WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.910 align:middle line:90%
Now, if you're serious about
a career in cybersecurity,

3
00:02.910 --> 00:05.700 align:middle line:90%
you're going to have to get
serious about understanding

4
00:05.700 --> 00:08.820 align:middle line:90%
what attacks are going to
be leveraged against you.

5
00:08.820 --> 00:11.310 align:middle line:90%
And luckily, there is a
pretty large community

6
00:11.310 --> 00:13.710 align:middle line:90%
and resources where you
can go to research what's

7
00:13.710 --> 00:15.240 align:middle line:84%
going on in today's world.

8
00:15.240 --> 00:17.820 align:middle line:90%
What are the most common threats
that are used against us?

9
00:17.820 --> 00:20.550 align:middle line:90%
In fact, there is an
organization, OWASP,

10
00:20.550 --> 00:22.740 align:middle line:90%
that is all about
educating people

11
00:22.740 --> 00:25.230 align:middle line:90%
on the different types of
attacks that are out there,

12
00:25.230 --> 00:27.930 align:middle line:90%
as well as how you can mitigate
these types of attacks,

13
00:27.930 --> 00:30.508 align:middle line:90%
especially in code or
other items like that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:27.930 --> 00:30.508 align:middle line:90%
especially in code or
other items like that.

14
00:30.508 --> 00:31.050 align:middle line:84%
So get ready.

15
00:31.050 --> 00:33.630 align:middle line:90%
In this particular skill, I'm
going to introduce you to OWASP

16
00:33.630 --> 00:36.810 align:middle line:90%
and show you how you can
explore what types of attacks

17
00:36.810 --> 00:39.060 align:middle line:90%
are really out there, and
their mitigation techniques.

18
00:39.060 --> 00:40.893 align:middle line:90%
This is going to be
really, really important

19
00:40.893 --> 00:44.790 align:middle line:90%
for you to use this organization
and this resource in your day

20
00:44.790 --> 00:45.660 align:middle line:84%
to day career.

21
00:45.660 --> 00:46.750 align:middle line:84%
Let's get going.

22
00:46.750 --> 00:49.290 align:middle line:90%
So this video is going to
be all about introducing you

23
00:49.290 --> 00:52.890 align:middle line:90%
to one of the most reputable
organizations for sharing

24
00:52.890 --> 00:56.040 align:middle line:90%
information and helping you
assess your own security

25
00:56.040 --> 00:59.130 align:middle line:90%
posture and get better at
protecting yourself-- the Open

26
00:59.130 --> 01:02.190 align:middle line:90%
Web Application Security
Project, or OWASP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.130 --> 01:02.190 align:middle line:90%
Web Application Security
Project, or OWASP.

27
01:02.190 --> 01:05.610 align:middle line:90%
This is a nonprofit,
worldwide foundation

28
01:05.610 --> 01:07.920 align:middle line:90%
that's all about
learning and investing

29
01:07.920 --> 01:10.830 align:middle line:90%
in assessing the
current threat landscape

30
01:10.830 --> 01:13.290 align:middle line:90%
and talking about how
we can protect ourselves

31
01:13.290 --> 01:13.957 align:middle line:84%
from bad actors.

32
01:13.957 --> 01:15.582 align:middle line:90%
Now, the way this
really works, there's

33
01:15.582 --> 01:16.920 align:middle line:84%
a couple ways that this works.

34
01:16.920 --> 01:19.723 align:middle line:90%
It's free, first of all, to
use, but you can't join them

35
01:19.723 --> 01:22.140 align:middle line:90%
as a member-- and, of course,
you can donate to them, too,

36
01:22.140 --> 01:23.640 align:middle line:84%
if you feel so inclined.

37
01:23.640 --> 01:25.650 align:middle line:90%
They have events
where they actually

38
01:25.650 --> 01:26.370 align:middle line:84%
have-- you can see right here.

