https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=BkoelewijnOWASP - User contributions [en]2026-04-26T10:11:10ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=Netherlands&diff=62220Netherlands2009-05-27T10:28:27Z<p>Bkoelewijn: Undo revision 62209 by BoeltLalet (Talk)</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein<br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17<br />
4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : AppSec Europe 2009<br />
Presentations: AppSec-EU 2009 Sebastien Deleersnyder, Telindus <br />
VAC Cross-Site Request Forgery Niels Teusink<br />
Open session / discussion about subjects brought forward by <br />
the attendees Martin Knobloch/Ferdinand Vroom/Peter Gouwentak<br />
Location : ASR Nederland<br />
MD0.60 - Auditorium<br />
Smallepad 30<br />
3811MG Amersfoort<br />
Sponsor : ASR Nederland<br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: bert.koelewijn@owasp.org<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don't have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br/><br />
<br />
== Meeting Schedule May 28th 2009: AppSec Europe 2009 ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide an abstract of the recently held AppSec Europe 2009, a VAC about CSRF and, new, an open discussion on application security subjects brought forward by the attendees. <br />
<table><br />
<tr><br />
<td width="350"><br />
ASR Nederland<br/><br />
<br/><br />
MD0.60 - Auditorium<br/><br />
Smallepad 30<br/><br />
3811MG Amersfoort<br/><br />
</td><br />
<td width="650"><br />
[[Image:ASR Nederland logo.jpg|200px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
<br />
<br/><br />
<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 - 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
<br />
'''18.45 - 19.45 AppSec-EU 2009 (Sebastien Deleersnyder, Telindus) '''<br><br />
Update on the AppSec-EU 2009: <br><br />
OWASP State of the union, an update on OWASP and OWASP projects and of course the highlights of the AppSec-EU 2009 presentations.<br />
<br />
'''19.45 - 20.00 Break '''<br><br />
<br />
'''20.00 - 20.30 VAC Cross-Site Request Forgery (Niels Teusink, Fox-IT) ''' <br><br />
CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.<br />
<br />
Niels Teusink holds a bachelor degree in Computer Science and has been experimenting with IT security for over a decade. He has worked for Fox-IT since 2005; first as a software engineer and since 2007 as a penetration tester. He has since performed dozens of penetration tests for all sorts of companies, including governments, banks and nuclear installations.<br />
<br />
'''20.30 - 21.15 Open session / discussion (Martin Knobloch/Ferdinand Vroom/Peter Gouwentak) ''' <br><br />
Open session / discussion about subjects brought forward by the attendees.<br />
<br />
The Announcement of this meeting: [[Media:Announcement OWASP-NL May 28th 2009.pdf]]<br><br />
The flyer of this meeting: [[Media:owasp_NL_may2009.pdf]]<br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 - 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''([[Media:20090409_passsive_reconnaissance_Dave_van_Stein.pdf]])<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he's working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 - 20.00 VAC Cross-site scripting Martin Visser '''([[Media:20090409_VAC_Cross-site-scripting_Martin_Visser.pdf]])<br><br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security - Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 - 20.15 Break ''' <br><br />
'''20.15 - 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers ''' ([[Media:20090409_presentatie_Wouter_van_Kuipers.pdf]])<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=62141Netherlands2009-05-27T07:40:44Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein<br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17<br />
4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : AppSec Europe 2009<br />
Presentations: AppSec-EU 2009 Sebastien Deleersnyder, Telindus <br />
VAC Cross-Site Request Forgery Niels Teusink<br />
Open session / discussion about subjects brought forward by <br />
the attendees Martin Knobloch/Ferdinand Vroom/Peter Gouwentak<br />
Location : ASR Nederland<br />
MD0.60 - Auditorium<br />
Smallepad 30<br />
3811MG Amersfoort<br />
Sponsor : ASR Nederland<br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: bert.koelewijn@owasp.org<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don't have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br/><br />
<br />
== Meeting Schedule May 28th 2009: AppSec Europe 2009 ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide an abstract of the recently held AppSec Europe 2009, a VAC about CSRF and, new, an open discussion on application security subjects brought forward by the attendees. <br />
<table><br />
<tr><br />
<td width="350"><br />
ASR Nederland<br/><br />
<br/><br />
MD0.60 - Auditorium<br/><br />
Smallepad 30<br/><br />
3811MG Amersfoort<br/><br />
</td><br />
<td width="650"><br />
[[Image:ASR Nederland logo.jpg|200px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
<br />
<br/><br />
<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 - 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
<br />
'''18.45 - 19.45 AppSec-EU 2009 (Sebastien Deleersnyder, Telindus) '''<br><br />
Update on the AppSec-EU 2009: <br><br />
OWASP State of the union, an update on OWASP and OWASP projects and of course the highlights of the AppSec-EU 2009 presentations.<br />
<br />
'''19.45 - 20.00 Break '''<br><br />
<br />
'''20.00 - 20.30 VAC Cross-Site Request Forgery (Niels Teusink, Fox-IT) ''' <br><br />
CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.<br />
<br />
Niels Teusink holds a bachelor degree in Computer Science and has been experimenting with IT security for over a decade. He has worked for Fox-IT since 2005; first as a software engineer and since 2007 as a penetration tester. He has since performed dozens of penetration tests for all sorts of companies, including governments, banks and nuclear installations.<br />
<br />
'''20.30 - 21.15 Open session / discussion (Martin Knobloch/Ferdinand Vroom/Peter Gouwentak) ''' <br><br />
Open session / discussion about subjects brought forward by the attendees.<br />
<br />
The Announcement of this meeting: [[Media:Announcement OWASP-NL May 28th 2009.pdf]]<br><br />
The flyer of this meeting: [[Media:owasp_NL_may2009.pdf]]<br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 - 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''([[Media:20090409_passsive_reconnaissance_Dave_van_Stein.pdf]])<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he's working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 - 20.00 VAC Cross-site scripting Martin Visser '''([[Media:20090409_VAC_Cross-site-scripting_Martin_Visser.pdf]])<br><br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security - Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 - 20.15 Break ''' <br><br />
'''20.15 - 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers ''' ([[Media:20090409_presentatie_Wouter_van_Kuipers.pdf]])<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=62140Netherlands2009-05-27T07:39:37Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein<br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17<br />
4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : AppSec Europe 2009<br />
Presentations: AppSec-EU 2009 Sebastien Deleersnyder, Telindus <br />
VAC Cross-Site Request Forgery Niels Teusink<br />
Open session / discussion about subjects brought forward by <br />
the attendees Martin Knobloch/Ferdinand Vroom/Peter Gouwentak<br />
Location : ASR Nederland<br />
MD0.60 - Auditorium<br />
Smallepad 30<br />
3811MG Amersfoort<br />
Sponsor : ASR Nederland<br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: bert.koelewijn@owasp.org<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don't have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br/><br />
<br />
== Meeting Schedule May 28th 2009: AppSec Europe 2009 ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide an abstract of the recently held AppSec Europe 2009, a VAC about CSRF and, new, an open discussion on application security subjects brought forward by the attendees. <br />
<table><br />
<tr><br />
<td width="350"><br />
ASR Nederland<br/><br />
<br/><br />
MD0.60 - Auditorium<br/><br />
Smallepad 30<br/><br />
3811MG Amersfoort<br/><br />
</td><br />
<td width="650"><br />
[[Image:ASR Nederland logo.jpg|200px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
<br />
<br/><br />
<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 - 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
<br />
'''18.45 - 19.45 AppSec-EU 2009 (Sebastien Deleersnyder, Telindus) '''<br><br />
Update on the AppSec-EU 2009: <br><br />
OWASP State of the union, an update on OWASP and OWASP projects and of course the highlights of the AppSec-EU 2009 presentations.<br />
<br />
'''19.45 - 20.00 Break '''<br><br />
<br />
'''20.00 - 20.30 VAC Cross-Site Request Forgery (Niels Teusink, Fox-IT) ''' <br><br />
CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.<br />
<br />
Niels Teusink holds a bachelor degree in Computer Science and has been experimenting with IT security for over a decade. He has worked for Fox-IT since 2005; first as a software engineer and since 2007 as a penetration tester. He has since performed dozens of penetration tests for all sorts of companies, including governments, banks and nuclear installations.<br />
<br />
'''20.30 - 21.15 Open session / discussion (Martin Knobloch/Ferdinand Vroom/Peter Gouwentak) ''' <br><br />
Open session / discussion about subjects brought forward by the attendees.<br />
<br />
The Announcement of this meeting: [[Media:Announcement OWASP-NL May 28th 2009.pdf]]<br><br />
The flyer of this meeting: [[Media:owasp_NL_may2009.pdf]]<br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 â 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''([[Media:20090409_passsive_reconnaissance_Dave_van_Stein.pdf]])<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he's working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 - 20.00 VAC Cross-site scripting Martin Visser '''([[Media:20090409_VAC_Cross-site-scripting_Martin_Visser.pdf]])<br><br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security - Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 - 20.15 Break ''' <br><br />
'''20.15 - 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers ''' ([[Media:20090409_presentatie_Wouter_van_Kuipers.pdf]])<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=62139Netherlands2009-05-27T07:27:01Z<p>Bkoelewijn: Undo revision 61915 by BoeltLalet (Talk)</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein<br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17<br />
4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : AppSec Europe 2009<br />
Presentations: AppSec-EU 2009 Sebastien Deleersnyder, Telindus <br />
VAC Cross-Site Request Forgery Niels Teusink<br />
Open session / discussion about subjects brought forward by <br />
the attendees Martin Knobloch/Ferdinand Vroom/Peter Gouwentak<br />
Location : ASR Nederland<br />
MD0.60 - Auditorium<br />
Smallepad 30<br />
3811MG Amersfoort<br />
Sponsor : ASR Nederland<br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: bert.koelewijn@owasp.org<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don't have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br/><br />
<br />
== Meeting Schedule May 28th 2009: AppSec Europe 2009 ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide an abstract of the recently held AppSec Europe 2009, a VAC about CSRF and, new, an open discussion on application security subjects brought forward by the attendees. <br />
<table><br />
<tr><br />
<td width="350"><br />
ASR Nederland<br/><br />
<br/><br />
MD0.60 - Auditorium<br/><br />
Smallepad 30<br/><br />
3811MG Amersfoort<br/><br />
</td><br />
<td width="650"><br />
[[Image:ASR Nederland logo.jpg|200px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
<br />
<br/><br />
<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 - 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
<br />
'''18.45 - 19.45 AppSec-EU 2009 (Sebastien Deleersnyder, Telindus) '''<br><br />
Update on the AppSec-EU 2009: <br><br />
OWASP State of the union, an update on OWASP and OWASP projects and of course the highlights of the AppSec-EU 2009 presentations.<br />
<br />
'''19.45 - 20.00 Break '''<br><br />
<br />
'''20.00 - 20.30 VAC Cross-Site Request Forgery (Niels Teusink, Fox-IT) ''' <br><br />
CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.<br />
<br />
Niels Teusink holds a bachelor degree in Computer Science and has been experimenting with IT security for over a decade. He has worked for Fox-IT since 2005; first as a software engineer and since 2007 as a penetration tester. He has since performed dozens of penetration tests for all sorts of companies, including governments, banks and nuclear installations.<br />
<br />
'''20.30 - 21.15 Open session / discussion (Martin Knobloch/Ferdinand Vroom/Peter Gouwentak) ''' <br><br />
Open session / discussion about subjects brought forward by the attendees.<br />
<br />
The Announcement of this meeting: [[Media:Announcement OWASP-NL May 28th 2009.pdf]]<br><br />
The flyer of this meeting: [[Media:owasp_NL_may2009.pdf]]<br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 â 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''([[Media:20090409_passsive_reconnaissance_Dave_van_Stein.pdf]])<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he's working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 - 20.00 VAC Cross-site scripting Martin Visser '''([[Media:20090409_VAC_Cross-site-scripting_Martin_Visser.pdf]])<br><br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security â Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 - 20.15 Break ''' <br><br />
'''20.15 - 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers ''' ([[Media:20090409_presentatie_Wouter_van_Kuipers.pdf]])<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=61041Netherlands2009-05-20T06:06:20Z<p>Bkoelewijn: /* Meeting Schedule May 28th 2009: AppSec Europe 2009 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein<br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17<br />
4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : AppSec Europe 2009<br />
Presentations: AppSec-EU 2009 Sebastien Deleersnyder, Telindus <br />
VAC Cross-Site Request Forgery Niels Teusink<br />
Open session / discussion about subjects brought forward by <br />
the attendees Martin Knobloch/Ferdinand Vroom/Peter Gouwentak<br />
Location : ASR Nederland<br />
MD0.60 - Auditorium<br />
Smallepad 30<br />
3811MG Amersfoort<br />
Sponsor : ASR Nederland<br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: bert.koelewijn@owasp.org<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br/><br />
<br />
== Meeting Schedule May 28th 2009: AppSec Europe 2009 ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide an abstract of the recently held AppSec Europe 2009, a VAC about CSRF and, new, an open discussion on application security subjects brought forward by the attendees. <br />
<table><br />
<tr><br />
<td width="350"><br />
ASR Nederland<br/><br />
<br/><br />
MD0.60 - Auditorium<br/><br />
Smallepad 30<br/><br />
3811MG Amersfoort<br/><br />
</td><br />
<td width="650"><br />
[[Image:ASR Nederland logo.jpg|200px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
<br />
<br/><br />
<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 – 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
<br />
'''18.45 - 19.45 AppSec-EU 2009 (Sebastien Deleersnyder, Telindus) '''<br><br />
Update on the AppSec-EU 2009: <br><br />
OWASP State of the union, an update on OWASP and OWASP projects and of course the highlights of the AppSec-EU 2009 presentations.<br />
<br />
'''19.45 – 20.00 Break '''<br><br />
<br />
'''20.00 – 20.30 VAC Cross-Site Request Forgery (Niels Teusink, Fox-IT) ''' <br><br />
CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.<br />
<br />
Niels Teusink holds a bachelor degree in Computer Science and has been experimenting with IT security for over a decade. He has worked for Fox-IT since 2005; first as a software engineer and since 2007 as a penetration tester. He has since performed dozens of penetration tests for all sorts of companies, including governments, banks and nuclear installations.<br />
<br />
'''20.30 – 21.15 Open session / discussion (Martin Knobloch/Ferdinand Vroom/Peter Gouwentak) ''' <br><br />
Open session / discussion about subjects brought forward by the attendees.<br />
<br />
The flyer of this meeting: [[Media:Announcement OWASP-NL May 28th 2009.pdf]]<br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 – 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''([[Media:20090409_passsive_reconnaissance_Dave_van_Stein.pdf]])<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he’s working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 – 20.00 VAC Cross-site scripting Martin Visser '''([[Media:20090409_VAC_Cross-site-scripting_Martin_Visser.pdf]])<br><br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security – Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 – 20.15 Break ''' <br><br />
'''20.15 – 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers ''' ([[Media:20090409_presentatie_Wouter_van_Kuipers.pdf]])<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=61039Netherlands2009-05-20T06:01:33Z<p>Bkoelewijn: /* Meeting schedule 2009 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein<br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17<br />
4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : AppSec Europe 2009<br />
Presentations: AppSec-EU 2009 Sebastien Deleersnyder, Telindus <br />
VAC Cross-Site Request Forgery Niels Teusink<br />
Open session / discussion about subjects brought forward by <br />
the attendees Martin Knobloch/Ferdinand Vroom/Peter Gouwentak<br />
Location : ASR Nederland<br />
MD0.60 - Auditorium<br />
Smallepad 30<br />
3811MG Amersfoort<br />
Sponsor : ASR Nederland<br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: bert.koelewijn@owasp.org<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br/><br />
<br />
== Meeting Schedule May 28th 2009: AppSec Europe 2009 ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide an abstract of the recently held AppSec Europe 2009, a VAC about CSRF and, new, an open discussion on application security subjects brought forward by the attendees. <br />
<table><br />
<tr><br />
<td width="350"><br />
ASR Nederland<br/><br />
<br/><br />
MD0.60 - Auditorium<br/><br />
Smallepad 30<br/><br />
3811MG Amersfoort<br/><br />
</td><br />
<td width="650"><br />
[[Image:ASR Nederland logo.jpg]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
<br />
<br/><br />
<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 – 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
<br />
'''18.45 - 19.45 AppSec-EU 2009 (Sebastien Deleersnyder, Telindus) '''<br><br />
Update on the AppSec-EU 2009: <br><br />
OWASP State of the union, an update on OWASP and OWASP projects and of course the highlights of the AppSec-EU 2009 presentations.<br />
<br />
'''19.45 – 20.00 Break '''<br><br />
<br />
'''20.00 – 20.30 VAC Cross-Site Request Forgery (Niels Teusink, Fox-IT) ''' <br><br />
CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.<br />
<br />
Niels Teusink holds a bachelor degree in Computer Science and has been experimenting with IT security for over a decade. He has worked for Fox-IT since 2005; first as a software engineer and since 2007 as a penetration tester. He has since performed dozens of penetration tests for all sorts of companies, including governments, banks and nuclear installations.<br />
<br />
'''20.30 – 21.15 Open session / discussion (Martin Knobloch/Ferdinand Vroom/Peter Gouwentak) ''' <br><br />
Open session / discussion about subjects brought forward by the attendees.<br />
<br />
The flyer of this meeting: [[Media:Announcement OWASP-NL May 28th 2009.pdf]]<br />
<br />
<br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 – 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''([[Media:20090409_passsive_reconnaissance_Dave_van_Stein.pdf]])<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he’s working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 – 20.00 VAC Cross-site scripting Martin Visser '''([[Media:20090409_VAC_Cross-site-scripting_Martin_Visser.pdf]])<br><br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security – Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 – 20.15 Break ''' <br><br />
'''20.15 – 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers ''' ([[Media:20090409_presentatie_Wouter_van_Kuipers.pdf]])<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=60542Netherlands2009-05-11T15:32:28Z<p>Bkoelewijn: /* Meeting schedule 2009 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein <br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17, 4131 NJ Vianen<br />
088 - 660 66 00<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : AppSec Europe 2009<br />
Presentations: AppSec-EU 2009 Sebastien Deleersnyder, Telindus <br />
VAC Cross-Site Request Forgery Niels Teusink<br />
Open session / discussion about subjects brought forward by <br />
the attendees Martin Knobloch/Ferdinand Vroom/Peter Gouwentak<br />
Location : <br />
Sponsor : <br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: owasp@irc2.com.<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 – 18.45 Introduction (OWASP organization, projects, sponsor) '''([[Media:20090409_passsive_reconnaissance_Dave_van_Stein.pdf]])<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he’s working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 – 20.00 VAC Cross-site scripting Martin Visser '''([[Media:20090409_VAC_Cross-site-scripting_Martin_Visser.pdf]])<br><br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security – Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 – 20.15 Break ''' <br><br />
'''20.15 – 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers ''' ([[Media:20090409_presentatie_Wouter_van_Kuipers.pdf]])<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=56992Netherlands2009-03-19T08:29:23Z<p>Bkoelewijn: Undo revision 56788 by Favroom (Talk)</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein <br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17, 4131 NJ Vianen<br />
088 - 660 66 00<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: owasp@irc2.com.<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 – 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he’s working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 – 20.00 VAC Cross-site scripting Martin Visser ''' <br><br />
<br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security – Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 – 20.15 Break ''' <br><br />
