Jeff Williams -- The History of OWASP

OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together. Jeff Williams joins Chris to trace that early history, from their consulting roots to the first Top 10, the Foundation, and the growth of community events. He explains the tradeoffs behind an awareness list, the importance of independence, and why recognition alone does not make software safer. Their conversation also examines open-source project visibility, participation, and the difficulty of turning useful work into something more developers can discover and adopt. Jeff’s firsthand account offers both a history lesson and a challenge to the community: simplify security, communicate the value of its tools, and keep expanding who can contribute.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Jeff Williams:→ Jeff Williams on LinkedIn→ Contrast SecurityMentioned in this episode:→ OWASP Foundation→ OWASP Top 10→ OWASP WebGoat→ OWASP DefectDojo→ OWASP Dependency-CheckFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 OWASP’s history with Jeff Williams01:39 Shared roots in security consulting07:47 The early days of OWASP11:13 Creating the first OWASP Top 1014:22 Evidence, judgment, and the Top 1017:48 Independence and outside interests18:12 The Top 10’s growing influence20:27 Simplifying the work of fixing vulnerabilities23:15 Forming the Foundation and early conferences29:46 Helping people discover OWASP projects30:33 DefectDojo and communicating project value33:20 Dependency-Check and broader adoption35:49 Improving OWASP through participation