39
01:26.370 --> 01:27.780 align:middle line:90%
It's like a picture
of an event where

40
01:27.780 --> 01:30.072 align:middle line:90%
people are talking about
security and they get together
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:27.780 --> 01:30.072 align:middle line:90%
people are talking about
security and they get together

41
01:30.072 --> 01:32.580 align:middle line:90%
and they have conferences
or learning spotlights,

42
01:32.580 --> 01:34.590 align:middle line:90%
monthly chapter
meetings, and so on.

43
01:34.590 --> 01:36.750 align:middle line:90%
They also do have
local chapters where

44
01:36.750 --> 01:39.300 align:middle line:90%
you can see how you can
get involved locally

45
01:39.300 --> 01:40.890 align:middle line:84%
in your own threat landscape.

46
01:40.890 --> 01:42.390 align:middle line:90%
But the real thing
that the majority

47
01:42.390 --> 01:44.280 align:middle line:90%
of people come
here to do is they

48
01:44.280 --> 01:46.590 align:middle line:84%
look at the individual projects.

49
01:46.590 --> 01:50.460 align:middle line:90%
Because security itself is
a gigantic, moving thing,

50
01:50.460 --> 01:53.460 align:middle line:90%
there's not just one
website or one project that

51
01:53.460 --> 01:55.620 align:middle line:84%
encompasses all of security.

52
01:55.620 --> 01:57.390 align:middle line:90%
If we click on Projects,
we'll just see.

53
01:57.390 --> 01:59.717 align:middle line:90%
This is kind of the Browse
All Projects section.

54
01:59.717 --> 02:01.800 align:middle line:90%
And you can scroll down,
it tells you a little bit
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:59.717 --> 02:01.800 align:middle line:90%
And you can scroll down,
it tells you a little bit

55
02:01.800 --> 02:02.550 align:middle line:84%
about the projects.

56
02:02.550 --> 02:03.175 align:middle line:84%
But here we go.

57
02:03.175 --> 02:04.590 align:middle line:84%
Let's start by looking at this.

58
02:04.590 --> 02:06.620 align:middle line:90%
The flagship products
are, obviously,

59
02:06.620 --> 02:09.419 align:middle line:90%
this is basically saying this
is why you came to OWASP,

60
02:09.419 --> 02:10.949 align:middle line:84%
is to learn about these things.

61
02:10.949 --> 02:13.140 align:middle line:90%
And probably their
most well-known project

62
02:13.140 --> 02:15.540 align:middle line:84%
is the OWASP Top Ten.

63
02:15.540 --> 02:19.200 align:middle line:90%
This is talking about the
OWASP top 10 most commonly used

64
02:19.200 --> 02:23.290 align:middle line:90%
threats and attacks that are out
there and how to mitigate them.

65
02:23.290 --> 02:25.680 align:middle line:90%
Now I'm going to jump into
the OWASP top Ten in a second,

66
02:25.680 --> 02:28.800 align:middle line:90%
but I also want to draw your
attention to some other things

67
02:28.800 --> 02:30.390 align:middle line:84%
like the Cheat Sheet series.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:28.800 --> 02:30.390 align:middle line:84%
like the Cheat Sheet series.

68
02:30.390 --> 02:33.270 align:middle line:90%
This is huge, because
this is a quick snapshot

69
02:33.270 --> 02:36.600 align:middle line:90%
of how attacks work and
their mitigation steps.

70
02:36.600 --> 02:39.240 align:middle line:90%
We also have the Mobile
Top Ten, because threats

71
02:39.240 --> 02:41.730 align:middle line:90%
against mobile devices are
very different than threats

72
02:41.730 --> 02:43.860 align:middle line:90%
against physical and
on-premise devices.

73
02:43.860 --> 02:46.860 align:middle line:90%
There is a testing guide for
you to test your own security

74
02:46.860 --> 02:50.010 align:middle line:90%
items, and then there's also
dependency checks and tracks

75
02:50.010 --> 02:52.320 align:middle line:90%
so that you can see what
types of dependencies

76
02:52.320 --> 02:55.260 align:middle line:90%
are needed in order to secure
against different threats.

77
02:55.260 --> 02:56.620 align:middle line:84%
I can't stress this enough.