'''20.15 – 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers '''<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=56991Netherlands2009-03-19T08:28:21Z<p>Bkoelewijn: Undo revision 56790 by Favroom (Talk)</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
=== Call for Speakers ===<br />
We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/><br />
'''Presentations:'''<br/><br />
Are you working on interesting subject, you would like to share your experiences with the OWASP community.<br />
Any topic related to application security will be appreciated!<br/><br />
'''VAC, Vulnerability, Attack, Countermeasure:'''<br/><br />
The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/><br />
<br />
=== Sponsorship of a local chapter meeting ===<br />
We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br><br />
'''Hosting a local chapter meeting:'''<br><br />
To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br><br />
'''Sponsorship of a local chapter meeting:'''<br><br />
You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br><br />
<br />
'''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''<br />
<br />
== Meeting schedule 2009 ==<br />
This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
April 9th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Knowing Your Enemy<br />
Presentations: Modern information gathering; how to abuse search engines Dave van Stein <br />
VAC Cross-site scripting Martin Visser <br />
Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers <br />
Location : Lange Dreef 17, 4131 NJ Vianen<br />
088 - 660 66 00<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
May 28th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
September 24th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
<br />
December 10th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : <br />
Presentations: <br />
Location : <br />
Sponsor : <br />
</pre><br />
<br />
<br />
<br />
'''Registration'''<br><br />
If you want to attend, please send an email to: owasp-netherlands@owasp.org.<br />
<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br />
== Meeting Schedule 9th April Knowing Your Enemy ==<br />
<br />
'''Summary'''<br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions. <br />
<table><br />
<tr><br />
<td width="350"><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
</td><br />
<td width="650"><br />
[[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="650"><br />
About Sogeti Nederland B.V.<br />
Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets. <br />
<br />
Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb. <br />
<br />
Vision<br />
Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees. <br />
<br />
New trends<br />
Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.<br />
<br/><br />
More information about Sogeti can be found on our website www.sogeti.nl.<br />
<br/><br />
</td><br />
</tr><br />
</table><br />
<br />
'''18.30 – 18.45 Introduction (OWASP organization, projects, sponsor) '''<br><br />
'''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''<br><br />
Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself. <br />
Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he’s working for ps_testware as a web application security testing specialist. <br />
<br />
'''19.30 – 20.00 VAC Cross-site scripting Martin Visser ''' <br><br />
<br />
Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security – Microsoft development" course both within and outside Sogeti. <br />
<br />
'''20.00 – 20.15 Break ''' <br><br />
'''20.15 – 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers '''<br><br />
Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.<br />
<br />
Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master<br />
Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.<br />
<br />
The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]<br />
<br />
== Past Events ==<br />
* Events held in [[Netherlands_Previous_Events_2008|2008]]<br />
* Events held in [[Netherlands_Previous_Events_2007|2007]]<br />
* Events held in [[Netherlands_Previous_Events_2006|2006]]<br />
* Events held in [[Netherlands_Previous_Events_2005|2005]]</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=OWASP_Community&diff=46687OWASP Community2008-11-21T14:42:19Z<p>Bkoelewijn: /* 2008 */</p>
<hr />
<div>This page is for people to post OWASP related events, such as chapter meetings, OWASP conferences, get-togethers, and OWASP sponsored events.<br />
<br />
Events from previous years are archived here:<br />
* '''[[OWASP Community 2006]]'''<br />
<br />
This page is monitored, and items posted here will be copied to the OWASP Calendar [[Main Page]]. Please post new items in chronological order using the following format:<br />
<br />
'''Mon ## (##:00h) - [[Article]]'''<br />
<br />
<!--<br />
<br />
CHAPTER LEADS -- please put your schedule here and we'll post a month in advance<br />
<br />
*** Belgium ***<br />
<br />
*** OTTAWA: Rough dates ***<br />
<br />
*** BOSTON: Every first Wednesday of the month ***<br />
<br />
*** BOULDER: Every third Thursday of the month except Nov and Dec ***<br />
<br />
*** MELBOURNE: First Tuesday of the month ***<br />
<br />
*** NETHERLANDS: Second Thursday of the month sometimes ***<br />
<br />
*** ROCHESTER: Every third Monday of the month ***<br />
<br />
*** TORONTO: Every second Wednesday of the month<br />
<br />
*** VIRGINIA: Every second thursday of the month ***<br />
<br />
*** SINGAPORE: Every first Thursday of the month ***<br />
<br />
--><br />
<br />
==Upcoming Events==<br />
=== 2008 ===<br />
<br />
'''Dec 11 (17:30h) - [http://www.owasp.org/index.php/Netherlands#Announcement_December_11th_2008:_Architectural_and_design_risk_analysis Netherlands Chapter Meeting]'''<br />
<br />
'''Dec 3 (17:30h) - [https://www.owasp.org/index.php/Denmark#Local_News Denmark Chapter Meeting]'''<br />
<br />
'''Sept 22nd-25th - [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference NY/NJ Metro]'''<br />
<br />
'''Aug 21 (18:00h) - [http://www.owasp.org/index.php/Boulder#Next_Meeting Boulder Chapter Meeting]'''<br />
<br />
==Past Events==<br />
<br />
'''Dec 11 (18:00h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''Mar 26 (17:30h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Jan 29 (11:15h) - [[Helsinki|Helsinki chapter and RWSUG seminar]]'''<br />
<br />
'''Jan 29 (11:30h) - [[Cincinnati|Cincinnati chapter meeting]]'''<br />
<br />
'''Dec 20 (17:30h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Dec 15 (11:00h) - [[Pune|Pune chapter meeting]]'''<br />
<br />
'''Dec 12 (18:00h) - [[Chicago|Chicago chapter meeting]]'''<br />
<br />
'''Dec 6 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Dec 5 (18:00h) - [[Boston|Possible Boston OWASP Chapter Meeting]] '''<br />
<br />
'''Dec 3 (13:00h) - [[Israel|OWASP Israel 2007]] '''<br />
<br />
'''Nov 29 (18:00h) -[[Seattle|Seattle Chapter Meeting]] '''<br />
<br />
'''Nov 29 (18:00h) -[[Sacramento|Sacramento Chapter Meeting]] '''<br />
<br />
'''Nov 26 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Nov 26 (09:30h) - [[Turkey|Turkey Chapter Meeting - Izmir]] '''<br />
<br />
'''Nov 24 (13:30h) - [[Turkey|Turkey Chapter Meeting - Ankara]] '''<br />
<br />
'''Nov 20 (18:00h) - [[Belgium|Belgium Chapter Meeting]] '''<br />
<br />
'''Nov 14 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
<br />
'''Nov 14 (18:00h) - [[Houston|Houston Chapter Meeting]] '''<br />
<br />
'''Nov 11 (18:00h) - [[Ireland|Ireland Chapter Meeting]] '''<br />
<br />
'''Nov 7 (18:00h) - [[Boston|Possible Boston OWASP Chapter Meeting]] '''<br />
<br />
'''Nov 7 (19:00h) - [[Singapore|Singapore OWASP Chapter Meeting]] '''<br />
<br />
'''Nov 3 (18:30h) - [[Malaysia|Malaysia OWASP Chapter Meeting]] '''<br />
<br />
'''Oct 9 (19:30h) - [[Singapore|Singapore OWASP chapter meeting]]'''<br />
<br />
'''Oct 2 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Sept 27 (1800h) - [[New York|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Sept 27 (13:00h) - [[Taiwan|Taiwan chapter meeting]]'''<br />
<br />
'''Sept 13 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Sept 10 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Sept 7 (15:00h) [[Germany|German chapter meeting]]''' - Restart of the German Chapter<br />
<br />
'''Sept (12:00h) - [[Belgium|Belgium OWASP Day Event]] '''<br />
<br />
'''Sept 6 (18:00h) - [[Kansas_City|Kansas City Chapter meeting]]'''<br />
<br />
'''Sept 5 (18:00h) - [[Chicago|Chicago Chapter Meeting]]'''<br />
<br />
'''Sept 5 (17:00h) - [[Israel|Israeli chapter meeting]]'''<br />
<br />
'''Sept 5 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''July 25 (18:00h) - [[San Jose|San Jose Chapter Meeting]]'''<br />
<br />
'''July 24 (17:00h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''July 14 (11:00h) - [[Turkey|Turkey chapter meeting - 1st Web Security Days]]'''<br />
<br />
'''July 6 (17:00h) - [[Spain|Spain chapter meeting]]'''<br />
<br />
'''June 26 (11:30h) - [[Austin|Austin chapter meeting]]''' - Running Web Application Scans<br />
<br />
'''June 22 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''June 21 (19:00h) - [[Denver]]''' - Anti-DNS Pinning Attacks / Calculating Return on Security Investment (ROSI)<br />
<br />
'''June 19 (18:00h) - [[Minneapolis St Paul|Minneapolis St Paul chapter meeting]]'''<br />
<br />
'''June 15 (17:00h) - [[Spain|Spain chapter meeting]]'''<br />
<br />
'''June 14 (08:00h) - [[Vietnam|Vietnam chapter meeting]]'''<br />
<br />
'''June 13 (18:30h) - [[Kansas City|Kansas City chapter meeting]]'''<br />
<br />
'''June 12 (18:00h) - [[New York|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Jun 5 (19:00h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Jun 5 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Jun 5 (17:30h) - [[Houston | Houston Chapter Meeting]]'''<br />
<br />
'''May 29 (9:00h) - [[http://www.owasp.org/index.php/Italy#May_29th.2C_2007_-_Seminar:_.22Software_Security.22 Italy@Firenze Tecnologia]]'''<br />
<br />
'''May 29 (11:30h) - [[Austin | Austin Chapter Meeting]]''' - Bullet Proof UI - A programmer's guide to the complete idiot". <br />
<br />
'''May 29 (18:00h) - [[Ottawa | Ottawa Chapter Meeting]]'''<br />
<br />
'''May 22 (18:30h) - [[New Zealand|1st New Zealand chapter Meeting]]'''<br />
<br />
'''May 21 (14:00h) - [[Israel|2nd OWASP Israel mini conference]]'''<br />
<br />
'''May 15 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''May 10 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''May 9 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''May 8 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''May 6 (11:00h) - [[Turkey|Turkey chapter meeting]]'''<br />
<br />
'''May 2 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''May 1 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Apr 26 (11:00h) - [[San Antonio|San Antonio chapter meeting]]'''<br />
<br />
'''Apr 26 (17:00h) - [[Switzerland|Switzerland chapter meeting and "Swiss Security Dinner"]]'''<br />
<br />
'''Apr 24 (18:00h) - [[Minneapolis St Paul|Minneapolis St Paul chapter meeting]]'''<br />
<br />
'''Apr 20 (19:00h) - [[Hong Kong|Hong Kong chapter meeting - Objectives for 2007]]'''<br />
<br />
'''Apr 19 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Apr 18 (17:00h) - [[San Francisco City Chapter Meeting]]'''<br />
<br />
'''Apr 17 (18:00h) - [[New Jersey|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Apr 17 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Apr 12 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Apr 12 (18:00h) - [[San Jose|San Jose chapter meeting]]'''<br />
<br />
'''Apr 11 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Apr 4 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Apr 3 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Mar 30 - [[http://www.owasp.org/index.php/Italy#March_30th.2C_2007_-_Master_in_Security_-_University_of_Rome_.22La_Sapienza.22| Italy@Master in Security at "La Sapienza"]]'''<br />
<br />
'''Mar 28 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''<br />
<br />
'''Mar 28 (11:30h) - [[San Antonio|San Antonio chapter meeting]]'''<br />
<br />
; '''Mar 27-30 - [http://www.blackhat.com Black Hat Euro]'''<br />
: OWASP members receive a Euro 100 Briefings discount by inserting BH7EUASSOC in the box marked “Coupon Codes”<br />
<br />
'''Mar 22 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Mar 21-22 - [[Belgium#OWASP_Top_10_2007_Update_.28Infosecurity_Belgium.2C_21_.26_.2622_Mar_2007.29|Belgium@InfoSecurity]]'''<br />
<br />
'''Mar 20 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Mar 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Mar 14 (18:00h) - [[Chicago|Chicago chapter meeting]]'''<br />
<br />
'''Mar 13 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Mar 8 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
<br />
'''Mar 7 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Mar 7 (18:30h) - [[Kansas City|Kansas City chapter meeting]]'''<br />
<br />
'''Mar 6 (18:30h) - [[Philadelphia|Philadelphia chapter meeting]]'''<br />
<br />
'''Mar 6 (18:30h) - [[San Francisco|San Francisco and San Jose chapter meeting]]'''<br />
<br />
'''Mar 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Mar 5 (11:00h) - [[New Jersey|New Jersey chapter meeting]]'''<br />
<br />
'''Mar 1 (11:30h) - [http://www.eusecwest.com/agenda.html EUSecWest 07: Testing Guide]'''<br />
<br />
; '''Feb 26-Mar 1 - [http://www.blackhat.com Black Hat DC]'''<br />
: OWASP members receive a $100 Briefings discount by inserting BH7DCASSOC in the box marked “Coupon Codes”<br />
<br />
'''Feb 28 (18:00h) - [[Seattle|Seattle chapter meeting]]'''<br />
<br />
'''Feb 27 (18:00h) - [[Edmonton|Edmonton chapter meeting]]'''<br />
<br />
'''Feb 22 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Feb 22 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Feb 21 (18:30h) - [[Denver|Denver chapter meeting]]'''<br />
<br />
'''Feb 19 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Feb 15 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''<br />
<br />
'''Feb 15 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Feb 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Feb 13 (18:00h) - [[Ireland|Ireland chapter meeting]]'''<br />
<br />
'''Feb 12 (18:30h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''Feb 7 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Feb 6-7 - [[Italy#February_6th-8th.2C_2007_-_InfoSecurity|Italy@InfoSecurity]]'''<br />
<br />
'''Feb 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Feb 2 (14:00h) - [[Chennai|Chennai chapter meeting]]'''<br />
<br />
'''Jan 31 (15:00h) - [[Mumbai|Mumbai chapter meeting]]'''<br />
<br />
'''Jan 30 (11:30h) - [[Austin|Austin chapter meeting]]'''<br />
<br />
'''Jan 25 (18:00h) - [[San Francisco| San Francisco chapter meeting]]'''<br />
<br />
'''Jan 25 (14:30h) - [[Italy#October_25th.2C_2007_-_Isaca_Rome|Italy@ISACA Rome]]'''<br />
<br />
'''Jan 24 (17:30h) - [[Israel#6th_OWASP_IL_meeting:_Wednesday.2C_January_24th_2007|6th OWASP Israel chapter meeting]]'''<br />
<br />
'''Jan 23 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''Jan 22 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Jan 17 (18:30h) - [[Denver|Denver chapter meeting]]'''<br />
<br />
'''Jan 16 (17:45h) - [[Edmonton|Edmonton chapter meeting]]'''<br />
<br />
'''Jan 11 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Jan 11 (18:30h) - [[Phoenix|Phoenix chapter meeting]]'''<br />
<br />
'''Jan 11 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Jan 10 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Jan 8 (18:00h) - [[Seattle|Seattle chapter meeting]]'''<br />
<br />
'''Jan 3 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''May 1 - [[Melbourne | Melbourne chapter meeting]]'''<br />
<br />
'''May 2 - [[Boston]]'''<br />
<br />
'''May 6 - [[Turkey]]'''<br />
<br />
'''May 8 - [[Virginia (Northern Virginia)|Washington DC (VA)]]'''<br />
<br />
'''May 9 - [[Toronto]]'''<br />
<br />
'''May 10 - [[Belgium]]'''<br />
<br />
'''May 15 - [[Rochester]]'''<br />
<br />
'''May 21 - [[Israel]]'''<br />
<br />
'''May 22 - [[New Zealand]]'''<br />
<br />
'''May 29 - [[Italy]]'''<br />
<br />
'''June 5 - [[Houston]]'''<br />
<br />
'''June 5 - [[Melbourne]]'''<br />
<br />
'''June 5 - [[Helsinki]]'''<br />
<br />
'''June 12 - [[New Jersey]]'''<br />
<br />
'''June 15 - [[Spain]]'''<br />
<br />
'''July 14 - [[Turkey]]'''</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=46667Netherlands2008-11-21T11:55:00Z<p>Bkoelewijn: /* Announcement December 11th 2008: Architectural and design risk analysis */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2008 ==<br />
This is an overview of the 2008 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
March 26th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Software Vulnerability assessment<br />
Presentations: Complex(ity) matters, Mario de Boer (Dutch)<br />
V.A.C. SQL injection, Marinus Kuivenhoven (Dutch)<br />
Secure Programming with Static Analysis, Brian Chess (English) <br />
Location : Mercure Utrecht Nieuwegein, Buizerdlaan 10, 3435 SB Nieuwegein<br />
Sponsor : Fortify Software<br />
<br />
Oktober 27th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Privacy and the Internet<br />
Presentations: Privacy and Internet (Dutch), Frank Fruijthoff and Ellen Hoving<br />
Vulnerability and source code scanners. (Dutch) Emile Strijbos <br />
Location : ps_testware B.V., Dorpsstraat 26, 3941 JM DOORN<br />
Sponsor : ps_testware B.V.<br />
<br />
December 11th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Workshop: Architectural and design risk analysis<br />
Presentations: Architectural risk analyses (English), André N. Klingsheim and Lars-Helge Netland <br />
Location : TTY Amsterdam, Kerkstraat 342, 1017 JA Amsterdam<br />
Sponsor : TTY Internet Solutions<br />
</pre><br />
<br />
== Announcement December 11th 2008: Architectural and design risk analysis ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals about risk analyses in the architectural and design phases. The speakers will give specific examples and there will be time to ask questions.<br/><br />
Please register before December 8th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
TTY Internet Solutions<br/><br />
Kerkstraat 342<br/><br />
1017 JA Amsterdam<br/><br />
</td><br />
<td width="350"><br />
[[Image:TTYlogo.jpg|200px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
For the route by car or public transport please visit: http://tty.nl/nl/contact/amsterdam<br/><br />
</td><br />
<td width="350"><br />
TTY was founded in 1997 and has grown to be a solid Full Service Internet Partner. For a wide range of companies, large financial institutions, publishers and large insurance companies TTY develops high-traffic websites, shops, backoffice- and payment systems. TTY is especially known as a partner (and in some cases shareholder) of successful internet hits as<br />
2dehands.nl, ViaVia.nl, Nationale-Vacaturebank.nl, Sellaband.com, jaap.nl en Gekko.com.<br/><br />
For more information please visit: http://tty.nl<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 – 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 – 21.00 '''Architectural risk analyses''' (English), André N. Klingsheim and Lars-Helge Netland<br/><br />
This workshop will explore how businesses can use risk analysis in the architecture/design phase of software development to produce more secure software. Participants will get an introduction to risk analysis, which will<br />
cover both definitions and how to apply the concepts in practice. The workshop consists of four parts: a short overview of current security threats; an introduction to risk management; an exploration of the limitations of risk management; and some real world applications of the presented techniques.<br/><br />
Lars-Helge Netland and André N. Klingsheim are software security analysts at, and co-owners of, NoWires Group AS. They both hold PhD degrees in applied software security, focused on risk analysis of software architecture and design.<br/><br />
<br/><br />
20.00 – 20:15 '''Break'''<br/><br />
<br/><br />
21.15 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br><br />
Please register before December 8th, because of the necessary catering arrangements.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_11_December.pdf]]<br/><br />
<br />
== Meeting minutes October 27th 2008 ==<br />
<br />
At October 27th, the Dutch OWASP chapter came together at the office of the sponsor of the evening; ps_testware in Doorn. The subject of the evening was 'Privacy and the Internet’. There were 2 speakers and approximately 25 attendees.<br/><br />
<br/><br />
After a short welcome talk by both the sponsor and OWASP, Mario de Boer had an announcement about a new OWASP project; ORPRO, the Open Review Project. The goal of the project is to review Open Source Software from an independent point of view. Reviews will be done both manually and with the aid of source code analysis software provided by Fortify. The first software package to be reviewed is already available so reviewers are needed. More information can be found on the OWASP project page. [http://www.owasp.org/index.php/Category:OWASP_Open_Review_Project]<br/><br />
<br/><br />
'''First presentation:''' Privacy & the Internet presented by Frank Fruijthoff and Ellen Hoving. <br/><br />
The goal of this presentation was to show the problems in regulating privacy on the internet by law. The presentation was roughly split in 3 parts: definitions, requirements and context. <br/><br />
The main problem with regulating privacy is that the concept of privacy is very broad and not well defined. Privacy can have different meanings and consequences in different contexts. Most laws therefore focus on the individual and define privacy as 'protection of personal information' where 'personal information' is all data that can be tracked back to a single person. The last years many countries within the EU developed internet laws concerning privacy on the internet. These laws state that information can only be used what it originally was intended for and usage of that information must be reported at central register. This register also makes it possible to file a complaint and check what companies use personal information for what purposes. While these rules are mostly sufficient for local databases they often fail when applied to information stored on or with use of the internet. Problems encountered are captured in the "four D's";<br/><br />
- Internet is deterritorialized; internet has no boundaries.<br/><br />
- Internet is deregulated; internet has no law, only terms of use.<br/><br />
- Internet is dematerialized; internet is not physical.<br/><br />
- Internet is decentralized; there is no single regulating or controlling organization.<br/><br />
Although the protection of personal data is more and more covered by laws, the increasing usage of external storage and connections over the internet will make it harder to enforce them. The main conclusion of the evening was that, although many initiatives improving privacy exist, the very properties of the internet make it hard to ensure privacy completely. <br/><br />
