Now, if you're serious about a career in cybersecurity,
you're going to have to get serious about understanding
what attacks are going to be leveraged against you.
And luckily, there is a pretty large community
and resources where you can go to research what's
going on in today's world.
What are the most common threats that are used against us?
In fact, there is an organization, OWASP,
that is all about educating people
on the different types of attacks that are out there,
as well as how you can mitigate these types of attacks,
especially in code or other items like that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
especially in code or other items like that.
So get ready.
In this particular skill, I'm going to introduce you to OWASP
and show you how you can explore what types of attacks
are really out there, and their mitigation techniques.
This is going to be really, really important
for you to use this organization and this resource in your day
to day career.
Let's get going.
So this video is going to be all about introducing you
to one of the most reputable organizations for sharing
information and helping you assess your own security
posture and get better at protecting yourself-- the Open
Web Application Security Project, or OWASP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Web Application Security Project, or OWASP.
This is a nonprofit, worldwide foundation
that's all about learning and investing
in assessing the current threat landscape
and talking about how we can protect ourselves
from bad actors.
Now, the way this really works, there's
a couple ways that this works.
It's free, first of all, to use, but you can't join them
as a member-- and, of course, you can donate to them, too,
if you feel so inclined.
They have events where they actually
have-- you can see right here.
It's like a picture of an event where
people are talking about security and they get together WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
people are talking about security and they get together
and they have conferences or learning spotlights,
monthly chapter meetings, and so on.
They also do have local chapters where
you can see how you can get involved locally
in your own threat landscape.
But the real thing that the majority
of people come here to do is they
look at the individual projects.
Because security itself is a gigantic, moving thing,
there's not just one website or one project that
encompasses all of security.
If we click on Projects, we'll just see.
This is kind of the Browse All Projects section.
And you can scroll down, it tells you a little bit WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And you can scroll down, it tells you a little bit
about the projects.
But here we go.
Let's start by looking at this.
The flagship products are, obviously,
this is basically saying this is why you came to OWASP,
is to learn about these things.
And probably their most well-known project
is the OWASP Top Ten.
This is talking about the OWASP top 10 most commonly used
threats and attacks that are out there and how to mitigate them.
Now I'm going to jump into the OWASP top Ten in a second,
but I also want to draw your attention to some other things
like the Cheat Sheet series. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
like the Cheat Sheet series.
This is huge, because this is a quick snapshot
of how attacks work and their mitigation steps.
We also have the Mobile Top Ten, because threats
against mobile devices are very different than threats
against physical and on-premise devices.
There is a testing guide for you to test your own security
items, and then there's also dependency checks and tracks
so that you can see what types of dependencies
are needed in order to secure against different threats.
I can't stress this enough.
If you're really serious about a career in IT security, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If you're really serious about a career in IT security,
you need to spend a little bit of time
just poking around in this website, particularly
the Top Ten.
That's going to be really, really important
for you to understand and learn about the threat landscape.
But then they also have lab projects,
which is where they're actually practicing and creating
applications that will help you secure yourself.
Like an API security project.
The WebGoat is something we're actually
going to see in the next Nugget, where
we practice attacks and learn how attackers use them
against us.
We have a Java HTML sanitizer, so we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have a Java HTML sanitizer, so we
can parse through our Java code and figure out or recommend
ways that we can sanitize our own code.
Then they have new projects that are up and coming.
This is the Incubator Projects.
You can create a honeypot to try and attract people
in and see what it is that they're trying
to attack in the first place.
There's a DDOS prevention, using DPI, deep packet inspection.
I think that's really cool, too.
These are new projects that they're currently
exploring and trying to find new ways to secure our environment
and our code and application. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and our code and application.
And then, of course, they have these types of projects where
they're saying, hey, we actually need
some help maintaining and contributing to these projects.
So if you're feeling so inclined to jump in and actually
contribute to these projects.
These are the projects needing website update,
and you can actually get involved with OWASP
and see what you can do to help them out.
So let's jump back up and let's click on that OWASP Top Ten,
because that is a pretty major talking point.
Here you go.
This shows us different types of attacks
that are being used against us.
And if you're looking ahead and you're seeing the playlist, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if you're looking ahead and you're seeing the playlist,
you see we've got SQL injection coming up on the playlist.
This is a number one attack.
They're going to try and use these types of attacks,
injection attacks against you where they can send code
in through your website to be executed on your server.
The cross-site scripting attack is another really, really
common one that we're going to be exploring.
So just to show you how you can navigate through this,
we'll click on Injection.
This is where it tells you information
about the attack itself.
What is the threat and the attack vector?
What are your weaknesses, and what is the impact going to be? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What are your weaknesses, and what is the impact going to be?
It tells you where you can look for these weaknesses
within an application and what you can even do,
quick steps to prevent this attack from happening.
Then it even shows you examples of how
the attack is carried out.
And the cool thing about OWASP is they update
this information all the time.
That's what's really, really great.
And considering this is a free organization
that you can just use right now-- right this very second,
you can fire up this website and just start
learning from it immediately, or, even cooler,
get registered for their security conferences WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
get registered for their security conferences
and get training on these different types of attacks
and mitigation techniques.
I can't stress this enough.
This is why this video is coming first in this skill,
because this is something that you should absolutely be
taking advantage of right now.
So that's introducing you to OWASP and the top 10 threats.
I hope this has been informative for you
and I'd like to thank you for--