78
02:56.620 --> 03:00.180 align:middle line:90%
If you're really serious
about a career in IT security,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:56.620 --> 03:00.180 align:middle line:90%
If you're really serious
about a career in IT security,

79
03:00.180 --> 03:02.820 align:middle line:90%
you need to spend a
little bit of time

80
03:02.820 --> 03:05.040 align:middle line:90%
just poking around in
this website, particularly

81
03:05.040 --> 03:05.708 align:middle line:84%
the Top Ten.

82
03:05.708 --> 03:07.500 align:middle line:90%
That's going to be
really, really important

83
03:07.500 --> 03:10.740 align:middle line:90%
for you to understand and learn
about the threat landscape.

84
03:10.740 --> 03:12.760 align:middle line:90%
But then they also
have lab projects,

85
03:12.760 --> 03:15.240 align:middle line:90%
which is where they're actually
practicing and creating

86
03:15.240 --> 03:18.480 align:middle line:90%
applications that will
help you secure yourself.

87
03:18.480 --> 03:20.850 align:middle line:84%
Like an API security project.

88
03:20.850 --> 03:22.650 align:middle line:90%
The WebGoat is
something we're actually

89
03:22.650 --> 03:24.233 align:middle line:90%
going to see in the
next Nugget, where

90
03:24.233 --> 03:26.790 align:middle line:90%
we practice attacks and
learn how attackers use them

91
03:26.790 --> 03:27.810 align:middle line:84%
against us.

92
03:27.810 --> 03:30.570 align:middle line:90%
We have a Java HTML
sanitizer, so we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:27.810 --> 03:30.570 align:middle line:90%
We have a Java HTML
sanitizer, so we

93
03:30.570 --> 03:33.450 align:middle line:90%
can parse through our Java code
and figure out or recommend

94
03:33.450 --> 03:36.420 align:middle line:90%
ways that we can
sanitize our own code.

95
03:36.420 --> 03:38.580 align:middle line:90%
Then they have new projects
that are up and coming.

96
03:38.580 --> 03:40.350 align:middle line:84%
This is the Incubator Projects.

97
03:40.350 --> 03:43.050 align:middle line:90%
You can create a honeypot
to try and attract people

98
03:43.050 --> 03:44.940 align:middle line:90%
in and see what it is
that they're trying

99
03:44.940 --> 03:46.500 align:middle line:84%
to attack in the first place.

100
03:46.500 --> 03:50.597 align:middle line:90%
There's a DDOS prevention, using
DPI, deep packet inspection.

101
03:50.597 --> 03:51.930 align:middle line:84%
I think that's really cool, too.

102
03:51.930 --> 03:54.030 align:middle line:90%
These are new projects
that they're currently

103
03:54.030 --> 03:58.680 align:middle line:90%
exploring and trying to find new
ways to secure our environment

104
03:58.680 --> 04:00.500 align:middle line:84%
and our code and application.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
03:58.680 --> 04:00.500 align:middle line:84%
and our code and application.

105
04:00.500 --> 04:03.000 align:middle line:90%
And then, of course, they have
these types of projects where

106
04:03.000 --> 04:04.680 align:middle line:90%
they're saying, hey,
we actually need

107
04:04.680 --> 04:07.690 align:middle line:90%
some help maintaining and
contributing to these projects.

108
04:07.690 --> 04:10.590 align:middle line:90%
So if you're feeling so
inclined to jump in and actually

109
04:10.590 --> 04:11.850 align:middle line:84%
contribute to these projects.

110
04:11.850 --> 04:13.920 align:middle line:90%
These are the projects
needing website update,

111
04:13.920 --> 04:16.470 align:middle line:90%
and you can actually
get involved with OWASP

112
04:16.470 --> 04:18.519 align:middle line:90%
and see what you can
do to help them out.

113
04:18.519 --> 04:21.019 align:middle line:90%
So let's jump back up and let's
click on that OWASP Top Ten,

114
04:21.019 --> 04:23.040 align:middle line:90%
because that is a pretty
major talking point.

115
04:23.040 --> 04:23.760 align:middle line:84%
Here you go.