<br/><br />
'''Second presentation:''' Vulnerability and source code scanners presented by E. Strijbos. This presentation showed the results of a research concerning the feasibility of a Web Application Security Certification by the usage of vulnerability scanners.<br/><br />
With the daily increasing amount of threads and vulnerabilities in web applications there is a market-driven demand for an independent and automated scan service. Current scan services often lack coverage and depth of scanning and give no details about the used scanning methods.<br/><br />
In this research several commercial vulnerability scanners and static analysis tools were compared and checked for scantime, accuracy, false positives, and ease of use. The results showed that almost all scanners find most of the vulnerabilities, but also produce many false positives. Also, without proper configuration the amount of results can be overwhelming and inconclusive. Furthermore results showed that static analysis scanners are much faster than vulnerability scanners, but have a more limited usage. The main conclusion was that although vulnerability scanners and static analysis tools can be very helpful in identifying vulnerabilities, their current efficiency is not high enough to use as the basis for an automated vulnerability scan.<br/><br />
<br />
== Meeting October 27th 2008: Privacy and the Internet ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals about personal and technical privacy on the internet. The speakers focus on privacy regulations related to the internet and on the mass amount of personal and technical information available about persons and companies on the internet, with and without their consent. Furthermore tools will be discussed that help prevent leakage of privacy related and other kind of data. They will give specific examples and there will be time to ask questions.<br/><br />
Please register before October 20th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 20.15 '''Privacy and Internet''' (Dutch), Frank Fruijthoff and Ellen Hoving<br/><br />
In this presentation the general principles of privacy laws in the Netherlands and the EU and specifically privacy and the internet will be covered.<br/><br />
Frank Fruijthoff is a Compliance Officer with ING. He has a Compliance and Risk Management background and is specialised in privacy.<br/><br />
Ellen Hoving is a graduated lawyer. She works as an independent consultant specialized in compliance and privacy.<br/><br />
<br/><br />
20.15 – 20:30 '''Break'''<br/><br />
<br/><br />
20:30 – 21:00 '''Vulnerability and source code scanners''' (Dutch), Emile Strijbos<br />
<br/><br />
For his Master thesis in computer science at the Radboud Universiteit in Nijmegen, Emile Strijbos investigated vulnerability scanners and source code scanners. These are automated tools that try to detect security flaws, either in running web-applications or in their source code.<br/><br />
Emile tried out several of these tools, including both free and commercial ones, to see how good they are at detecting standard vulnerabilities, such as SQL injection, XSS, CSRF, etc.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br><br />
Please register before October 20th, because of the necessary catering arrangements. The number of registries is limited to 50 due to the capacity of the location and will be handled in order of receipt.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_27_Oktober.pdf]]<br/><br />
<br />
== Meeting minutes March 23th 2008 ==<br />
<br />
At March 23th, the Dutch OWASP chapter came together in the Mercury hotel in Nieuwegein. The meeting was sponsored by Fortify Software. The subject of the evening was 'Software Vulnerability Assesment’. There were 3 speakers and approximately 40 attendees.<br/><br />
<br/><br />
After a short introduction of Migchiel de Jong (Fortify) about the subject of Static and Dynamic Analysis and the tools that Fortify provides the speakers of the evening where introduced.<br/><br />
<br/><br />
'''First presentation:''' Practices of Complex(ity) matters (Dutch), Mario de Boer<br/><br />
Mario de Boer has spent much of his free time the last 16 years into disassembling various pieces of software and analyzing the code and its statistics. The main advantage in analyzing binaries is that no access to source code is needed, all dependencies (i.e. the compiler) are included and it’s independent of the tool used. Disassembling compiled code gives great insight in the complexity of the software and the entry and exit points of data. Although there is no direct relation between the complexity of software and its security, statistically the most vulnerabilities appear in the most complex portions of a program. Data entry points in complex portions of the code can give rise to possible exploits so static analysis can give insight in the most vulnerable places in software which is useful information in testing.<br />
The disadvantages of static analysis are that an extensive knowledge of assembly is needed and, due to its statistic nature, it gives rise to many false positives. <br />
In conclusion static binary analysis, when used by experts, can be a powerful tool to gain insight in the most vulnerable parts of the software and be a valuable tool in both developing and testing software. <br/><br />
<br/><br />
'''Second presentation:''' V.A.C: SQL injection (Dutch), Marinus Kuivenhoven<br/><br />
A new reoccurring topic on OWASP presentations will be the so called VAC. In these presentations an expert will talk about a Vulnerability, how to Assess it and possible Countermeasures. This evening Marinus started with the second vulnerability in the OWASP top ten; SQL injections.<br/><br />
With the aid of Webgoat, a few simple examples and the possible consequences were shown. SQL injection is particularly useful exploit in the reconnaissance phase since it can be abused for information leakage and in getting information about e.g. the table structure. <br/><br />
On the internet and in literature many countermeasures against SQL injections are described. However, many of these countermeasures are not usable in a maintainable system or cannot prevent SQL injections completely. The most important conclusion was that input should never be trusted and should never be directly used.<br/><br />
<br/><br />
'''Third presentation:''' Secure Programming with Static Analysis (English), Brian Chess<br/><br />
The last speaker of the evening was Brian Chess who presented his new book ‘Secure Programming with Static Analysis’. Brian made clear that, although a powerful tool, static binary analysis is already too late in the SDLC to be successful in preventing vulnerabilities. Scanning for possible vulnerabilities should be implemented as early as possible i.e. during coding. The main advantages of static analysis are the cost and speed. Since errors and bad practices are identified in an early stage they can be solved at the spot, making auditing the software more efficient in term of time and depth. <br/><br />
Static analysis can successfully be used for style and type checking, program understanding and verification, and for security reviews. The success of static analysis, however, is fully depending on the rules implemented in the scanner. Static analysis is also unable to identify design flaws, right problems, or wrong user input. <br/><br />
The conclusion was that scanning for vulnerabilities can probably only be successful with the aid of static analysis, but many requirements should be met. Firstly it should become part of the SDLC and culture. Secondly the right tool should be picked and people should be trained in its use. Lastly investments should be made in building up a good rule set and metrics. <br/><br />
<br />
== Meeting March 26th 2008: Software Vulnerability assessment ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The main focus will be on software vulnerability assessment. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
Mercure Utrecht Nieuwegein<br/><br />
Buizerdlaan 10,<br/><br />
3435 SB Nieuwegein<br/><br />
</td><br />
<td width="350"><br />
[[Image:Fortify.JPG|143px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="350"><br />
Fortify Software products protect companies from today’s greatest security risk: the software applications that run their businesses. Combining deep application security expertise with extensive software development experience, Fortify Software has defined the market with award-winning products that span the software development cycle. Today, Fortify Software fortifies the software for the most demanding customer deployments, including the world’s largest, most varied code bases.<br/><br />
<br/><br />
For more information please visit:<br/><br />
www.fortify.com<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 - 18:50 '''Introduction''' (OWASP, sponsor)<br/><br />
<br/><br />
18.50 - 19.30 '''Complex(ity) matters''' (Dutch), Mario de Boer<br/><br />
Various methods exist to locate specific vulnerabilities in software. In the presentation we will look at static analysis of binaries, and the problems we face when trying to locate vulnerabilities. Several ideas will be discussed to make the search easier, but at the same time less exact. The first idea is trivial: automate as much as possible. The second idea is nearly trivial: don't aim at exact vulnerabilities but relax the search to locating potential vulnerabilities. We will give examples that illustrate the results.<br/><br />
Mario de Boer is a senior security consultant at Logica, and as such focuses on security management aspects like security frameworks, compliance, monitoring and control and risk management. Before joining Logica, Mario worked at the Dutch ministries of Defense and Justice, he co-founded a security company and worked as a project manager in the financial sector. For several years he taught courses in software security analysis and secure software development. Besides security management, Mario has interest in software security, reverse engineering and cryptography. Within Logica Netherlands, he is knowledge manager application security. Mario holds a PhD in Mathematics and is CISA and CISSP.<br/><br />
<br/><br />
19.30 - 19:50 '''Break'''<br/><br />
<br/><br />
19:50 - 20:20 '''V.A.C: SQL injection''' (Dutch), Marinus Kuivenhoven<br />
<br/><br />
<u>'''V'''ulnerability:</u><br/><br />
An application which uses a database for its information needs, communicates with it trough SQL. SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of a Database for parsing and execution.<br/><br />
<u>'''A'''ssessment:</u><br/><br />
SQL injection can threaten the confidentiality, availability and integrity of the data. The various types of SQL injection and their impact will be shown.<br/><br />
<u>'''C'''ountermeasure:</u><br/><br />
Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because a database will execute all syntactically valid queries that it receives. How this should be done will be shown for the most popular languages.<br/><br />
Marinus is a Technology Specialist with Sogeti Nederland B.V. specializing in service oriented architectures and secure application development. His experience includes developing and administrating Oracle-based systems.<br/><br />
<br/><br />
20.20 - 21.00 '''Secure Programming with Static Analysis''' (English), Brian Chess<br/><br />
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution. We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.<br/><br />
Brian Chess is a founder of Fortify Software and serves as Fortify's Chief Scientist, where his work focuses on practical methods for creating secure systems. His book, Secure Programming with Static Analysis, shows how static source code analysis is an indispensable tool for getting security right. Brian holds a Ph.D. in computer engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service.<br/><br />
<br/><br />
21.00 - 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br />
== Meeting minutes December 20th 2007 ==<br />
<br />
At December 20th, the Dutch OWASP chapter came together at the office of ps_testware located in Doorn. The subject of the evening was 'creating secure (web)applications. There were 3 speakers and close to 30 attendees <br/><br />
<br/><br />
'''First presentation:''' Practices of developing optimal security (dutch), Andre Post<br/><br />
Andre talked from his rich experience as software auditor and code reviewer. Based on his experience he stated that developing good, secure software can only be done with developers with the right set of mind. Security should not be tested into the software, but should be a natural thing for developers to develop into the software. For this you need developers who know by heart when security flaws start to exist and how to prevent them. Developers with the necessary experience are rare and often developer teams do not have the right expertise for developing secure software. The most important conclusion of his speech was that secure software starts with security aware developers.<br/><br />
<br/><br />
'''Second presentation:''' Problems of developing secure and correct applications (dutch), Erik Poll<br/><br />
Erik Poll stated that besides having developers who are aware of security, you should also have developers that now the limitations and inherent security leaks of the used language. One of the problems is that many developers are not taught the inherent security holes in programming languages during their education. <br/><br />
Another problem is that software is often made secure for the wrong reasons. At this moment only two reasons appear to be the drive behind developing secure software: economics and laws. Security is mostly of secondary concern and as such will only be implemented at minimum requirements. Bad examples of big companies who develop insecure software and still be successful even further restrict the demand for secure software.<br/><br />
On the positive side many developers make the same mistakes so testing for common security holes can easily be done with checklists and validation tools. These validation tools can be made more successful with the use of metatags in the code.<br/><br />
Erik concluded his speech that improving the secureness of software can only be achieved when there is commitment, the knowledge is available and software is developed and implemented with a secure mind. <br/><br />
<br/><br />
'''Third presentation:''' Protecting Web services and Web applications against security threats, Rix Groenboom<br/><br />
The third presentation was about a problem which probably will become bigger and bigger the coming years. Although security might be in the scope when developing software at this moment, it certainly was not a requirement 20 or more years ago. Despite their intrinsic insecureness, these systems are connected more and more to the world wide web to meet de demands for online availability. This imposes a major security risk which will become more evident in the years to come and might become bigger than the Y2K problem. Unlike modern software, these applications can only be made secure enough by using advanced testing strategies combined with the use of test-tools and thorough regression tests. Testing alone however is not enough; to accomplish maximum secureness all connections to these systems should be based on a 'deny unless' instead of an 'allow unless' basis. <br/><br />
The conclusion of Rix's talk was that old systems connected to new interfaces should be treated as insecure and all possible precautions should be taken to achieve an acceptable level of secureness.<br/><br />
<br />
== Meeting December 20th 2007: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll [http://www.cs.ru.nl/~erikpoll/talks/OWASP2007.pdf (slides of the presentation)]<br />
<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
<br />
== Meeting September 13th: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting minutes Januar 11th 2007 ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
<br />
== Meeting Januar 11th 2007 ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting minutes March 9thh 2007 ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== Meeting March 9th 2007: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:Announcement_11_December.pdf&diff=46666File:Announcement 11 December.pdf2008-11-21T11:54:19Z<p>Bkoelewijn: Meeting announcement of the OWASP Netherlands Chapter</p>
<hr />
<div>Meeting announcement of the OWASP Netherlands Chapter</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:TTYlogo.jpg&diff=46665File:TTYlogo.jpg2008-11-21T11:52:57Z<p>Bkoelewijn: Logo of sponsor OWASP Netherlands chapter</p>
<hr />
<div>Logo of sponsor OWASP Netherlands chapter</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=46664Netherlands2008-11-21T11:51:19Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2008 ==<br />
This is an overview of the 2008 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
March 26th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Software Vulnerability assessment<br />
Presentations: Complex(ity) matters, Mario de Boer (Dutch)<br />
V.A.C. SQL injection, Marinus Kuivenhoven (Dutch)<br />
Secure Programming with Static Analysis, Brian Chess (English) <br />
Location : Mercure Utrecht Nieuwegein, Buizerdlaan 10, 3435 SB Nieuwegein<br />
Sponsor : Fortify Software<br />
<br />
Oktober 27th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Privacy and the Internet<br />
Presentations: Privacy and Internet (Dutch), Frank Fruijthoff and Ellen Hoving<br />
Vulnerability and source code scanners. (Dutch) Emile Strijbos <br />
Location : ps_testware B.V., Dorpsstraat 26, 3941 JM DOORN<br />
Sponsor : ps_testware B.V.<br />
<br />
December 11th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Workshop: Architectural and design risk analysis<br />
Presentations: Architectural risk analyses (English), André N. Klingsheim and Lars-Helge Netland <br />
Location : TTY Amsterdam, Kerkstraat 342, 1017 JA Amsterdam<br />
Sponsor : TTY Internet Solutions<br />
</pre><br />
<br />
== Announcement December 11th 2008: Architectural and design risk analysis ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals about risk analyses in the architectural and design phases. The speakers will give specific examples and there will be time to ask questions.<br/><br />
Please register before December 8th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
TTY Internet Solutions<br/><br />
Kerkstraat 342<br/><br />
1017 JA Amsterdam<br/><br />
</td><br />
<td width="350"><br />
[[Image:TTYlogo.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
For the route by car or public transport please visit: http://tty.nl/nl/contact/amsterdam<br/><br />
</td><br />
<td width="350"><br />
TTY was founded in 1997 and has grown to be a solid Full Service Internet Partner. For a wide range of companies, large financial institutions, publishers and large insurance companies TTY develops high-traffic websites, shops, backoffice- and payment systems. TTY is especially known as a partner (and in some cases shareholder) of successful internet hits as<br />
2dehands.nl, ViaVia.nl, Nationale-Vacaturebank.nl, Sellaband.com, jaap.nl en Gekko.com.<br/><br />
For more information please visit: http://tty.nl<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 – 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 – 21.00 '''Architectural risk analyses''' (English), André N. Klingsheim and Lars-Helge Netland<br/><br />
This workshop will explore how businesses can use risk analysis in the architecture/design phase of software development to produce more secure software. Participants will get an introduction to risk analysis, which will<br />
cover both definitions and how to apply the concepts in practice. The workshop consists of four parts: a short overview of current security threats; an introduction to risk management; an exploration of the limitations of risk management; and some real world applications of the presented techniques.<br/><br />
Lars-Helge Netland and André N. Klingsheim are software security analysts at, and co-owners of, NoWires Group AS. They both hold PhD degrees in applied software security, focused on risk analysis of software architecture and design.<br/><br />
<br/><br />
20.00 – 20:15 '''Break'''<br/><br />
<br/><br />
21.15 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br><br />
Please register before December 8th, because of the necessary catering arrangements.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_11_December.pdf]]<br/><br />
<br />
== Meeting minutes October 27th 2008 ==<br />
<br />
At October 27th, the Dutch OWASP chapter came together at the office of the sponsor of the evening; ps_testware in Doorn. The subject of the evening was 'Privacy and the Internet’. There were 2 speakers and approximately 25 attendees.<br/><br />
<br/><br />
After a short welcome talk by both the sponsor and OWASP, Mario de Boer had an announcement about a new OWASP project; ORPRO, the Open Review Project. The goal of the project is to review Open Source Software from an independent point of view. Reviews will be done both manually and with the aid of source code analysis software provided by Fortify. The first software package to be reviewed is already available so reviewers are needed. More information can be found on the OWASP project page. [http://www.owasp.org/index.php/Category:OWASP_Open_Review_Project]<br/><br />
<br/><br />
'''First presentation:''' Privacy & the Internet presented by Frank Fruijthoff and Ellen Hoving. <br/><br />
The goal of this presentation was to show the problems in regulating privacy on the internet by law. The presentation was roughly split in 3 parts: definitions, requirements and context. <br/><br />
The main problem with regulating privacy is that the concept of privacy is very broad and not well defined. Privacy can have different meanings and consequences in different contexts. Most laws therefore focus on the individual and define privacy as 'protection of personal information' where 'personal information' is all data that can be tracked back to a single person. The last years many countries within the EU developed internet laws concerning privacy on the internet. These laws state that information can only be used what it originally was intended for and usage of that information must be reported at central register. This register also makes it possible to file a complaint and check what companies use personal information for what purposes. While these rules are mostly sufficient for local databases they often fail when applied to information stored on or with use of the internet. Problems encountered are captured in the "four D's";<br/><br />
- Internet is deterritorialized; internet has no boundaries.<br/><br />
