OWASP Global AppSec

OWASP Global AppSec
Name	OWASP Global AppSec
Status	Active
Genre	Computer security conference
Frequency	Annual
Organizer	Open Web Application Security Project
First	2008
Location	Rotating global locations

OWASP Global AppSec OWASP Global AppSec is the flagship conference series organized by the Open Web Application Security Project, bringing together practitioners, researchers, vendors, and policymakers to address application security challenges. The event convenes speakers, trainers, and sponsors from across the software industry, cybersecurity research labs, standards bodies, and academic institutions to share threat intelligence, secure development practices, and compliance strategies. Attendees include representatives from major technology companies, cloud providers, regulatory agencies, and open source projects.

Overview

OWASP Global AppSec serves as a focal point for collaboration among organizations such as Microsoft, Google, Amazon Web Services, IBM, Apple Inc., Cisco Systems, Intel, Oracle Corporation, Facebook, GitHub, Red Hat, VMware, Accenture, Deloitte, PwC, KPMG, Ernst & Young, Capgemini, Atlassian, Salesforce, Adobe Inc., SAP SE, Nokia, Samsung Electronics, Siemens, HP Inc., Dell Technologies, Trustwave, Check Point Software Technologies, Palo Alto Networks, Fortinet, CrowdStrike, FireEye, Tenable, Inc., Rapid7, Qualys, Splunk, SANS Institute, ISACA, (ISC)², NIST, ENISA, CERT Coordination Center, MITRE Corporation, OW2 Consortium, Linux Foundation, Cloud Security Alliance, European Commission, United States Department of Homeland Security, National Security Agency, Federal Trade Commission and other stakeholders. The program emphasizes secure coding, threat modeling, vulnerability management, and application risk reduction aligned with standards from ISO/IEC 27001, PCI DSS, GDPR, HIPAA, SOX, FISMA, CISA, NIST Cybersecurity Framework, and audit frameworks used by enterprise customers.

History and Evolution

The conference evolved from regional meetups and chapters influenced by early web security work at organizations like Netscape Communications Corporation, Mozilla Foundation, Apache Software Foundation, Sun Microsystems, Oracle Corporation, Google, Facebook, Twitter, LinkedIn, Yahoo!, eBay Inc., PayPal Holdings, Inc., Shopify, Atlassian, and research labs at MIT, Stanford University, Carnegie Mellon University, University of Cambridge, University of Oxford, ETH Zurich, EPFL, Tsinghua University, National University of Singapore, University of Toronto, University of California, Berkeley, Harvard University, Princeton University, Yale University, Columbia University, Cornell University, University of Washington, and University of Michigan. High-profile incidents such as breaches at Equifax, Target Corporation, Yahoo!, Sony Pictures Entertainment, Home Depot, Marriott International, Capital One, Anthem Inc., Ashley Madison, LinkedIn, MGM Resorts International, SolarWinds, and Colonial Pipeline helped shape conference agendas toward supply chain security, incident response, and secure DevOps. Influential standards and projects like the OWASP Top Ten, CWE, CAPEC, NIST SP 800-53, and the SANS Top 25 have been central themes across editions.

Conferences and Events

Global AppSec editions have been staged alongside regional counterparts and partner events from groups such as Black Hat, DEF CON, RSA Conference, BSides, ShmooCon, CanSecWest, Infosecurity Europe, Infosecurity North America, BlueHat, Hack In The Box, Troopers, Hack.LU, Nullcon, DerbyCon, LockCon, and academic symposia like USENIX Security Symposium, IEEE Symposium on Security and Privacy, ACM CCS, NDSS Symposium, RAID, ESORICS, and Oakland. Programming typically includes keynote addresses, breakout tracks, training workshops, capture-the-flag competitions, vendor expos, lightning talks, and panel discussions featuring leaders from RSA Conference, SANS Institute, (ISC)², ISACA, NIST, ENISA, European Parliament, World Bank, International Monetary Fund, Bank for International Settlements, Federal Reserve System, European Central Bank, and major universities. The conference often partners with certification providers and training organizations such as GIAC, EC-Council, ISACA, and university continuing education programs.

Program Tracks and Content

Program tracks cover topics championed by contributors like the OWASP Top Ten authors, secure design projects influenced by Design Patterns from software firms, threat research inspired by incidents involving Stuxnet, WannaCry, NotPetya, Mirai botnet, Spectre and Meltdown, and Heartbleed, and defensive tooling from projects at CNCF, Kubernetes, Docker, Prometheus, Istio, Envoy, Helm, OpenSSL, Let's Encrypt, LibreSSL, BoringSSL, Metasploit Project, Burp Suite, Nmap, Wireshark, John the Ripper, Aircrack-ng, Snort, Suricata, Zeek (formerly Bro), OSSEC, and Wazuh. Tracks include secure SDLC, DevSecOps, cloud security, mobile application security, API security, IoT security, identity and access management, cryptography, fuzzing, threat intelligence, red team/blue team exercises, privacy engineering, and legal/compliance sessions referencing laws like EU GDPR, California Consumer Privacy Act, US CLOUD Act, Digital Millennium Copyright Act, Computer Fraud and Abuse Act, and international treaties. Workshops often derive material from projects hosted by OWASP Foundation, Mozilla Foundation, Apache Software Foundation, Linux Foundation, Cloud Native Computing Foundation, and university research groups.

Community and Governance

The conference is organized by volunteers, chapter leaders, and a governance board aligned with non-profit structures similar to the OWASP Foundation model and governance approaches used by Mozilla Foundation, Apache Software Foundation, Linux Foundation, Free Software Foundation, Electronic Frontier Foundation, and Open Source Initiative. Advisory boards often include representatives from vendors, academic institutions, and standards bodies such as NIST, ENISA, ISO, and IEC. Community contributions come from local chapters, special interest groups, student groups from universities like MIT, Stanford University, University of Oxford, University of Cambridge, ETH Zurich, University of Tokyo, and corporate security teams from firms previously mentioned. Sponsorship tiers and speaker selection follow transparent policies comparable to governance at Apache Foundation conferences and open call-for-proposals processes used by academic conferences.

Impact and Contributions to Application Security

Global AppSec has amplified the adoption of resources and standards produced by contributors such as the OWASP Top Ten, OWASP ASVS, CWE, CAPEC, NIST Cybersecurity Framework, ISO/IEC 27001, PCI DSS, and influenced vendor roadmaps at Microsoft, Google, Amazon Web Services, IBM, Oracle Corporation, Cisco Systems, Red Hat, VMware, GitHub, Atlassian, Adobe Inc., and cloud-native projects in the Cloud Native Computing Foundation. The conference has helped seed research cited in academic venues like ACM CCS, USENIX Security Symposium, IEEE S&P, and NDSS, informed regulatory testimony before bodies such as the European Parliament and United States Congress, and supported workforce development through collaboration with SANS Institute, (ISC)², ISACA, GIAC, and university programs. Initiatives showcased at Global AppSec—ranging from secure coding curricula to vulnerability disclosure frameworks—have contributed to incident mitigation efforts involving entities like Equifax, Target Corporation, SolarWinds, and Colonial Pipeline by promoting best practices, tooling, and cross-sector coordination.

Category:Computer security conferences