116
04:23.760 --> 04:26.578 align:middle line:90%
This shows us different
types of attacks

117
04:26.578 --> 04:27.870 align:middle line:84%
that are being used against us.

118
04:27.870 --> 04:30.328 align:middle line:90%
And if you're looking ahead
and you're seeing the playlist,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:27.870 --> 04:30.328 align:middle line:90%
And if you're looking ahead
and you're seeing the playlist,

119
04:30.328 --> 04:33.220 align:middle line:90%
you see we've got SQL injection
coming up on the playlist.

120
04:33.220 --> 04:35.010 align:middle line:84%
This is a number one attack.

121
04:35.010 --> 04:37.290 align:middle line:90%
They're going to try and
use these types of attacks,

122
04:37.290 --> 04:40.830 align:middle line:90%
injection attacks against
you where they can send code

123
04:40.830 --> 04:44.220 align:middle line:90%
in through your website to
be executed on your server.

124
04:44.220 --> 04:46.890 align:middle line:90%
The cross-site scripting attack
is another really, really

125
04:46.890 --> 04:48.970 align:middle line:90%
common one that we're
going to be exploring.

126
04:48.970 --> 04:51.240 align:middle line:90%
So just to show you how you
can navigate through this,

127
04:51.240 --> 04:52.720 align:middle line:84%
we'll click on Injection.

128
04:52.720 --> 04:54.360 align:middle line:90%
This is where it
tells you information

129
04:54.360 --> 04:56.160 align:middle line:84%
about the attack itself.

130
04:56.160 --> 04:58.110 align:middle line:90%
What is the threat
and the attack vector?

131
04:58.110 --> 05:01.440 align:middle line:90%
What are your weaknesses, and
what is the impact going to be?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:58.110 --> 05:01.440 align:middle line:90%
What are your weaknesses, and
what is the impact going to be?

132
05:01.440 --> 05:03.810 align:middle line:90%
It tells you where you can
look for these weaknesses

133
05:03.810 --> 05:06.270 align:middle line:90%
within an application
and what you can even do,

134
05:06.270 --> 05:09.280 align:middle line:90%
quick steps to prevent
this attack from happening.

135
05:09.280 --> 05:11.400 align:middle line:90%
Then it even shows
you examples of how

136
05:11.400 --> 05:12.960 align:middle line:84%
the attack is carried out.

137
05:12.960 --> 05:15.180 align:middle line:90%
And the cool thing about
OWASP is they update

138
05:15.180 --> 05:17.040 align:middle line:84%
this information all the time.

139
05:17.040 --> 05:18.660 align:middle line:90%
That's what's
really, really great.

140
05:18.660 --> 05:21.000 align:middle line:90%
And considering this
is a free organization

141
05:21.000 --> 05:23.820 align:middle line:90%
that you can just use right
now-- right this very second,

142
05:23.820 --> 05:25.860 align:middle line:90%
you can fire up this
website and just start

143
05:25.860 --> 05:29.100 align:middle line:90%
learning from it
immediately, or, even cooler,

144
05:29.100 --> 05:31.830 align:middle line:90%
get registered for their
security conferences
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:29.100 --> 05:31.830 align:middle line:90%
get registered for their
security conferences

145
05:31.830 --> 05:34.770 align:middle line:90%
and get training on these
different types of attacks

146
05:34.770 --> 05:36.060 align:middle line:84%
and mitigation techniques.

147
05:36.060 --> 05:37.270 align:middle line:84%
I can't stress this enough.

148
05:37.270 --> 05:39.720 align:middle line:90%
This is why this video is
coming first in this skill,

149
05:39.720 --> 05:42.030 align:middle line:90%
because this is something
that you should absolutely be

150
05:42.030 --> 05:43.770 align:middle line:84%
taking advantage of right now.

151
05:43.770 --> 05:47.070 align:middle line:90%
So that's introducing you to
OWASP and the top 10 threats.

152
05:47.070 --> 05:48.780 align:middle line:90%
I hope this has been
informative for you

153
05:48.780 --> 05:51.230 align:middle line:84%
and I'd like to thank you for--