Ralph Andalis

Ralph Andalis

Ralph Andalis

Pentester | Security Consultant | Security Researcher

Ralph is an independent Security Consultant/Pentester/Security Researcher with 8 years experience in the industry who recently served as a Security Consultant in a global information security assurance firm called NCC Group. His expertise is mainly Web, Mobile, and Network Pentesting, Threat Modeling, Security Architecture Review, and Security Design Reviews. Prior to that, he was a pioneer Application Security Consultant for Fwdsec, a Cyber Threat Management Consultant at Ernst & Young (EY) with the experience of being sent abroad for client engagements upon client request. He started his career as a Security Researcher at Hewlett-Packard Fortify with focus on Mobile Application Security particularly with Android and iOS.

He is also a major active contributor and a member of the working group for the OWASP Application Security Verification Standard (ASVS) project, making the standard better for fellow pentesters and developers alike. Whenever he has spare time, he volunteers giving Web, Mobile Application Security and Threat Modelling lectures to university students as part of being a thought leader in the security community and outreach to students. You can also find him as a regular conference volunteer staff for some premium and well-known security conferences, namely: CanSecWest, REcon and Ringzer0 Training.

He earned his Computer Science degree from Ateneo de Naga University - one of the best top tier schools in the Philippines. His bachelor degree thesis was awarded in a National IT Conference last 2015 as one of his top accomplishments during that time aside from being a consistent Dean’s List award as well.

Presentation Abstract

OWASP ASVS: A Methodical and Practical Approach to Application Security Testing

OWASP Application Security Verification Standard (ASVS) is a list of application security requirements or tests that can be used by architects, developers, testers, security professionals, tool vendors, and consumers to define, build, test and verify secure applications. It has been gaining popularity over the recent years to even getting itself as part of the ‘must know’ knowledge for some AppSec job postings, yet a lot of people are confused with its usage and how to really use it. This talk will discuss some of the nuances and approaches to a more methodical and practical web app pentest and how can someone use it efficiently whether they are a builder (developer), planner (architect) or breaker (pentester).

This talk will go through the overview of ASVS, its main purpose and usage, categories and subsections, practical examples of several requirements that could be easily tested (pentester’s view), practical examples as well of some requirements that people have difficulty to interpret and test (developer and pentester’s view), also demystify some of the confusing requirements and a bit of sneak peek for the upcoming version 5.0 (fixes and work in progress).

Get Tickets