- Internet is deregulated; internet has no law, only terms of use.<br/><br />
- Internet is dematerialized; internet is not physical.<br/><br />
- Internet is decentralized; there is no single regulating or controlling organization.<br/><br />
Although the protection of personal data is more and more covered by laws, the increasing usage of external storage and connections over the internet will make it harder to enforce them. The main conclusion of the evening was that, although many initiatives improving privacy exist, the very properties of the internet make it hard to ensure privacy completely. <br/><br />
<br/><br />
'''Second presentation:''' Vulnerability and source code scanners presented by E. Strijbos. This presentation showed the results of a research concerning the feasibility of a Web Application Security Certification by the usage of vulnerability scanners.<br/><br />
With the daily increasing amount of threads and vulnerabilities in web applications there is a market-driven demand for an independent and automated scan service. Current scan services often lack coverage and depth of scanning and give no details about the used scanning methods.<br/><br />
In this research several commercial vulnerability scanners and static analysis tools were compared and checked for scantime, accuracy, false positives, and ease of use. The results showed that almost all scanners find most of the vulnerabilities, but also produce many false positives. Also, without proper configuration the amount of results can be overwhelming and inconclusive. Furthermore results showed that static analysis scanners are much faster than vulnerability scanners, but have a more limited usage. The main conclusion was that although vulnerability scanners and static analysis tools can be very helpful in identifying vulnerabilities, their current efficiency is not high enough to use as the basis for an automated vulnerability scan.<br/><br />
<br />
== Meeting October 27th 2008: Privacy and the Internet ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals about personal and technical privacy on the internet. The speakers focus on privacy regulations related to the internet and on the mass amount of personal and technical information available about persons and companies on the internet, with and without their consent. Furthermore tools will be discussed that help prevent leakage of privacy related and other kind of data. They will give specific examples and there will be time to ask questions.<br/><br />
Please register before October 20th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 20.15 '''Privacy and Internet''' (Dutch), Frank Fruijthoff and Ellen Hoving<br/><br />
In this presentation the general principles of privacy laws in the Netherlands and the EU and specifically privacy and the internet will be covered.<br/><br />
Frank Fruijthoff is a Compliance Officer with ING. He has a Compliance and Risk Management background and is specialised in privacy.<br/><br />
Ellen Hoving is a graduated lawyer. She works as an independent consultant specialized in compliance and privacy.<br/><br />
<br/><br />
20.15 – 20:30 '''Break'''<br/><br />
<br/><br />
20:30 – 21:00 '''Vulnerability and source code scanners''' (Dutch), Emile Strijbos<br />
<br/><br />
For his Master thesis in computer science at the Radboud Universiteit in Nijmegen, Emile Strijbos investigated vulnerability scanners and source code scanners. These are automated tools that try to detect security flaws, either in running web-applications or in their source code.<br/><br />
Emile tried out several of these tools, including both free and commercial ones, to see how good they are at detecting standard vulnerabilities, such as SQL injection, XSS, CSRF, etc.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br><br />
Please register before October 20th, because of the necessary catering arrangements. The number of registries is limited to 50 due to the capacity of the location and will be handled in order of receipt.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_27_Oktober.pdf]]<br/><br />
<br />
== Meeting minutes March 23th 2008 ==<br />
<br />
At March 23th, the Dutch OWASP chapter came together in the Mercury hotel in Nieuwegein. The meeting was sponsored by Fortify Software. The subject of the evening was 'Software Vulnerability Assesment’. There were 3 speakers and approximately 40 attendees.<br/><br />
<br/><br />
After a short introduction of Migchiel de Jong (Fortify) about the subject of Static and Dynamic Analysis and the tools that Fortify provides the speakers of the evening where introduced.<br/><br />
<br/><br />
'''First presentation:''' Practices of Complex(ity) matters (Dutch), Mario de Boer<br/><br />
Mario de Boer has spent much of his free time the last 16 years into disassembling various pieces of software and analyzing the code and its statistics. The main advantage in analyzing binaries is that no access to source code is needed, all dependencies (i.e. the compiler) are included and it’s independent of the tool used. Disassembling compiled code gives great insight in the complexity of the software and the entry and exit points of data. Although there is no direct relation between the complexity of software and its security, statistically the most vulnerabilities appear in the most complex portions of a program. Data entry points in complex portions of the code can give rise to possible exploits so static analysis can give insight in the most vulnerable places in software which is useful information in testing.<br />
The disadvantages of static analysis are that an extensive knowledge of assembly is needed and, due to its statistic nature, it gives rise to many false positives. <br />
In conclusion static binary analysis, when used by experts, can be a powerful tool to gain insight in the most vulnerable parts of the software and be a valuable tool in both developing and testing software. <br/><br />
<br/><br />
'''Second presentation:''' V.A.C: SQL injection (Dutch), Marinus Kuivenhoven<br/><br />
A new reoccurring topic on OWASP presentations will be the so called VAC. In these presentations an expert will talk about a Vulnerability, how to Assess it and possible Countermeasures. This evening Marinus started with the second vulnerability in the OWASP top ten; SQL injections.<br/><br />
With the aid of Webgoat, a few simple examples and the possible consequences were shown. SQL injection is particularly useful exploit in the reconnaissance phase since it can be abused for information leakage and in getting information about e.g. the table structure. <br/><br />
On the internet and in literature many countermeasures against SQL injections are described. However, many of these countermeasures are not usable in a maintainable system or cannot prevent SQL injections completely. The most important conclusion was that input should never be trusted and should never be directly used.<br/><br />
<br/><br />
'''Third presentation:''' Secure Programming with Static Analysis (English), Brian Chess<br/><br />
The last speaker of the evening was Brian Chess who presented his new book ‘Secure Programming with Static Analysis’. Brian made clear that, although a powerful tool, static binary analysis is already too late in the SDLC to be successful in preventing vulnerabilities. Scanning for possible vulnerabilities should be implemented as early as possible i.e. during coding. The main advantages of static analysis are the cost and speed. Since errors and bad practices are identified in an early stage they can be solved at the spot, making auditing the software more efficient in term of time and depth. <br/><br />
Static analysis can successfully be used for style and type checking, program understanding and verification, and for security reviews. The success of static analysis, however, is fully depending on the rules implemented in the scanner. Static analysis is also unable to identify design flaws, right problems, or wrong user input. <br/><br />
The conclusion was that scanning for vulnerabilities can probably only be successful with the aid of static analysis, but many requirements should be met. Firstly it should become part of the SDLC and culture. Secondly the right tool should be picked and people should be trained in its use. Lastly investments should be made in building up a good rule set and metrics. <br/><br />
<br />
== Meeting March 26th 2008: Software Vulnerability assessment ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The main focus will be on software vulnerability assessment. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
Mercure Utrecht Nieuwegein<br/><br />
Buizerdlaan 10,<br/><br />
3435 SB Nieuwegein<br/><br />
</td><br />
<td width="350"><br />
[[Image:Fortify.JPG|143px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="350"><br />
Fortify Software products protect companies from today’s greatest security risk: the software applications that run their businesses. Combining deep application security expertise with extensive software development experience, Fortify Software has defined the market with award-winning products that span the software development cycle. Today, Fortify Software fortifies the software for the most demanding customer deployments, including the world’s largest, most varied code bases.<br/><br />
<br/><br />
For more information please visit:<br/><br />
www.fortify.com<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 - 18:50 '''Introduction''' (OWASP, sponsor)<br/><br />
<br/><br />
18.50 - 19.30 '''Complex(ity) matters''' (Dutch), Mario de Boer<br/><br />
Various methods exist to locate specific vulnerabilities in software. In the presentation we will look at static analysis of binaries, and the problems we face when trying to locate vulnerabilities. Several ideas will be discussed to make the search easier, but at the same time less exact. The first idea is trivial: automate as much as possible. The second idea is nearly trivial: don't aim at exact vulnerabilities but relax the search to locating potential vulnerabilities. We will give examples that illustrate the results.<br/><br />
Mario de Boer is a senior security consultant at Logica, and as such focuses on security management aspects like security frameworks, compliance, monitoring and control and risk management. Before joining Logica, Mario worked at the Dutch ministries of Defense and Justice, he co-founded a security company and worked as a project manager in the financial sector. For several years he taught courses in software security analysis and secure software development. Besides security management, Mario has interest in software security, reverse engineering and cryptography. Within Logica Netherlands, he is knowledge manager application security. Mario holds a PhD in Mathematics and is CISA and CISSP.<br/><br />
<br/><br />
19.30 - 19:50 '''Break'''<br/><br />
<br/><br />
19:50 - 20:20 '''V.A.C: SQL injection''' (Dutch), Marinus Kuivenhoven<br />
<br/><br />
<u>'''V'''ulnerability:</u><br/><br />
An application which uses a database for its information needs, communicates with it trough SQL. SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of a Database for parsing and execution.<br/><br />
<u>'''A'''ssessment:</u><br/><br />
SQL injection can threaten the confidentiality, availability and integrity of the data. The various types of SQL injection and their impact will be shown.<br/><br />
<u>'''C'''ountermeasure:</u><br/><br />
Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because a database will execute all syntactically valid queries that it receives. How this should be done will be shown for the most popular languages.<br/><br />
Marinus is a Technology Specialist with Sogeti Nederland B.V. specializing in service oriented architectures and secure application development. His experience includes developing and administrating Oracle-based systems.<br/><br />
<br/><br />
20.20 - 21.00 '''Secure Programming with Static Analysis''' (English), Brian Chess<br/><br />
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution. We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.<br/><br />
Brian Chess is a founder of Fortify Software and serves as Fortify's Chief Scientist, where his work focuses on practical methods for creating secure systems. His book, Secure Programming with Static Analysis, shows how static source code analysis is an indispensable tool for getting security right. Brian holds a Ph.D. in computer engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service.<br/><br />
<br/><br />
21.00 - 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br />
== Meeting minutes December 20th 2007 ==<br />
<br />
At December 20th, the Dutch OWASP chapter came together at the office of ps_testware located in Doorn. The subject of the evening was 'creating secure (web)applications. There were 3 speakers and close to 30 attendees <br/><br />
<br/><br />
'''First presentation:''' Practices of developing optimal security (dutch), Andre Post<br/><br />
Andre talked from his rich experience as software auditor and code reviewer. Based on his experience he stated that developing good, secure software can only be done with developers with the right set of mind. Security should not be tested into the software, but should be a natural thing for developers to develop into the software. For this you need developers who know by heart when security flaws start to exist and how to prevent them. Developers with the necessary experience are rare and often developer teams do not have the right expertise for developing secure software. The most important conclusion of his speech was that secure software starts with security aware developers.<br/><br />
<br/><br />
'''Second presentation:''' Problems of developing secure and correct applications (dutch), Erik Poll<br/><br />
Erik Poll stated that besides having developers who are aware of security, you should also have developers that now the limitations and inherent security leaks of the used language. One of the problems is that many developers are not taught the inherent security holes in programming languages during their education. <br/><br />
Another problem is that software is often made secure for the wrong reasons. At this moment only two reasons appear to be the drive behind developing secure software: economics and laws. Security is mostly of secondary concern and as such will only be implemented at minimum requirements. Bad examples of big companies who develop insecure software and still be successful even further restrict the demand for secure software.<br/><br />
On the positive side many developers make the same mistakes so testing for common security holes can easily be done with checklists and validation tools. These validation tools can be made more successful with the use of metatags in the code.<br/><br />
Erik concluded his speech that improving the secureness of software can only be achieved when there is commitment, the knowledge is available and software is developed and implemented with a secure mind. <br/><br />
<br/><br />
'''Third presentation:''' Protecting Web services and Web applications against security threats, Rix Groenboom<br/><br />
The third presentation was about a problem which probably will become bigger and bigger the coming years. Although security might be in the scope when developing software at this moment, it certainly was not a requirement 20 or more years ago. Despite their intrinsic insecureness, these systems are connected more and more to the world wide web to meet de demands for online availability. This imposes a major security risk which will become more evident in the years to come and might become bigger than the Y2K problem. Unlike modern software, these applications can only be made secure enough by using advanced testing strategies combined with the use of test-tools and thorough regression tests. Testing alone however is not enough; to accomplish maximum secureness all connections to these systems should be based on a 'deny unless' instead of an 'allow unless' basis. <br/><br />
The conclusion of Rix's talk was that old systems connected to new interfaces should be treated as insecure and all possible precautions should be taken to achieve an acceptable level of secureness.<br/><br />
<br />
== Meeting December 20th 2007: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll [http://www.cs.ru.nl/~erikpoll/talks/OWASP2007.pdf (slides of the presentation)]<br />
<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
<br />
== Meeting September 13th: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting minutes Januar 11th 2007 ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
<br />
== Meeting Januar 11th 2007 ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting minutes March 9thh 2007 ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== Meeting March 9th 2007: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=46663Netherlands2008-11-21T11:35:42Z<p>Bkoelewijn: /* Meeting schedule 2008 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2008 ==<br />
This is an overview of the 2008 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
March 26th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Software Vulnerability assessment<br />
Presentations: Complex(ity) matters, Mario de Boer (Dutch)<br />
V.A.C. SQL injection, Marinus Kuivenhoven (Dutch)<br />
Secure Programming with Static Analysis, Brian Chess (English) <br />
Location : Mercure Utrecht Nieuwegein, Buizerdlaan 10, 3435 SB Nieuwegein<br />
Sponsor : Fortify Software<br />
<br />
Oktober 27th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Privacy and the Internet<br />
Presentations: Privacy and Internet (Dutch), Frank Fruijthoff and Ellen Hoving<br />
Vulnerability and source code scanners. (Dutch) Emile Strijbos <br />
Location : ps_testware B.V., Dorpsstraat 26, 3941 JM DOORN<br />
Sponsor : ps_testware B.V.<br />
<br />
December 11th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Workshop: Architectural and design risk analysis<br />
Presentations: Architectural risk analyses (English), André N. Klingsheim and Lars-Helge Netland <br />
Location : TTY Amsterdam, Kerkstraat 342, 1017 JA Amsterdam<br />
Sponsor : TTY Internet Solutions<br />
</pre><br />
<br />
== Meeting minutes October 27th 2008 ==<br />
<br />
At October 27th, the Dutch OWASP chapter came together at the office of the sponsor of the evening; ps_testware in Doorn. The subject of the evening was 'Privacy and the Internet’. There were 2 speakers and approximately 25 attendees.<br/><br />
<br/><br />
After a short welcome talk by both the sponsor and OWASP, Mario de Boer had an announcement about a new OWASP project; ORPRO, the Open Review Project. The goal of the project is to review Open Source Software from an independent point of view. Reviews will be done both manually and with the aid of source code analysis software provided by Fortify. The first software package to be reviewed is already available so reviewers are needed. More information can be found on the OWASP project page. [http://www.owasp.org/index.php/Category:OWASP_Open_Review_Project]<br/><br />
<br/><br />
'''First presentation:''' Privacy & the Internet presented by Frank Fruijthoff and Ellen Hoving. <br/><br />
The goal of this presentation was to show the problems in regulating privacy on the internet by law. The presentation was roughly split in 3 parts: definitions, requirements and context. <br/><br />
The main problem with regulating privacy is that the concept of privacy is very broad and not well defined. Privacy can have different meanings and consequences in different contexts. Most laws therefore focus on the individual and define privacy as 'protection of personal information' where 'personal information' is all data that can be tracked back to a single person. The last years many countries within the EU developed internet laws concerning privacy on the internet. These laws state that information can only be used what it originally was intended for and usage of that information must be reported at central register. This register also makes it possible to file a complaint and check what companies use personal information for what purposes. While these rules are mostly sufficient for local databases they often fail when applied to information stored on or with use of the internet. Problems encountered are captured in the "four D's";<br/><br />
- Internet is deterritorialized; internet has no boundaries.<br/><br />
- Internet is deregulated; internet has no law, only terms of use.<br/><br />
- Internet is dematerialized; internet is not physical.<br/><br />
- Internet is decentralized; there is no single regulating or controlling organization.<br/><br />
Although the protection of personal data is more and more covered by laws, the increasing usage of external storage and connections over the internet will make it harder to enforce them. The main conclusion of the evening was that, although many initiatives improving privacy exist, the very properties of the internet make it hard to ensure privacy completely. <br/><br />
<br/><br />
'''Second presentation:''' Vulnerability and source code scanners presented by E. Strijbos. This presentation showed the results of a research concerning the feasibility of a Web Application Security Certification by the usage of vulnerability scanners.<br/><br />
With the daily increasing amount of threads and vulnerabilities in web applications there is a market-driven demand for an independent and automated scan service. Current scan services often lack coverage and depth of scanning and give no details about the used scanning methods.<br/><br />
In this research several commercial vulnerability scanners and static analysis tools were compared and checked for scantime, accuracy, false positives, and ease of use. The results showed that almost all scanners find most of the vulnerabilities, but also produce many false positives. Also, without proper configuration the amount of results can be overwhelming and inconclusive. Furthermore results showed that static analysis scanners are much faster than vulnerability scanners, but have a more limited usage. The main conclusion was that although vulnerability scanners and static analysis tools can be very helpful in identifying vulnerabilities, their current efficiency is not high enough to use as the basis for an automated vulnerability scan.<br/><br />
<br />
== Meeting October 27th 2008: Privacy and the Internet ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals about personal and technical privacy on the internet. The speakers focus on privacy regulations related to the internet and on the mass amount of personal and technical information available about persons and companies on the internet, with and without their consent. Furthermore tools will be discussed that help prevent leakage of privacy related and other kind of data. They will give specific examples and there will be time to ask questions.<br/><br />
Please register before October 20th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 20.15 '''Privacy and Internet''' (Dutch), Frank Fruijthoff and Ellen Hoving<br/><br />
In this presentation the general principles of privacy laws in the Netherlands and the EU and specifically privacy and the internet will be covered.<br/><br />
Frank Fruijthoff is a Compliance Officer with ING. He has a Compliance and Risk Management background and is specialised in privacy.<br/><br />
Ellen Hoving is a graduated lawyer. She works as an independent consultant specialized in compliance and privacy.<br/><br />
<br/><br />
20.15 – 20:30 '''Break'''<br/><br />
<br/><br />
20:30 – 21:00 '''Vulnerability and source code scanners''' (Dutch), Emile Strijbos<br />
<br/><br />
For his Master thesis in computer science at the Radboud Universiteit in Nijmegen, Emile Strijbos investigated vulnerability scanners and source code scanners. These are automated tools that try to detect security flaws, either in running web-applications or in their source code.<br/><br />
Emile tried out several of these tools, including both free and commercial ones, to see how good they are at detecting standard vulnerabilities, such as SQL injection, XSS, CSRF, etc.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br><br />
Please register before October 20th, because of the necessary catering arrangements. The number of registries is limited to 50 due to the capacity of the location and will be handled in order of receipt.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_27_Oktober.pdf]]<br/><br />
<br />
== Meeting minutes March 23th 2008 ==<br />
<br />
At March 23th, the Dutch OWASP chapter came together in the Mercury hotel in Nieuwegein. The meeting was sponsored by Fortify Software. The subject of the evening was 'Software Vulnerability Assesment’. There were 3 speakers and approximately 40 attendees.<br/><br />
<br/><br />
After a short introduction of Migchiel de Jong (Fortify) about the subject of Static and Dynamic Analysis and the tools that Fortify provides the speakers of the evening where introduced.<br/><br />
<br/><br />
'''First presentation:''' Practices of Complex(ity) matters (Dutch), Mario de Boer<br/><br />
Mario de Boer has spent much of his free time the last 16 years into disassembling various pieces of software and analyzing the code and its statistics. The main advantage in analyzing binaries is that no access to source code is needed, all dependencies (i.e. the compiler) are included and it’s independent of the tool used. Disassembling compiled code gives great insight in the complexity of the software and the entry and exit points of data. Although there is no direct relation between the complexity of software and its security, statistically the most vulnerabilities appear in the most complex portions of a program. Data entry points in complex portions of the code can give rise to possible exploits so static analysis can give insight in the most vulnerable places in software which is useful information in testing.<br />
The disadvantages of static analysis are that an extensive knowledge of assembly is needed and, due to its statistic nature, it gives rise to many false positives. <br />
In conclusion static binary analysis, when used by experts, can be a powerful tool to gain insight in the most vulnerable parts of the software and be a valuable tool in both developing and testing software. <br/><br />
<br/><br />
'''Second presentation:''' V.A.C: SQL injection (Dutch), Marinus Kuivenhoven<br/><br />
A new reoccurring topic on OWASP presentations will be the so called VAC. In these presentations an expert will talk about a Vulnerability, how to Assess it and possible Countermeasures. This evening Marinus started with the second vulnerability in the OWASP top ten; SQL injections.<br/><br />
With the aid of Webgoat, a few simple examples and the possible consequences were shown. SQL injection is particularly useful exploit in the reconnaissance phase since it can be abused for information leakage and in getting information about e.g. the table structure. <br/><br />
On the internet and in literature many countermeasures against SQL injections are described. However, many of these countermeasures are not usable in a maintainable system or cannot prevent SQL injections completely. The most important conclusion was that input should never be trusted and should never be directly used.<br/><br />
<br/><br />
'''Third presentation:''' Secure Programming with Static Analysis (English), Brian Chess<br/><br />
The last speaker of the evening was Brian Chess who presented his new book ‘Secure Programming with Static Analysis’. Brian made clear that, although a powerful tool, static binary analysis is already too late in the SDLC to be successful in preventing vulnerabilities. Scanning for possible vulnerabilities should be implemented as early as possible i.e. during coding. The main advantages of static analysis are the cost and speed. Since errors and bad practices are identified in an early stage they can be solved at the spot, making auditing the software more efficient in term of time and depth. <br/><br />
Static analysis can successfully be used for style and type checking, program understanding and verification, and for security reviews. The success of static analysis, however, is fully depending on the rules implemented in the scanner. Static analysis is also unable to identify design flaws, right problems, or wrong user input. <br/><br />
The conclusion was that scanning for vulnerabilities can probably only be successful with the aid of static analysis, but many requirements should be met. Firstly it should become part of the SDLC and culture. Secondly the right tool should be picked and people should be trained in its use. Lastly investments should be made in building up a good rule set and metrics. <br/><br />
<br />
== Meeting March 26th 2008: Software Vulnerability assessment ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The main focus will be on software vulnerability assessment. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
Mercure Utrecht Nieuwegein<br/><br />
Buizerdlaan 10,<br/><br />
3435 SB Nieuwegein<br/><br />
</td><br />
<td width="350"><br />
[[Image:Fortify.JPG|143px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="350"><br />
Fortify Software products protect companies from today’s greatest security risk: the software applications that run their businesses. Combining deep application security expertise with extensive software development experience, Fortify Software has defined the market with award-winning products that span the software development cycle. Today, Fortify Software fortifies the software for the most demanding customer deployments, including the world’s largest, most varied code bases.<br/><br />
<br/><br />
For more information please visit:<br/><br />
www.fortify.com<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 - 18:50 '''Introduction''' (OWASP, sponsor)<br/><br />
<br/><br />
18.50 - 19.30 '''Complex(ity) matters''' (Dutch), Mario de Boer<br/><br />
Various methods exist to locate specific vulnerabilities in software. In the presentation we will look at static analysis of binaries, and the problems we face when trying to locate vulnerabilities. Several ideas will be discussed to make the search easier, but at the same time less exact. The first idea is trivial: automate as much as possible. The second idea is nearly trivial: don't aim at exact vulnerabilities but relax the search to locating potential vulnerabilities. We will give examples that illustrate the results.<br/><br />
Mario de Boer is a senior security consultant at Logica, and as such focuses on security management aspects like security frameworks, compliance, monitoring and control and risk management. Before joining Logica, Mario worked at the Dutch ministries of Defense and Justice, he co-founded a security company and worked as a project manager in the financial sector. For several years he taught courses in software security analysis and secure software development. Besides security management, Mario has interest in software security, reverse engineering and cryptography. Within Logica Netherlands, he is knowledge manager application security. Mario holds a PhD in Mathematics and is CISA and CISSP.<br/><br />
<br/><br />
19.30 - 19:50 '''Break'''<br/><br />
<br/><br />
19:50 - 20:20 '''V.A.C: SQL injection''' (Dutch), Marinus Kuivenhoven<br />
<br/><br />
<u>'''V'''ulnerability:</u><br/><br />
An application which uses a database for its information needs, communicates with it trough SQL. SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of a Database for parsing and execution.<br/><br />
<u>'''A'''ssessment:</u><br/><br />
SQL injection can threaten the confidentiality, availability and integrity of the data. The various types of SQL injection and their impact will be shown.<br/><br />
<u>'''C'''ountermeasure:</u><br/><br />
Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because a database will execute all syntactically valid queries that it receives. How this should be done will be shown for the most popular languages.<br/><br />
Marinus is a Technology Specialist with Sogeti Nederland B.V. specializing in service oriented architectures and secure application development. His experience includes developing and administrating Oracle-based systems.<br/><br />
<br/><br />
20.20 - 21.00 '''Secure Programming with Static Analysis''' (English), Brian Chess<br/><br />
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution. We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.<br/><br />
Brian Chess is a founder of Fortify Software and serves as Fortify's Chief Scientist, where his work focuses on practical methods for creating secure systems. His book, Secure Programming with Static Analysis, shows how static source code analysis is an indispensable tool for getting security right. Brian holds a Ph.D. in computer engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service.<br/><br />
<br/><br />
21.00 - 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
<br />
== Meeting minutes December 20th 2007 ==<br />
<br />
At December 20th, the Dutch OWASP chapter came together at the office of ps_testware located in Doorn. The subject of the evening was 'creating secure (web)applications. There were 3 speakers and close to 30 attendees <br/><br />
<br/><br />
'''First presentation:''' Practices of developing optimal security (dutch), Andre Post<br/><br />
Andre talked from his rich experience as software auditor and code reviewer. Based on his experience he stated that developing good, secure software can only be done with developers with the right set of mind. Security should not be tested into the software, but should be a natural thing for developers to develop into the software. For this you need developers who know by heart when security flaws start to exist and how to prevent them. Developers with the necessary experience are rare and often developer teams do not have the right expertise for developing secure software. The most important conclusion of his speech was that secure software starts with security aware developers.<br/><br />
<br/><br />
'''Second presentation:''' Problems of developing secure and correct applications (dutch), Erik Poll<br/><br />
Erik Poll stated that besides having developers who are aware of security, you should also have developers that now the limitations and inherent security leaks of the used language. One of the problems is that many developers are not taught the inherent security holes in programming languages during their education. <br/><br />
Another problem is that software is often made secure for the wrong reasons. At this moment only two reasons appear to be the drive behind developing secure software: economics and laws. Security is mostly of secondary concern and as such will only be implemented at minimum requirements. Bad examples of big companies who develop insecure software and still be successful even further restrict the demand for secure software.<br/><br />
On the positive side many developers make the same mistakes so testing for common security holes can easily be done with checklists and validation tools. These validation tools can be made more successful with the use of metatags in the code.<br/><br />
Erik concluded his speech that improving the secureness of software can only be achieved when there is commitment, the knowledge is available and software is developed and implemented with a secure mind. <br/><br />
<br/><br />
'''Third presentation:''' Protecting Web services and Web applications against security threats, Rix Groenboom<br/><br />
The third presentation was about a problem which probably will become bigger and bigger the coming years. Although security might be in the scope when developing software at this moment, it certainly was not a requirement 20 or more years ago. Despite their intrinsic insecureness, these systems are connected more and more to the world wide web to meet de demands for online availability. This imposes a major security risk which will become more evident in the years to come and might become bigger than the Y2K problem. Unlike modern software, these applications can only be made secure enough by using advanced testing strategies combined with the use of test-tools and thorough regression tests. Testing alone however is not enough; to accomplish maximum secureness all connections to these systems should be based on a 'deny unless' instead of an 'allow unless' basis. <br/><br />
The conclusion of Rix's talk was that old systems connected to new interfaces should be treated as insecure and all possible precautions should be taken to achieve an acceptable level of secureness.<br/><br />
<br />
== Meeting December 20th 2007: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll [http://www.cs.ru.nl/~erikpoll/talks/OWASP2007.pdf (slides of the presentation)]<br />
<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
<br />
== Meeting September 13th: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting minutes Januar 11th 2007 ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
<br />
== Meeting Januar 11th 2007 ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting minutes March 9thh 2007 ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== Meeting March 9th 2007: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:Announcement_27_Oktober.pdf&diff=43373File:Announcement 27 Oktober.pdf2008-10-15T06:15:56Z<p>Bkoelewijn: chapter meeting OWASP-NL chapter on Oktober 27th 2008</p>
<hr />
<div>chapter meeting OWASP-NL chapter on Oktober 27th 2008</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=43372Netherlands2008-10-15T06:14:08Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]<br />
<paypal>Netherlands</paypal><br />
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2008 ==<br />
This is an overview of the 2008 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
March 26th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Software Vulnerability assessment<br />
Presentations: Complex(ity) matters, Mario de Boer (Dutch)<br />
V.A.C. SQL injection, Marinus Kuivenhoven (Dutch)<br />
Secure Programming with Static Analysis, Brian Chess (English) <br />
Location : Mercure Utrecht Nieuwegein, Buizerdlaan 10, 3435 SB Nieuwegein<br />
Sponsor : Fortify Software<br />
<br />
Oktober 27th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Privacy and the Internet<br />
Presentations: Privacy and Internet (Dutch), Frank Fruijthoff and Ellen Hoving<br />
Vulnerability and source code scanners. (Dutch) Emile Strijbos <br />
Location : ps_testware B.V., Dorpsstraat 26, 3941 JM DOORN<br />
Sponsor : ps_testware B.V.<br />
</pre><br />
== Announcement 27 Oktober: Privacy and the Internet ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals about personal and technical privacy on the internet. The speakers focus on privacy regulations related to the internet and on the mass amount of personal and technical information available about persons and companies on the internet, with and without their consent. Furthermore tools will be discussed that help prevent leakage of privacy related and other kind of data. They will give specific examples and there will be time to ask questions.<br/><br />
Please register before October 20th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 20.15 '''Privacy and Internet''' (Dutch), Frank Fruijthoff and Ellen Hoving<br/><br />
In this presentation the general principles of privacy laws in the Netherlands and the EU and specifically privacy and the internet will be covered.<br/><br />
Frank Fruijthoff is a Compliance Officer with ING. He has a Compliance and Risk Management background and is specialised in privacy.<br/><br />
Ellen Hoving is a graduated lawyer. She works as an independent consultant specialized in compliance and privacy.<br/><br />
<br/><br />
20.15 – 20:30 '''Break'''<br/><br />
<br/><br />
20:30 – 21:00 '''Vulnerability and source code scanners''' (Dutch), Emile Strijbos<br />
<br/><br />
For his Master thesis in computer science at the Radboud Universiteit in Nijmegen, Emile Strijbos investigated vulnerability scanners and source code scanners. These are automated tools that try to detect security flaws, either in running web-applications or in their source code.<br/><br />
Emile tried out several of these tools, including both free and commercial ones, to see how good they are at detecting standard vulnerabilities, such as SQL injection, XSS, CSRF, etc.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br><br />
Please register before October 20th, because of the necessary catering arrangements. The number of registries is limited to 50 due to the capacity of the location and will be handled in order of receipt.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_27_Oktober.pdf]]<br/><br />
<br />
== Announcement March 26th: Software Vulnerability assessment ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The main focus will be on software vulnerability assessment. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
Mercure Utrecht Nieuwegein<br/><br />
Buizerdlaan 10,<br/><br />
3435 SB Nieuwegein<br/><br />
</td><br />
<td width="350"><br />
[[Image:Fortify.JPG|143px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="350"><br />
Fortify Software products protect companies from today’s greatest security risk: the software applications that run their businesses. Combining deep application security expertise with extensive software development experience, Fortify Software has defined the market with award-winning products that span the software development cycle. Today, Fortify Software fortifies the software for the most demanding customer deployments, including the world’s largest, most varied code bases.<br/><br />
<br/><br />
For more information please visit:<br/><br />
www.fortify.com<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 - 18:50 '''Introduction''' (OWASP, sponsor)<br/><br />
<br/><br />
18.50 - 19.30 '''Complex(ity) matters''' (Dutch), Mario de Boer<br/><br />
Various methods exist to locate specific vulnerabilities in software. In the presentation we will look at static analysis of binaries, and the problems we face when trying to locate vulnerabilities. Several ideas will be discussed to make the search easier, but at the same time less exact. The first idea is trivial: automate as much as possible. The second idea is nearly trivial: don't aim at exact vulnerabilities but relax the search to locating potential vulnerabilities. We will give examples that illustrate the results.<br/><br />
Mario de Boer is a senior security consultant at Logica, and as such focuses on security management aspects like security frameworks, compliance, monitoring and control and risk management. Before joining Logica, Mario worked at the Dutch ministries of Defense and Justice, he co-founded a security company and worked as a project manager in the financial sector. For several years he taught courses in software security analysis and secure software development. Besides security management, Mario has interest in software security, reverse engineering and cryptography. Within Logica Netherlands, he is knowledge manager application security. Mario holds a PhD in Mathematics and is CISA and CISSP.<br/><br />
<br/><br />
19.30 - 19:50 '''Break'''<br/><br />
<br/><br />
19:50 - 20:20 '''V.A.C: SQL injection''' (Dutch), Marinus Kuivenhoven<br />
<br/><br />
<u>'''V'''ulnerability:</u><br/><br />
An application which uses a database for its information needs, communicates with it trough SQL. SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of a Database for parsing and execution.<br/><br />
<u>'''A'''ssessment:</u><br/><br />
SQL injection can threaten the confidentiality, availability and integrity of the data. The various types of SQL injection and their impact will be shown.<br/><br />
<u>'''C'''ountermeasure:</u><br/><br />
Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because a database will execute all syntactically valid queries that it receives. How this should be done will be shown for the most popular languages.<br/><br />
Marinus is a Technology Specialist with Sogeti Nederland B.V. specializing in service oriented architectures and secure application development. His experience includes developing and administrating Oracle-based systems.<br/><br />
<br/><br />
20.20 - 21.00 '''Secure Programming with Static Analysis''' (English), Brian Chess<br/><br />
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution. We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.<br/><br />
Brian Chess is a founder of Fortify Software and serves as Fortify's Chief Scientist, where his work focuses on practical methods for creating secure systems. His book, Secure Programming with Static Analysis, shows how static source code analysis is an indispensable tool for getting security right. Brian holds a Ph.D. in computer engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service.<br/><br />
<br/><br />
21.00 - 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
== Announcement 20 december: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll [http://www.cs.ru.nl/~erikpoll/talks/OWASP2007.pdf (slides of the presentation)]<br />
<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
<br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=OWASP_Community&diff=26232OWASP Community2008-03-03T19:34:42Z<p>Bkoelewijn: </p>
<hr />
<div>This page is for people to post OWASP related events, such as chapter meetings, OWASP conferences, get-togethers, and OWASP sponsored events.<br />
<br />
Events from previous years are archived here:<br />
* '''[[OWASP Community 2006]]'''<br />
<br />
This page is monitored, and items posted here will be copied to the OWASP Calendar [[Main Page]]. Please post new items in chronological order using the following format:<br />
<br />
'''Mon ## (##:00h) - [[Article]]'''<br />
<br />
<!--<br />
<br />
CHAPTER LEADS -- please put your schedule here and we'll post a month in advance<br />
<br />
*** Belgium ***<br />
<br />
*** OTTAWA: Rough dates ***<br />
<br />
*** BOSTON: Every first Wednesday of the month ***<br />
<br />
*** MELBOURNE: First Tuesday of the month ***<br />
<br />
*** NETHERLANDS: Second Thursday of the month sometimes ***<br />
<br />
*** ROCHESTER: Every third Monday of the month ***<br />
<br />
*** TORONTO: Every second Wednesday of the month<br />
<br />
*** VIRGINIA: Every second thursday of the month ***<br />
<br />
*** SINGAPORE: Every first Thursday of the month ***<br />
<br />
--><br />
<br />
==Upcoming Events==<br />
<br />
'''Dec 11 (18:00h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''Mar 26 (17:30h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
==Upcoming Events==<br />
'''Jan 29 (11:15h) - [[Helsinki|Helsinki chapter and RWSUG seminar]]'''<br />
<br />
'''Jan 29 (11:30h) - [[Cincinnati|Cincinnati chapter meeting]]'''<br />
<br />
'''Dec 20 (17:30h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Dec 15 (11:00h) - [[Pune|Pune chapter meeting]]'''<br />
<br />
'''Dec 12 (18:00h) - [[Chicago|Chicago chapter meeting]]'''<br />
<br />
'''Dec 6 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Dec 5 (18:00h) - [[Boston|Possible Boston OWASP Chapter Meeting]] '''<br />
<br />
'''Dec 3 (13:00h) - [[Israel|OWASP Israel 2007]] '''<br />
<br />
'''Nov 29 (18:00h) -[[Seattle|Seattle Chapter Meeting]] '''<br />
<br />
'''Nov 29 (18:00h) -[[Sacramento|Sacramento Chapter Meeting]] '''<br />
<br />
'''Nov 26 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Nov 26 (09:30h) - [[Turkey|Turkey Chapter Meeting - Izmir]] '''<br />
<br />
'''Nov 24 (13:30h) - [[Turkey|Turkey Chapter Meeting - Ankara]] '''<br />
<br />
'''Nov 20 (18:00h) - [[Belgium|Belgium Chapter Meeting]] '''<br />
<br />
'''Nov 14 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
<br />
'''Nov 14 (18:00h) - [[Houston|Houston Chapter Meeting]] '''<br />
<br />
'''Nov 11 (18:00h) - [[Ireland|Ireland Chapter Meeting]] '''<br />
<br />
'''Nov 7 (18:00h) - [[Boston|Possible Boston OWASP Chapter Meeting]] '''<br />
<br />
'''Nov 7 (19:00h) - [[Singapore|Singapore OWASP Chapter Meeting]] '''<br />
<br />
'''Nov 3 (18:30h) - [[Malaysia|Malaysia OWASP Chapter Meeting]] '''<br />
<br />
==Past Events==<br />
<br />
'''Oct 9 (19:30h) - [[Singapore|Singapore OWASP chapter meeting]]'''<br />
<br />
'''Oct 2 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Sept 27 (1800h) - [[New York|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Sept 27 (13:00h) - [[Taiwan|Taiwan chapter meeting]]'''<br />
<br />
'''Sept 13 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Sept 10 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Sept 7 (15:00h) [[Germany|German chapter meeting]]''' - Restart of the German Chapter<br />
<br />
'''Sept (12:00h) - [[Belgium|Belgium OWASP Day Event]] '''<br />
<br />
'''Sept 6 (18:00h) - [[Kansas_City|Kansas City Chapter meeting]]'''<br />
<br />
'''Sept 5 (18:00h) - [[Chicago|Chicago Chapter Meeting]]'''<br />
<br />
'''Sept 5 (17:00h) - [[Israel|Israeli chapter meeting]]'''<br />
<br />
'''Sept 5 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''July 25 (18:00h) - [[San Jose|San Jose Chapter Meeting]]'''<br />
<br />
'''July 24 (17:00h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''July 14 (11:00h) - [[Turkey|Turkey chapter meeting - 1st Web Security Days]]'''<br />
<br />
'''July 6 (17:00h) - [[Spain|Spain chapter meeting]]'''<br />
<br />
'''June 26 (11:30h) - [[Austin|Austin chapter meeting]]''' - Running Web Application Scans<br />
<br />
'''June 22 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''June 21 (19:00h) - [[Denver]]''' - Anti-DNS Pinning Attacks / Calculating Return on Security Investment (ROSI)<br />
<br />
'''June 19 (18:00h) - [[Minneapolis St Paul|Minneapolis St Paul chapter meeting]]'''<br />
<br />
'''June 15 (17:00h) - [[Spain|Spain chapter meeting]]'''<br />
<br />
'''June 13 (18:30h) - [[Kansas City|Kansas City chapter meeting]]'''<br />
<br />
'''June 12 (18:00h) - [[New York|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Jun 5 (19:00h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Jun 5 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Jun 5 (17:30h) - [[Houston | Houston Chapter Meeting]]'''<br />
<br />
'''May 29 (9:00h) - [[http://www.owasp.org/index.php/Italy#May_29th.2C_2007_-_Seminar:_.22Software_Security.22 Italy@Firenze Tecnologia]]'''<br />
<br />
'''May 29 (11:30h) - [[Austin | Austin Chapter Meeting]]''' - Bullet Proof UI - A programmer's guide to the complete idiot". <br />
<br />
'''May 29 (18:00h) - [[Ottawa | Ottawa Chapter Meeting]]'''<br />
<br />
'''May 22 (18:30h) - [[New Zealand|1st New Zealand chapter Meeting]]'''<br />
<br />
'''May 21 (14:00h) - [[Israel|2nd OWASP Israel mini conference]]'''<br />
<br />
'''May 15 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''May 10 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''May 9 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''May 8 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''May 6 (11:00h) - [[Turkey|Turkey chapter meeting]]'''<br />
<br />
'''May 2 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''May 1 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Apr 26 (11:00h) - [[San Antonio|San Antonio chapter meeting]]'''<br />
<br />
'''Apr 26 (17:00h) - [[Switzerland|Switzerland chapter meeting and "Swiss Security Dinner"]]'''<br />
<br />
'''Apr 24 (18:00h) - [[Minneapolis St Paul|Minneapolis St Paul chapter meeting]]'''<br />
<br />
'''Apr 20 (19:00h) - [[Hong Kong|Hong Kong chapter meeting - Objectives for 2007]]'''<br />
<br />
'''Apr 19 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Apr 18 (17:00h) - [[San Francisco City Chapter Meeting]]'''<br />
<br />
'''Apr 17 (18:00h) - [[New Jersey|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Apr 17 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Apr 12 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Apr 12 (18:00h) - [[San Jose|San Jose chapter meeting]]'''<br />
<br />
'''Apr 11 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Apr 4 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Apr 3 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Mar 30 - [[http://www.owasp.org/index.php/Italy#March_30th.2C_2007_-_Master_in_Security_-_University_of_Rome_.22La_Sapienza.22| Italy@Master in Security at "La Sapienza"]]'''<br />
<br />
'''Mar 28 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''<br />
<br />
'''Mar 28 (11:30h) - [[San Antonio|San Antonio chapter meeting]]'''<br />
<br />
; '''Mar 27-30 - [http://www.blackhat.com Black Hat Euro]'''<br />
: OWASP members receive a Euro 100 Briefings discount by inserting BH7EUASSOC in the box marked “Coupon Codes”<br />
<br />
'''Mar 22 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Mar 21-22 - [[Belgium#OWASP_Top_10_2007_Update_.28Infosecurity_Belgium.2C_21_.26_.2622_Mar_2007.29|Belgium@InfoSecurity]]'''<br />
<br />
'''Mar 20 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Mar 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Mar 14 (18:00h) - [[Chicago|Chicago chapter meeting]]'''<br />
<br />
'''Mar 13 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Mar 8 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
<br />
'''Mar 7 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Mar 7 (18:30h) - [[Kansas City|Kansas City chapter meeting]]'''<br />
<br />
'''Mar 6 (18:30h) - [[Philadelphia|Philadelphia chapter meeting]]'''<br />
<br />
'''Mar 6 (18:30h) - [[San Francisco|San Francisco and San Jose chapter meeting]]'''<br />
<br />
'''Mar 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Mar 5 (11:00h) - [[New Jersey|New Jersey chapter meeting]]'''<br />
<br />
'''Mar 1 (11:30h) - [http://www.eusecwest.com/agenda.html EUSecWest 07: Testing Guide]'''<br />
<br />
; '''Feb 26-Mar 1 - [http://www.blackhat.com Black Hat DC]'''<br />
: OWASP members receive a $100 Briefings discount by inserting BH7DCASSOC in the box marked “Coupon Codes”<br />
<br />
'''Feb 28 (18:00h) - [[Seattle|Seattle chapter meeting]]'''<br />
<br />
'''Feb 27 (18:00h) - [[Edmonton|Edmonton chapter meeting]]'''<br />
<br />
'''Feb 22 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Feb 22 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Feb 21 (18:30h) - [[Denver|Denver chapter meeting]]'''<br />
<br />
'''Feb 19 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Feb 15 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''<br />
<br />
'''Feb 15 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Feb 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Feb 13 (18:00h) - [[Ireland|Ireland chapter meeting]]'''<br />
<br />
'''Feb 12 (18:30h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''Feb 7 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Feb 6-7 - [[Italy#February_6th-8th.2C_2007_-_InfoSecurity|Italy@InfoSecurity]]'''<br />
<br />
'''Feb 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Feb 2 (14:00h) - [[Chennai|Chennai chapter meeting]]'''<br />
<br />
'''Jan 31 (15:00h) - [[Mumbai|Mumbai chapter meeting]]'''<br />
<br />
'''Jan 30 (11:30h) - [[Austin|Austin chapter meeting]]'''<br />
<br />
'''Jan 25 (18:00h) - [[San Francisco| San Francisco chapter meeting]]'''<br />
<br />
'''Jan 25 (14:30h) - [[Italy#October_25th.2C_2007_-_Isaca_Rome|Italy@ISACA Rome]]'''<br />
<br />
'''Jan 24 (17:30h) - [[Israel#6th_OWASP_IL_meeting:_Wednesday.2C_January_24th_2007|6th OWASP Israel chapter meeting]]'''<br />
<br />
'''Jan 23 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''Jan 22 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Jan 17 (18:30h) - [[Denver|Denver chapter meeting]]'''<br />
<br />
'''Jan 16 (17:45h) - [[Edmonton|Edmonton chapter meeting]]'''<br />
<br />
'''Jan 11 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Jan 11 (18:30h) - [[Phoenix|Phoenix chapter meeting]]'''<br />
<br />
'''Jan 11 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Jan 10 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Jan 8 (18:00h) - [[Seattle|Seattle chapter meeting]]'''<br />
<br />
'''Jan 3 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''May 1 - [[Melbourne | Melbourne chapter meeting]]'''<br />
<br />
'''May 2 - [[Boston]]'''<br />
<br />
'''May 6 - [[Turkey]]'''<br />
<br />
'''May 8 - [[Virginia (Northern Virginia)|Washington DC (VA)]]'''<br />
<br />
'''May 9 - [[Toronto]]'''<br />
<br />
'''May 10 - [[Belgium]]'''<br />
<br />
'''May 15 - [[Rochester]]'''<br />
<br />
'''May 21 - [[Israel]]'''<br />
<br />
'''May 22 - [[New Zealand]]'''<br />
<br />
'''May 29 - [[Italy]]'''<br />
<br />
'''June 5 - [[Houston]]'''<br />
<br />
'''June 5 - [[Melbourne]]'''<br />
<br />
'''June 5 - [[Helsinki]]'''<br />
<br />
'''June 12 - [[New Jersey]]'''<br />
<br />
'''June 15 - [[Spain]]'''<br />
<br />
'''July 14 - [[Turkey]]'''</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=26231Netherlands2008-03-03T19:30:27Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2008 ==<br />
This is an overview of the 2008 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
March 26th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Software Vulnerability assessment<br />
Presentations: Complex(ity) matters, Mario de Boer (Dutch)<br />
V.A.C. SQL injection, Marinus Kuivenhoven (Dutch)<br />
Secure Programming with Static Analysis, Brian Chess (English) <br />
Location : Mercure Utrecht Nieuwegein, Buizerdlaan 10, 3435 SB Nieuwegein<br />
Sponsor : Fortify Software<br />
</pre><br />
== Announcement March 26th: Software Vulnerability assessment ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The main focus will be on software vulnerability assessment. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
Mercure Utrecht Nieuwegein<br/><br />
Buizerdlaan 10,<br/><br />
3435 SB Nieuwegein<br/><br />
</td><br />
<td width="350"><br />
[[Image:Fortify.JPG|143px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="350"><br />
Fortify Software products protect companies from today’s greatest security risk: the software applications that run their businesses. Combining deep application security expertise with extensive software development experience, Fortify Software has defined the market with award-winning products that span the software development cycle. Today, Fortify Software fortifies the software for the most demanding customer deployments, including the world’s largest, most varied code bases.<br/><br />
<br/><br />
For more information please visit:<br/><br />
www.fortify.com<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 - 18:50 '''Introduction''' (OWASP, sponsor)<br/><br />
<br/><br />
18.50 - 19.30 '''Complex(ity) matters''' (Dutch), Mario de Boer<br/><br />
Various methods exist to locate specific vulnerabilities in software. In the presentation we will look at static analysis of binaries, and the problems we face when trying to locate vulnerabilities. Several ideas will be discussed to make the search easier, but at the same time less exact. The first idea is trivial: automate as much as possible. The second idea is nearly trivial: don't aim at exact vulnerabilities but relax the search to locating potential vulnerabilities. We will give examples that illustrate the results.<br/><br />
Mario de Boer is a senior security consultant at Logica, and as such focuses on security management aspects like security frameworks, compliance, monitoring and control and risk management. Before joining Logica, Mario worked at the Dutch ministries of Defense and Justice, he co-founded a security company and worked as a project manager in the financial sector. For several years he taught courses in software security analysis and secure software development. Besides security management, Mario has interest in software security, reverse engineering and cryptography. Within Logica Netherlands, he is knowledge manager application security. Mario holds a PhD in Mathematics and is CISA and CISSP.<br/><br />
<br/><br />
19.30 - 19:50 '''Break'''<br/><br />
<br/><br />
19:50 - 20:20 '''V.A.C: SQL injection''' (Dutch), Marinus Kuivenhoven<br />
<br/><br />
<u>'''V'''ulnerability:</u><br/><br />
An application which uses a database for its information needs, communicates with it trough SQL. SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of a Database for parsing and execution.<br/><br />
<u>'''A'''ssessment:</u><br/><br />
SQL injection can threaten the confidentiality, availability and integrity of the data. The various types of SQL injection and their impact will be shown.<br/><br />
<u>'''C'''ountermeasure:</u><br/><br />
Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because a database will execute all syntactically valid queries that it receives. How this should be done will be shown for the most popular languages.<br/><br />
Marinus is a Technology Specialist with Sogeti Nederland B.V. specializing in service oriented architectures and secure application development. His experience includes developing and administrating Oracle-based systems.<br/><br />
<br/><br />
20.20 - 21.00 '''Secure Programming with Static Analysis''' (English), Brian Chess<br/><br />
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution. We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.<br/><br />
Brian Chess is a founder of Fortify Software and serves as Fortify's Chief Scientist, where his work focuses on practical methods for creating secure systems. His book, Secure Programming with Static Analysis, shows how static source code analysis is an indispensable tool for getting security right. Brian holds a Ph.D. in computer engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service.<br/><br />
<br/><br />
21.00 - 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
== Announcement 20 december: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll [http://www.cs.ru.nl/~erikpoll/talks/OWASP2007.pdf (slides of the presentation)]<br />
<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
<br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=26227Netherlands2008-03-03T19:28:27Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2008 ==<br />
This is an overview of the 2008 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
March 26th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Software Vulnerability assessment<br />
Presentations: Complex(ity) matters, Mario de Boer (dutch)<br />
V.A.C. SQL injection, Marinus Kuivenhoven (dutch)<br />
Secure Programming with Static Analysis, Brian Chess (english) <br />
Location : Mercure Utrecht Nieuwegein, Buizerdlaan 10, 3435 SB NIEUWEGEIN<br />
Sponsor : Fortify Software<br />
</pre><br />
== Announcement March 26th: Software Vulnerability assessment ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The main focus will be on software vulnerability assessment. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
Mercure Utrecht Nieuwegein<br/><br />
Buizerdlaan 10,<br/><br />
3435 SB Nieuwegein<br/><br />
</td><br />
<td width="350"><br />
[[Image:Fortify.JPG|143px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="350"><br />
Fortify Software products protect companies from today’s greatest security risk: the software applications that run their businesses. Combining deep application security expertise with extensive software development experience, Fortify Software has defined the market with award-winning products that span the software development cycle. Today, Fortify Software fortifies the software for the most demanding customer deployments, including the world’s largest, most varied code bases.<br/><br />
<br/><br />
For more information please visit:<br/><br />
www.fortify.com<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 - 18:50 '''Introduction''' (OWASP, sponsor)<br/><br />
<br/><br />
18.50 - 19.30 '''Complex(ity) matters''' (Dutch), Mario de Boer<br/><br />
Various methods exist to locate specific vulnerabilities in software. In the presentation we will look at static analysis of binaries, and the problems we face when trying to locate vulnerabilities. Several ideas will be discussed to make the search easier, but at the same time less exact. The first idea is trivial: automate as much as possible. The second idea is nearly trivial: don't aim at exact vulnerabilities but relax the search to locating potential vulnerabilities. We will give examples that illustrate the results.<br/><br />
Mario de Boer is a senior security consultant at Logica, and as such focuses on security management aspects like security frameworks, compliance, monitoring and control and risk management. Before joining Logica, Mario worked at the Dutch ministries of Defense and Justice, he co-founded a security company and worked as a project manager in the financial sector. For several years he taught courses in software security analysis and secure software development. Besides security management, Mario has interest in software security, reverse engineering and cryptography. Within Logica Netherlands, he is knowledge manager application security. Mario holds a PhD in Mathematics and is CISA and CISSP.<br/><br />
<br/><br />
19.30 - 19:50 '''Break'''<br/><br />
<br/><br />
19:50 - 20:20 '''V.A.C: SQL injection''' (Dutch), Marinus Kuivenhoven<br />
<br/><br />
<u>'''V'''ulnerability:</u><br/><br />
An application which uses a database for its information needs, communicates with it trough SQL. SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of a Database for parsing and execution.<br/><br />
<u>'''A'''ssessment:</u><br/><br />
SQL injection can threaten the confidentiality, availability and integrity of the data. The various types of SQL injection and their impact will be shown.<br/><br />
<u>'''C'''ountermeasure:</u><br/><br />
Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because a database will execute all syntactically valid queries that it receives. How this should be done will be shown for the most popular languages.<br/><br />
Marinus is a Technology Specialist with Sogeti Nederland B.V. specializing in service oriented architectures and secure application development. His experience includes developing and administrating Oracle-based systems.<br/><br />
<br/><br />
20.20 - 21.00 '''Secure Programming with Static Analysis''' (English), Brian Chess<br/><br />
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution. We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.<br/><br />
Brian Chess is a founder of Fortify Software and serves as Fortify's Chief Scientist, where his work focuses on practical methods for creating secure systems. His book, Secure Programming with Static Analysis, shows how static source code analysis is an indispensable tool for getting security right. Brian holds a Ph.D. in computer engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service.<br/><br />
<br/><br />
21.00 - 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
== Announcement 20 december: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll [http://www.cs.ru.nl/~erikpoll/talks/OWASP2007.pdf (slides of the presentation)]<br />
<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
<br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=26223Netherlands2008-03-03T19:24:25Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2008 ==<br />
This is an overview of the 2008 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
March 26th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Software Vulnerability assessment<br />
Presentations: Complex(ity) matters, Mario de Boer (dutch)<br />
V.A.C. SQL injection, Marinus Kuivenhoven (dutch)<br />
Secure Programming with Static Analysis, Brian Chess (english) <br />
Location : Mercure Utrecht Nieuwegein, Buizerdlaan 10, 3435 SB NIEUWEGEIN<br />
Sponsor : Fortify Software<br />
</pre><br />
== Announcement March 26th: Software Vulnerability assessment ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The main focus will be on software vulnerability assessment. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
Mercure Utrecht Nieuwegein<br/><br />
Buizerdlaan 10,<br/><br />
3435 SB Nieuwegein<br/><br />
</td><br />
<td width="350"><br />
[[Image:Fortify.JPG|143px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
</td><br />
<td width="350"><br />
Fortify Software products protect companies from today’s greatest security risk: the software applications that run their businesses. Combining deep application security expertise with extensive software development experience, Fortify Software has defined the market with award-winning products that span the software development cycle. Today, Fortify Software fortifies the software for the most demanding customer deployments, including the world’s largest, most varied code bases.<br/><br />
<br/><br />
For more information please visit:<br/><br />
www.fortify.com<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 18:50 '''Introduction''' (OWASP, sponsor)<br/><br />
<br/><br />
18.50 - 19.30 '''Complex(ity) matters''' (Dutch), Mario de Boer<br/><br />
Various methods exist to locate specific vulnerabilities in software. In the presentation we will look at static analysis of binaries, and the problems we face when trying to locate vulnerabilities. Several ideas will be discussed to make the search easier, but at the same time less exact. The first idea is trivial: automate as much as possible. The second idea is nearly trivial: don't aim at exact vulnerabilities but relax the search to locating potential vulnerabilities. We will give examples that illustrate the results.<br/><br />
Mario de Boer is a senior security consultant at Logica, and as such focuses on security management aspects like security frameworks, compliance, monitoring and control and risk management. Before joining Logica, Mario worked at the Dutch ministries of Defense and Justice, he co-founded a security company and worked as a project manager in the financial sector. For several years he taught courses in software security analysis and secure software development. Besides security management, Mario has interest in software security, reverse engineering and cryptography. Within Logica Netherlands, he is knowledge manager application security. Mario holds a PhD in Mathematics and is CISA and CISSP.<br/><br />
<br/><br />
19.30 – 19:50 '''Break'''<br/><br />
<br/><br />
19:50 – 20:20 '''V.A.C. SQL injection''' (Dutch), Marinus Kuivenhoven<br />
<br/><br />
'''V'''ulnerability:<br/><br />
An application which uses a database for its information needs, communicates with it trough SQL. SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of a Database for parsing and execution.<br/><br />
'''A'''ssessment:<br/><br />
SQL injection can threaten the confidentiality, availability and integrity of the data. The various types of SQL injection and their impact will be shown.<br/><br />
'''C'''ountermeasure:<br/><br />
Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because a database will execute all syntactically valid queries that it receives. How this should be done will be shown for the most popular languages.<br/><br />
Marinus is a Technology Specialist with Sogeti Nederland B.V. specializing in service oriented architectures and secure application development. His experience includes developing and administrating Oracle-based systems.<br/><br />
<br/><br />
20.20 - 21.00 '''Secure Programming with Static Analysis''' (English), Brian Chess<br/><br />
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution. We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.<br/><br />
Brian Chess is a founder of Fortify Software and serves as Fortify's Chief Scientist, where his work focuses on practical methods for creating secure systems. His book, Secure Programming with Static Analysis, shows how static source code analysis is an indispensable tool for getting security right. Brian holds a Ph.D. in computer engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
== Announcement 20 december: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll [http://www.cs.ru.nl/~erikpoll/talks/OWASP2007.pdf (slides of the presentation)]<br />
<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
<br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=26211Netherlands2008-03-03T16:02:51Z<p>Bkoelewijn: /* Meeting schedule 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2008 ==<br />
This is an overview of the 2008 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
March 26th<br />
----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Software Vulnerability assessment<br />
Presentations: Complex(ity) matters, Mario de Boer (dutch)<br />
V.A.C. SQL injection, Marinus Kuivenhoven (dutch)<br />
Secure Programming with Static Analysis, Brian Chess (english) <br />
Location : Mercure Utrecht Nieuwegein, Buizerdlaan 10, 3435 SB NIEUWEGEIN<br />
Sponsor : Fortify Software<br />
</pre><br />
<br />
== Announcement 20 december: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll [http://www.cs.ru.nl/~erikpoll/talks/OWASP2007.pdf (slides of the presentation)]<br />
<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
<br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=23923Netherlands2007-12-09T15:08:23Z<p>Bkoelewijn: /* Meeting schedule 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
This is an overview of the 2007 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
13 September<br />
------------<br />
Time : 18.00 - 21.30<br />
Main Topic : OWASP Netherlands chapter: putting initiatives into practice<br />
Presentations: Security Best Practices for .NET, Boaz Shunami<br />
Group discussion<br />
Location : Rivium Boulevard 102, 2909LK Capelle aan den IJssel <br />
Sponsor : Comsec Consulting BV<br />
<br />
<br />
20 December<br />
-----------<br />
Time : 17.30 - 21.30<br />
Main Topic : Creating secure (web-)applications; for developers and security professionals.<br />
Presentations: Practices of developing optimal security, André Post<br />
Problems of developing secure and correct applications, Erik Poll<br />
Protecting Web services and Web applications against security threats, Dr. Rix Groenboom<br />
Location : Dorpsstraat 26, 3941JM Doorn<br />
Sponsor : ps_testware bv<br />
</pre><br />
<br />
== Announcement 20 december: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
Please register before December 14th, because of the necessary catering arrangements. The number of registries is limited to 50 due to the capacity of the location and will be handled in order of receipt.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=OWASP_Community&diff=23922OWASP Community2007-12-09T15:02:29Z<p>Bkoelewijn: /* Upcoming Events */</p>
<hr />
<div>This page is for people to post OWASP related events, such as chapter meetings, OWASP conferences, get-togethers, and OWASP sponsored events.<br />
<br />
Events from previous years are archived here:<br />
* '''[[OWASP Community 2006]]'''<br />
<br />
This page is monitored, and items posted here will be copied to the OWASP Calendar [[Main Page]]. Please post new items in chronological order using the following format:<br />
<br />
'''Mon ## (##:00h) - [[Article]]'''<br />
<br />
<!--<br />
<br />
CHAPTER LEADS -- please put your schedule here and we'll post a month in advance<br />
<br />
*** Belgium ***<br />
<br />
*** OTTAWA: Rough dates ***<br />
<br />
*** BOSTON: Every first Wednesday of the month ***<br />
<br />
*** MELBOURNE: First Tuesday of the month ***<br />
<br />
*** NETHERLANDS: Second Thursday of the month sometimes ***<br />
<br />
*** ROCHESTER: Every third Monday of the month ***<br />
<br />
*** TORONTO: Every second Wednesday of the month<br />
<br />
*** VIRGINIA: Every second thursday of the month ***<br />
<br />
*** SINGAPORE: Every first Thursday of the month ***<br />
<br />
--><br />
<br />
==Upcoming Events==<br />
'''Dec 11 (18:00h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
==Upcoming Events==<br />
<br />
'''Dec 20 (17:30h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Dec 12 (18:00h) - [[Chicago|Chicago chapter meeting]]'''<br />
<br />
'''Dec 6 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Dec 5 (18:00h) - [[Boston|Possible Boston OWASP Chapter Meeting]] '''<br />
<br />
'''Dec 3 (13:00h) - [[Israel|OWASP Israel 2007]] '''<br />
<br />
'''Nov 29 (18:00h) -[[Seattle|Seattle Chapter Meeting]] '''<br />
<br />
'''Nov 29 (18:00h) -[[Sacramento|Sacramento Chapter Meeting]] '''<br />
<br />
'''Nov 26 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Nov 26 (09:30h) - [[Turkey|Turkey Chapter Meeting - Izmir]] '''<br />
<br />
'''Nov 24 (13:30h) - [[Turkey|Turkey Chapter Meeting - Ankara]] '''<br />
<br />
'''Nov 20 (18:00h) - [[Belgium|Belgium Chapter Meeting]] '''<br />
<br />
'''Nov 14 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
<br />
'''Nov 14 (18:00h) - [[Houston|Houston Chapter Meeting]] '''<br />
<br />
'''Nov 11 (18:00h) - [[Ireland|Ireland Chapter Meeting]] '''<br />
<br />
'''Nov 7 (18:00h) - [[Boston|Possible Boston OWASP Chapter Meeting]] '''<br />
<br />
'''Nov 7 (19:00h) - [[Singapore|Singapore OWASP Chapter Meeting]] '''<br />
<br />
'''Nov 3 (18:30h) - [[Malaysia|Malaysia OWASP Chapter Meeting]] '''<br />
<br />
==Past Events==<br />
<br />
'''Oct 9 (19:30h) - [[Singapore|Singapore OWASP chapter meeting]]'''<br />
<br />
'''Oct 2 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Sept 27 (1800h) - [[New York|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Sept 27 (13:00h) - [[Taiwan|Taiwan chapter meeting]]'''<br />
<br />
'''Sept 13 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Sept 10 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Sept 7 (15:00h) [[Germany|German chapter meeting]]''' - Restart of the German Chapter<br />
<br />
'''Sept (12:00h) - [[Belgium|Belgium OWASP Day Event]] '''<br />
<br />
'''Sept 6 (18:00h) - [[Kansas_City|Kansas City Chapter meeting]]'''<br />
<br />
'''Sept 5 (18:00h) - [[Chicago|Chicago Chapter Meeting]]'''<br />
<br />
'''Sept 5 (17:00h) - [[Israel|Israeli chapter meeting]]'''<br />
<br />
'''Sept 5 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''July 25 (18:00h) - [[San Jose|San Jose Chapter Meeting]]'''<br />
<br />
'''July 24 (17:00h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''July 14 (11:00h) - [[Turkey|Turkey chapter meeting - 1st Web Security Days]]'''<br />
<br />
'''July 6 (17:00h) - [[Spain|Spain chapter meeting]]'''<br />
<br />
'''June 26 (11:30h) - [[Austin|Austin chapter meeting]]''' - Running Web Application Scans<br />
<br />
'''June 22 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''June 21 (19:00h) - [[Denver]]''' - Anti-DNS Pinning Attacks / Calculating Return on Security Investment (ROSI)<br />
<br />
'''June 19 (18:00h) - [[Minneapolis St Paul|Minneapolis St Paul chapter meeting]]'''<br />
<br />
'''June 15 (17:00h) - [[Spain|Spain chapter meeting]]'''<br />
<br />
'''June 13 (18:30h) - [[Kansas City|Kansas City chapter meeting]]'''<br />
<br />
'''June 12 (18:00h) - [[New York|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Jun 5 (19:00h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Jun 5 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Jun 5 (17:30h) - [[Houston | Houston Chapter Meeting]]'''<br />
<br />
'''May 29 (9:00h) - [[http://www.owasp.org/index.php/Italy#May_29th.2C_2007_-_Seminar:_.22Software_Security.22 Italy@Firenze Tecnologia]]'''<br />
<br />
'''May 29 (11:30h) - [[Austin | Austin Chapter Meeting]]''' - Bullet Proof UI - A programmer's guide to the complete idiot". <br />
<br />
'''May 29 (18:00h) - [[Ottawa | Ottawa Chapter Meeting]]'''<br />
<br />
'''May 22 (18:30h) - [[New Zealand|1st New Zealand chapter Meeting]]'''<br />
<br />
'''May 21 (14:00h) - [[Israel|2nd OWASP Israel mini conference]]'''<br />
<br />
'''May 15 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''May 10 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''May 9 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''May 8 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''May 6 (11:00h) - [[Turkey|Turkey chapter meeting]]'''<br />
<br />
'''May 2 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''May 1 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Apr 26 (11:00h) - [[San Antonio|San Antonio chapter meeting]]'''<br />
<br />
'''Apr 26 (17:00h) - [[Switzerland|Switzerland chapter meeting and "Swiss Security Dinner"]]'''<br />
<br />
'''Apr 24 (18:00h) - [[Minneapolis St Paul|Minneapolis St Paul chapter meeting]]'''<br />
<br />
'''Apr 20 (19:00h) - [[Hong Kong|Hong Kong chapter meeting - Objectives for 2007]]'''<br />
<br />
'''Apr 19 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Apr 18 (17:00h) - [[San Francisco City Chapter Meeting]]'''<br />
<br />
'''Apr 17 (18:00h) - [[New Jersey|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Apr 17 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Apr 12 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Apr 12 (18:00h) - [[San Jose|San Jose chapter meeting]]'''<br />
<br />
'''Apr 11 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Apr 4 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Apr 3 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Mar 30 - [[http://www.owasp.org/index.php/Italy#March_30th.2C_2007_-_Master_in_Security_-_University_of_Rome_.22La_Sapienza.22| Italy@Master in Security at "La Sapienza"]]'''<br />
<br />
'''Mar 28 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''<br />
<br />
'''Mar 28 (11:30h) - [[San Antonio|San Antonio chapter meeting]]'''<br />
<br />
; '''Mar 27-30 - [http://www.blackhat.com Black Hat Euro]'''<br />
: OWASP members receive a Euro 100 Briefings discount by inserting BH7EUASSOC in the box marked “Coupon Codes”<br />
<br />
'''Mar 22 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Mar 21-22 - [[Belgium#OWASP_Top_10_2007_Update_.28Infosecurity_Belgium.2C_21_.26_.2622_Mar_2007.29|Belgium@InfoSecurity]]'''<br />
<br />
'''Mar 20 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Mar 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Mar 14 (18:00h) - [[Chicago|Chicago chapter meeting]]'''<br />
<br />
'''Mar 13 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Mar 8 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
<br />
'''Mar 7 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Mar 7 (18:30h) - [[Kansas City|Kansas City chapter meeting]]'''<br />
<br />
'''Mar 6 (18:30h) - [[Philadelphia|Philadelphia chapter meeting]]'''<br />
<br />
'''Mar 6 (18:30h) - [[San Francisco|San Francisco and San Jose chapter meeting]]'''<br />
<br />
'''Mar 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Mar 5 (11:00h) - [[New Jersey|New Jersey chapter meeting]]'''<br />
<br />
'''Mar 1 (11:30h) - [http://www.eusecwest.com/agenda.html EUSecWest 07: Testing Guide]'''<br />
<br />
; '''Feb 26-Mar 1 - [http://www.blackhat.com Black Hat DC]'''<br />
: OWASP members receive a $100 Briefings discount by inserting BH7DCASSOC in the box marked “Coupon Codes”<br />
<br />
'''Feb 28 (18:00h) - [[Seattle|Seattle chapter meeting]]'''<br />
<br />
'''Feb 27 (18:00h) - [[Edmonton|Edmonton chapter meeting]]'''<br />
<br />
'''Feb 22 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Feb 22 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Feb 21 (18:30h) - [[Denver|Denver chapter meeting]]'''<br />
<br />
'''Feb 19 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Feb 15 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''<br />
<br />
'''Feb 15 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Feb 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Feb 13 (18:00h) - [[Ireland|Ireland chapter meeting]]'''<br />
<br />
'''Feb 12 (18:30h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''Feb 7 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Feb 6-7 - [[Italy#February_6th-8th.2C_2007_-_InfoSecurity|Italy@InfoSecurity]]'''<br />
<br />
'''Feb 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Feb 2 (14:00h) - [[Chennai|Chennai chapter meeting]]'''<br />
<br />
'''Jan 31 (15:00h) - [[Mumbai|Mumbai chapter meeting]]'''<br />
<br />
'''Jan 30 (11:30h) - [[Austin|Austin chapter meeting]]'''<br />
<br />
'''Jan 25 (18:00h) - [[San Francisco| San Francisco chapter meeting]]'''<br />
<br />
'''Jan 25 (14:30h) - [[Italy#October_25th.2C_2007_-_Isaca_Rome|Italy@ISACA Rome]]'''<br />
<br />
'''Jan 24 (17:30h) - [[Israel#6th_OWASP_IL_meeting:_Wednesday.2C_January_24th_2007|6th OWASP Israel chapter meeting]]'''<br />
<br />
'''Jan 23 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''Jan 22 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Jan 17 (18:30h) - [[Denver|Denver chapter meeting]]'''<br />
<br />
'''Jan 16 (17:45h) - [[Edmonton|Edmonton chapter meeting]]'''<br />
<br />
'''Jan 11 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Jan 11 (18:30h) - [[Phoenix|Phoenix chapter meeting]]'''<br />
<br />
'''Jan 11 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Jan 10 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Jan 8 (18:00h) - [[Seattle|Seattle chapter meeting]]'''<br />
<br />
'''Jan 3 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''May 1 - [[Melbourne | Melbourne chapter meeting]]'''<br />
<br />
'''May 2 - [[Boston]]'''<br />
<br />
'''May 6 - [[Turkey]]'''<br />
<br />
'''May 8 - [[Virginia (Northern Virginia)|Washington DC (VA)]]'''<br />
<br />
'''May 9 - [[Toronto]]'''<br />
<br />
'''May 10 - [[Belgium]]'''<br />
<br />
'''May 15 - [[Rochester]]'''<br />
<br />
'''May 21 - [[Israel]]'''<br />
<br />
'''May 22 - [[New Zealand]]'''<br />
<br />
'''May 29 - [[Italy]]'''<br />
<br />
'''June 5 - [[Houston]]'''<br />
<br />
'''June 5 - [[Melbourne]]'''<br />
<br />
'''June 5 - [[Helsinki]]'''<br />
<br />
'''June 12 - [[New Jersey]]'''<br />
<br />
'''June 15 - [[Spain]]'''<br />
<br />
'''July 14 - [[Turkey]]'''</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=23861Netherlands2007-12-05T10:30:29Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
This is an overview of the 2007 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
13 September<br />
------------<br />
Time : 18.00 - 21.30<br />
Main Topic : OWASP Netherlands chapter: putting initiatives into practice<br />
Presentations: Security Best Practices for .NET, Boaz Shunami<br />
Group discussion<br />
Location : Rivium Boulevard 102, 2909LK Capelle aan den IJssel <br />
Sponsor : Comsec Consulting BV<br />
<br />
<br />
20 December<br />
-----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Creating secure (web-)applications; for developers and security professionals.<br />
Presentations: Practices of developing optimal security, André Post<br />
Problems of developing secure and correct applications, Erik Poll<br />
Protecting Web services and Web applications against security threats, Dr. Rix Groenboom<br />
Location : Dorpsstraat 26, 3941JM Doorn<br />
Sponsor : ps_testware bv<br />
</pre><br />
<br />
== Announcement 20 december: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
Please register before December 14th, because of the necessary catering arrangements. The number of registries is limited to 50 due to the capacity of the location and will be handled in order of receipt.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
The announcement and full descriptions can be found here:<br/><br />
[[Media:Announcement_20_December.pdf]]<br/><br />
[[Media:Announcement_20_December_2.pdf]]<br/><br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:Announcement_20_December.pdf&diff=23860File:Announcement 20 December.pdf2007-12-05T10:28:37Z<p>Bkoelewijn: Announcement OWASP Netherlands chapter meeting</p>
<hr />
<div>Announcement OWASP Netherlands chapter meeting</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:Announcement_20_December_2.pdf&diff=23859File:Announcement 20 December 2.pdf2007-12-05T10:23:45Z<p>Bkoelewijn: Announcement OWASP Netherlands chapter meeting - full description of the presentations.</p>
<hr />
<div>Announcement OWASP Netherlands chapter meeting - full description of the presentations.</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=23857Netherlands2007-12-05T10:01:29Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
This is an overview of the 2007 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
13 September<br />
------------<br />
Time : 18.00 - 21.30<br />
Main Topic : OWASP Netherlands chapter: putting initiatives into practice<br />
Presentations: Security Best Practices for .NET, Boaz Shunami<br />
Group discussion<br />
Location : Rivium Boulevard 102, 2909LK Capelle aan den IJssel <br />
Sponsor : Comsec Consulting BV<br />
<br />
<br />
20 December<br />
-----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Creating secure (web-)applications; for developers and security professionals.<br />
Presentations: Practices of developing optimal security, André Post<br />
Problems of developing secure and correct applications, Erik Poll<br />
Protecting Web services and Web applications against security threats, Dr. Rix Groenboom<br />
Location : Dorpsstraat 26, 3941JM Doorn<br />
Sponsor : ps_testware bv<br />
</pre><br />
<br />
== Announcement 20 december: Secure Development ==<br />
'''Summary'''<br/><br />
The main goal of the upcoming OWASP-NL meeting is to provide information to developers and security professionals involved in creating secure (web-)applications. The general and specific security issues involved on project and programming level will be covered from a practical as well as a theoretical point of view. The speakers will give specific examples and of course there is time to ask questions about your own experiences.<br/><br />
Please register before December the 14th because of the necessary catering arrangements.<br/><br />
<br/><br />
'''Location'''<br/><br />
The location and catering is provided by the sponsor of this meeting:<br/><br />
<table><br />
<tr><br />
<td width="350"><br />
ps_testware B.V.<br/><br />
Dorpsstraat 26,<br/><br />
3941 JM DOORN<br/><br />
</td><br />
<td width="350"><br />
[[Image:Pstestware.jpg|100px]]<br />
</td><br />
</tr><br />
<tr><br />
<td width="350"><br />
The location has parking facilities for 15 cars. However parking in the direct vicinity of ps_testware shouldn’t be a problem.<br/><br />
</td><br />
<td width="350"><br />
ps_testware delivers services related to software testing and software quality. In the field of software development, quality, time-to-market, business processes and software acceptance they play the role of "your devil's advocate" as an independent, flexible and specialized partner.<br/><br />
For more information please visit: www.pstestware.com.<br/><br />
</td><br />
</tr><br />
</table><br />
<br/><br />
<br/><br />
'''Program'''<br/><br />
17.30 - 18.30 '''Check-In''' (catering included)<br/><br />
<br/><br />
18.30 – 19:00 '''Introduction''' (OWASP organization, projects, sponsor)<br/><br />
<br/><br />
19.00 - 19.30 '''Practices of developing optimal security''' (dutch), Andre Post<br/><br />
This presentation highlights a number of current practices that lead to sub-optimal security, and suggests ways of avoiding these problems, focusing on the technical side of development.<br/><br />
André Post works for Fox-IT on a variety of projects including core product development, software architecting, security code reviews, and software project management.<br/><br />
<br/><br />
19.30 – 19:45 '''Break'''<br/><br />
<br/><br />
19:45 – 20:30 '''Problems of developing secure and correct applications''' (dutch), Erik Poll<br/><br />
This presentation will discuss different possibilities to improve software security. The problem of getting time and money available to be spend on security, not only for developing applications, but also for developing programming languages, will be raised.<br/><br />
Erik Poll is head of the Security of Systems (SoS) group at the Radboud University of Nijmegen. His research does focus on the security and correctness of software.<br/><br />
<br/><br />
20.30 - 21.00 '''Protecting Web services and Web applications against security threats''' (dutch), Rix Groenboom<br/><br />
During this session, Rix will explore how to implement development and security best practices in the code to make sure that your webservices and applications perform solidly when they are being hacked or used in malicious ways.<br/><br />
Rix Groenboom supports fortune 2000 companies in field automated software error prevention and correction for Parasoft. His main area of expertise is in the use of formal languages for the specification, design and validation of software applications.<br/><br />
<br/><br />
21.00 – 21:30 '''Discussion, questions and social'''<br/><br />
<br/><br />
'''Registration'''<br/><br />
If you want to attend, please send an email to: owasp@irc2.com.<br/><br />
Please register before December 14th, because of the necessary catering arrangements. The number of registries is limited to 50 due to the capacity of the location and will be handled in order of receipt.<br/><br />
<br/><br />
All OWASP chapter meetings are free of charge and you don’t have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br/><br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:Pstestware.gif&diff=23856File:Pstestware.gif2007-12-05T09:51:22Z<p>Bkoelewijn: ps_testware logo (OWASP Netherlands meeting sponsor)</p>
<hr />
<div>ps_testware logo (OWASP Netherlands meeting sponsor)</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=23821Netherlands2007-12-03T15:49:30Z<p>Bkoelewijn: /* Meeting schedule 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
This is an overview of the 2007 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
13 September<br />
------------<br />
Time : 18.00 - 21.30<br />
Main Topic : OWASP Netherlands chapter: putting initiatives into practice<br />
Presentations: Security Best Practices for .NET, Boaz Shunami<br />
Group discussion<br />
Location : Rivium Boulevard 102, 2909LK Capelle aan den IJssel <br />
Sponsor : Comsec Consulting BV<br />
<br />
<br />
20 December<br />
-----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Creating secure (web-)applications; for developers and security professionals.<br />
Presentations: Practices of developing optimal security, André Post<br />
Problems of developing secure and correct applications, Erik Poll<br />
Protecting Web services and Web applications against security threats, Dr. Rix Groenboom<br />
Location : Dorpsstraat 26, 3941JM Doorn<br />
Sponsor : ps_testware bv<br />
</pre><br />
<br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=23730Netherlands2007-11-29T11:43:43Z<p>Bkoelewijn: /* Meeting schedule 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
This is an overview of the 2007 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
13 September<br />
------------<br />
Time : 18.00 - 21.30<br />
Main Topic : OWASP Netherlands chapter: putting initiatives into practice<br />
Presentations: Security Best Practices for .NET, Boaz Shunami<br />
Group discussion<br />
Location : Rivium Boulevard 102, 2909LK Capelle aan den IJssel <br />
Sponsor : Comsec Consulting BV<br />
<br />
<br />
20 December<br />
-----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Creating secure (web-)applications; for developers and security professionals.<br />
Presentations: Common pitfalls and development good practices, André Post<br />
Software security, Erik Poll<br />
Protecting Web services and Web applications against security threats, Dr. Rix Groenboom<br />
Location : Dorpsstraat 26, 3941JM Doorn<br />
Sponsor : ps_testware bv<br />
</pre><br />
<br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=OWASP_Community&diff=21009OWASP Community2007-08-23T09:39:22Z<p>Bkoelewijn: /* Events */</p>
<hr />
<div>This page is for people to post OWASP related events, such as chapter meetings, OWASP conferences, get-togethers, and OWASP sponsored events.<br />
<br />
Events from previous years are archived here:<br />
* '''[[OWASP Community 2006]]'''<br />
<br />
This page is monitored, and items posted here will be copied to the OWASP [[Main Page]]. Please post new items in chronological order using the following format:<br />
<br />
'''Mon ## (##:00h) - [[Article]]'''<br />
<br />
<!--<br />
<br />
CHAPTER LEADS -- please put your schedule here and we'll post a month in advance<br />
<br />
*** Belgium ***<br />
'''Nov 20 (18:00h) - [[Belgium|Belgium Chapter Meeting]] '''<br />
<br />
*** OTTAWA: Rough dates ***<br />
'''Sept 12 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
'''Nov 14 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
<br />
*** BOSTON: Every first Wednesday of the month ***<br />
<br />
*** MELBOURNE: First Tuesday of the month ***<br />
'''Jul 3 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
*** NETHERLANDS: Second Thursday of the month sometimes ***<br />
'''Sept 13 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
'''Dec 13 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
*** ROCHESTER: Every third Monday of the month ***<br />
<br />
*** TORONTO: Every second Wednesday of the month<br />
<br />
*** VIRGINIA: Every second thursday of the month ***<br />
<br />
--><br />
<br />
==Events==<br />
'''Sept 27 (1800h) - [[New York|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Sept 27 (13:00h) - [[Taiwan|Taiwan chapter meeting]]'''<br />
<br />
'''Sept 13 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Sept 7 (15:00h) [[Germany|German chapter meeting]]''' - Restart of the German Chapter<br />
<br />
'''Sept (12:00h) - [[Belgium|Belgium OWASP Day Event]] '''<br />
<br />
'''Sept 5 (18:00h) - [[Chicago|Chicago Chapter Meeting]]'''<br />
<br />
'''Sept 5 (17:00h) - [[Israel|Israeli chapter meeting]]'''<br />
<br />
'''July 25 (18:00h) - [[San Jose|San Jose Chapter Meeting]]'''<br />
<br />
'''July 24 (17:00h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''July 14 (11:00h) - [[Turkey|Turkey chapter meeting - 1st Web Security Days]]'''<br />
<br />
'''July 6 (17:00h) - [[Spain|Spain chapter meeting]]'''<br />
<br />
'''June 26 (11:30hr) - [[Austin|Austin chapter meeting]]''' - Running Web Application Scans<br />
<br />
'''June 22 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''June 21 (19:00h) - [[Denver]]''' - Anti-DNS Pinning Attacks / Calculating Return on Security Investment (ROSI)<br />
<br />
'''June 19 (18:00h) - [[Minneapolis St Paul|Minneapolis St Paul chapter meeting]]'''<br />
<br />
'''June 15 (17:00hr) - [[Spain|Spain chapter meeting]]'''<br />
<br />
'''June 13 (18:30hr) - [[Kansas City|Kansas City chapter meeting]]'''<br />
<br />
'''June 12 (18:00hr) - [[New York|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Jun 5 (19:00h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Jun 5 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Jun 5 (17:30h) - [[Houston | Houston Chapter Meeting]]'''<br />
<br />
'''May 29 (9:00h) - [[http://www.owasp.org/index.php/Italy#May_29th.2C_2007_-_Seminar:_.22Software_Security.22 Italy@Firenze Tecnologia]]'''<br />
<br />
'''May 29 (11:30h) - [[Austin | Austin Chapter Meeting]]''' - Bullet Proof UI - A programmer's guide to the complete idiot". <br />
<br />
'''May 29 (18:00h) - [[Ottawa | Ottawa Chapter Meeting]]'''<br />
<br />
'''May 22 (18:30h) - [[New Zealand|1st New Zealand chapter Meeting]]'''<br />
<br />
'''May 21 (14:00h) - [[Israel|2nd OWASP Israel mini conference]]'''<br />
<br />
'''May 15 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''May 10 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''May 9 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''May 8 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''May 6 (11:00h) - [[Turkey|Turkey chapter meeting]]'''<br />
<br />
'''May 2 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''May 1 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Apr 26 (11:00h) - [[San Antonio|San Antonio chapter meeting]]'''<br />
<br />
'''Apr 26 (17:00h) - [[Switzerland|Switzerland chapter meeting and "Swiss Security Dinner"]]'''<br />
<br />
'''Apr 24 (18:00h) - [[Minneapolis St Paul|Minneapolis St Paul chapter meeting]]'''<br />
<br />
'''Apr 20 (19:00h) - [[Hong Kong|Hong Kong chapter meeting - Objectives for 2007]]'''<br />
<br />
'''Apr 19 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Apr 18 (17:00h) - [[San Francisco City Chapter Meeting]]'''<br />
<br />
'''Apr 17 (18:00h) - [[New Jersey|NY/NJ Metro chapter meeting]]'''<br />
<br />
'''Apr 17 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Apr 12 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Apr 12 (18:00h) - [[San Jose|San Jose chapter meeting]]'''<br />
<br />
'''Apr 11 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Apr 4 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Apr 3 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Mar 30 - [[http://www.owasp.org/index.php/Italy#March_30th.2C_2007_-_Master_in_Security_-_University_of_Rome_.22La_Sapienza.22| Italy@Master in Security at "La Sapienza"]]'''<br />
<br />
'''Mar 28 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''<br />
<br />
'''Mar 28 (11:30h) - [[San Antonio|San Antonio chapter meeting]]'''<br />
<br />
; '''Mar 27-30 - [http://www.blackhat.com Black Hat Euro]'''<br />
: OWASP members receive a Euro 100 Briefings discount by inserting BH7EUASSOC in the box marked “Coupon Codes”<br />
<br />
'''Mar 22 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Mar 21-22 - [[Belgium#OWASP_Top_10_2007_Update_.28Infosecurity_Belgium.2C_21_.26_.2622_Mar_2007.29|Belgium@InfoSecurity]]'''<br />
<br />
'''Mar 20 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Mar 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Mar 14 (18:00h) - [[Chicago|Chicago chapter meeting]]'''<br />
<br />
'''Mar 13 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Mar 8 (18:00h) - [[Ottawa|Ottawa Chapter Meeting]] '''<br />
<br />
'''Mar 7 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Mar 7 (18:30h) - [[Kansas City|Kansas City chapter meeting]]'''<br />
<br />
'''Mar 6 (18:30h) - [[Philadelphia|Philadelphia chapter meeting]]'''<br />
<br />
'''Mar 6 (18:30h) - [[San Francisco|San Francisco and San Jose chapter meeting]]'''<br />
<br />
'''Mar 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Mar 5 (11:00h) - [[New Jersey|New Jersey chapter meeting]]'''<br />
<br />
'''Mar 1 (11:30h) - [http://www.eusecwest.com/agenda.html EUSecWest 07: Testing Guide]'''<br />
<br />
; '''Feb 26-Mar 1 - [http://www.blackhat.com Black Hat DC]'''<br />
: OWASP members receive a $100 Briefings discount by inserting BH7DCASSOC in the box marked “Coupon Codes”<br />
<br />
'''Feb 28 (18:00h) - [[Seattle|Seattle chapter meeting]]'''<br />
<br />
'''Feb 27 (18:00h) - [[Edmonton|Edmonton chapter meeting]]'''<br />
<br />
'''Feb 22 (18:30h) - [[Helsinki|Helsinki chapter meeting]]'''<br />
<br />
'''Feb 22 (18:00h) - [[London|London chapter meeting]]'''<br />
<br />
'''Feb 21 (18:30h) - [[Denver|Denver chapter meeting]]'''<br />
<br />
'''Feb 19 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Feb 15 (18:00h) - [[Washington DC|Washington DC (MD) chapter meeting]]'''<br />
<br />
'''Feb 15 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Feb 14 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Feb 13 (18:00h) - [[Ireland|Ireland chapter meeting]]'''<br />
<br />
'''Feb 12 (18:30h) - [[Switzerland|Switzerland chapter meeting]]'''<br />
<br />
'''Feb 7 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''Feb 6-7 - [[Italy#February_6th-8th.2C_2007_-_InfoSecurity|Italy@InfoSecurity]]'''<br />
<br />
'''Feb 6 (18:00h) - [[Melbourne|Melbourne chapter meeting]]'''<br />
<br />
'''Feb 2 (14:00h) - [[Chennai|Chennai chapter meeting]]'''<br />
<br />
'''Jan 31 (15:00h) - [[Mumbai|Mumbai chapter meeting]]'''<br />
<br />
'''Jan 30 (11:30h) - [[Austin|Austin chapter meeting]]'''<br />
<br />
'''Jan 25 (18:00h) - [[San Francisco| San Francisco chapter meeting]]'''<br />
<br />
'''Jan 25 (14:30h) - [[Italy#October_25th.2C_2007_-_Isaca_Rome|Italy@ISACA Rome]]'''<br />
<br />
'''Jan 24 (17:30h) - [[Israel#6th_OWASP_IL_meeting:_Wednesday.2C_January_24th_2007|6th OWASP Israel chapter meeting]]'''<br />
<br />
'''Jan 23 (18:00h) - [[Belgium|Belgium chapter meeting]]'''<br />
<br />
'''Jan 22 (18:00h) - [[Rochester|Rochester chapter meeting]]'''<br />
<br />
'''Jan 17 (18:30h) - [[Denver|Denver chapter meeting]]'''<br />
<br />
'''Jan 16 (17:45h) - [[Edmonton|Edmonton chapter meeting]]'''<br />
<br />
'''Jan 11 (18:00h) - [[Netherlands|Netherlands chapter meeting]]'''<br />
<br />
'''Jan 11 (18:30h) - [[Phoenix|Phoenix chapter meeting]]'''<br />
<br />
'''Jan 11 (18:00h) - [[Virginia (Northern Virginia)|Washington DC (N. VA) chapter meeting]]'''<br />
<br />
'''Jan 10 (18:00h) - [[Toronto|Toronto chapter meeting]]'''<br />
<br />
'''Jan 8 (18:00h) - [[Seattle|Seattle chapter meeting]]'''<br />
<br />
'''Jan 3 (18:30h) - [[Boston|Boston chapter meeting]]'''<br />
<br />
'''May 1 - [[Melbourne | Melbourne chapter meeting]]'''<br />
<br />
'''May 2 - [[Boston]]'''<br />
<br />
'''May 6 - [[Turkey]]'''<br />
<br />
'''May 8 - [[Virginia (Northern Virginia)|Washington DC (VA)]]'''<br />
<br />
'''May 9 - [[Toronto]]'''<br />
<br />
'''May 10 - [[Belgium]]'''<br />
<br />
'''May 15 - [[Rochester]]'''<br />
<br />
'''May 21 - [[Israel]]'''<br />
<br />
'''May 22 - [[New Zealand]]'''<br />
<br />
'''May 29 - [[Italy]]'''<br />
<br />
'''June 5 - [[Houston]]'''<br />
<br />
'''June 5 - [[Melbourne]]'''<br />
<br />
'''June 5 - [[Helsinki]]'''<br />
<br />
'''June 12 - [[New Jersey]]'''<br />
<br />
'''June 15 - [[Spain]]'''<br />
<br />
'''July 14 - [[Turkey]]'''</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=21008Netherlands2007-08-23T09:23:43Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
This is an overview of the 2007 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
13 September<br />
------------<br />
Time : 18.00 - 21.30<br />
Main Topic : OWASP Netherlands chapter: putting initiatives into practice<br />
Presentations: Security Best Practices for .NET, Boaz Shunami<br />
Group discussion<br />
Location : Rivium Boulevard 102, 2909LK Capelle aan den IJssel <br />
Sponsor : Comsec Consulting BV<br />
<br />
<br />
13 December<br />
-----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Webapplication penetration testing<br />
Presentations: John Troch of ITamon BV offered a demo/presentation, details will follow.<br />
Location : Dorpsstraat 26, 3941JM Doorn<br />
Sponsor : ps_testware bv<br />
</pre><br />
<br />
== Announcement 13 September: putting initiatives into practice ==<br />
<br />
The main goal of the next OWASP meeting is finding a way to put initiatives and all offered help into a form of structural benefit for the OWASP Netherlands local chapter. As a starting point for the discussion, examples will be taken from other European chapters and input delivered by discussions that take place on the mailing list is considered too. Let this be a call to put your ideas on the mailing list before the next meeting!<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Comsec Consulting BV<br/><br />
Rivium Boulevard 102<br/><br />
2909LK Capelle aan den IJssel<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 OWASP update, Bert Koelewijn<br/><br />
18.45 - 19.15 Security Best Practices for .NET, Boaz Shunami<br/><br />
19.15 - 20.00 Discussion: collecting ideas and initiatives<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 21.00 Discussion: how to enable community commitment<br/><br />
21.00 - 21.30 Closing discussion and coffee<br/><br />
<br/><br />
Boaz Shunami<br/><br />
Boaz is manager of the Application Security department of Comsec Europe. He has 11 years of experience in the IT Security field, and a large part of them in Application Security.<br/><br />
Boaz did numerous application security audits in very large organizations and is recognized as one of the greatest expert’s world wide. Boaz' expertise is broad, but especially in-depth for the .NET platform.<br/><br />
<br/><br />
Discussion input (until now)<br/><br />
- division of local chapter work load by multiple people<br/><br />
- collaboration with other organizations<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:Implementation_of_Security_by_Design.ppt&diff=20499File:Implementation of Security by Design.ppt2007-07-30T19:53:09Z<p>Bkoelewijn: </p>
<hr />
<div></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=20498Netherlands2007-07-30T19:48:03Z<p>Bkoelewijn: /* Meeting schedule 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
This is an overview of the 2007 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
13 September<br />
------------<br />
Time : 18.00 - 21.30<br />
Main Topic : OWASP Netherlands chapter: putting initiatives into practice<br />
Presentations:<br />
Location : Rivium Boulevard 102, 2909LK Capelle aan den IJssel <br />
Sponsor : Comsec Consulting BV<br />
<br />
<br />
13 December<br />
-----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Webapplication penetration testing<br />
Presentations: John Troch of ITamon BV offered a demo/presentation, details will follow.<br />
Location : Dorpsstraat 26, 3941JM Doorn<br />
Sponsor : ps_testware bv<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=16854Netherlands2007-03-03T12:43:06Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
To start the year 2007 with a revived OWASP Netherlands local chapter, I'd like to propose a meeting schedule for 2007. The first meeting is already planned on 11 January and an official meeting announcement will follow.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
12 April<br />
--------<br />
Time : <br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 September<br />
------------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 December<br />
-----------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
January 11th, the Dutch OWASP chapter came together at the office of Sogeti Netherlands. Subject of the evening was 'putting software security into practice'. The group was small but select.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
After being welcomed by Frank Langeveld from Sogeti and Bert Koelewijn, Dutch chapter leader, the evening started with the presentation 'Security By Design'. During the presentation Martin Knobloch told about his experiences during the implementation of the Secure Development Life Cycle in a company like Sogeti Nederland B.V.<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:Implementation_of_Security_by_Design.ppt]]<br/><br />
<br/><br />
After a small break, the panel discussion started with the following panel: Henk van der Heijden - Comsec Consulting, Dr.ir. Mario de Boer - LogicaCMG and Martin Knobloch - Sogeti Nederland.<br/><br />
During the discussion, it became clear people are struggling to get the Secure Development Life Cycle implemented in their company. The various experiences were shared with the panel and the others. Company typical problems and common misunderstandings about Software security where brought up.<br/><br />
The consensus of the discussion was that the main problem lies in the lack of security awareness and knowledge of the managers and the developers. And this of course is exactly where OWASP comes in…<br/><br />
<br/><br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=15121Netherlands2007-01-09T08:55:51Z<p>Bkoelewijn: /* Announcement 11 January meeting */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br />
<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
The panel members are:<br/><br />
Henk van der Heijden, Managing Director - Comsec Consulting B.V.<br/><br />
Dr.ir. Mario de Boer, Security Consultant - LogicaCMG<br/><br />
Martin Knobloch, Senior Technologie Specialist - Sogeti Nederland B.V.<br/><br />
<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting schedule 2007 ==<br />
To start the year 2007 with a revived OWASP Netherlands local chapter, I'd like to propose a meeting schedule for 2007. The first meeting is already planned on 11 January and an official meeting announcement will follow.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
12 April<br />
--------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 September<br />
------------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 December<br />
-----------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=15115Netherlands2007-01-09T08:51:38Z<p>Bkoelewijn: /* Meeting schedule 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting schedule 2007 ==<br />
To start the year 2007 with a revived OWASP Netherlands local chapter, I'd like to propose a meeting schedule for 2007. The first meeting is already planned on 11 January and an official meeting announcement will follow.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations: Implementation of Security by Design, Martin Knobloch<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
12 April<br />
--------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 September<br />
------------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 December<br />
-----------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=14631Netherlands2006-12-27T07:19:45Z<p>Bkoelewijn: /* Announcement 11 January meeting */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br/><br />
This will be the main focus of the discussion that we will have with a panel of people that experienced implementing software security in the field.<br/><br />
<br/><br />
The location is provided by the sponsor of this meeting:<br/><br />
Sogeti Nederland B.V.<br/><br />
"La Charmille" building<br/><br />
Lange Dreef 17<br/><br />
4131 NJ Vianen<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (catering included)<br/><br />
18.30 - 18.45 Sponsor opening<br/><br />
18.45 - 19.00 OWASP update, Bert Koelewijn<br/><br />
19.00 - 19.30 Implementation of Security by Design, Martin Knobloch<br/><br />
19.30 - 19.45 Panel introduction<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.30 Panel discussion<br/><br />
<br/><br />
Implementation of Security by Design<br/><br />
What is needed to implement a 'Secure Development Life Cycle' within Sogeti Nederland? The speaker started a project called 'Security by Design' in march 2006 implementing a SDLC at Sogeti Nederland.<br/><br />
In his presentation, the speaker will share his technical and organizational experiences that he gained with the still ongoing implementation.<br/><br />
<br/><br />
About the speaker<br/><br />
Martin Knobloch has more than 8 years experience in design and development of J2EE applications for customers in various sectors of the market. In September 2003 Martin Knobloch started working for Sogeti Nederland, where he does the design, development and review of J2EE applications and architectures.<br/><br />
From this background, Martin Knobloch experienced the threats of insecure software firsthand. In march 2006, Martin Knobloch started implementing a SDLC within Sogeti Nederland.<br/><br />
<br/><br />
Panel discussion<br/><br />
In the discussion, we will try to find answers to questions like:<br/><br />
- What are the most common security practices in software development?<br/><br />
- How effective are those practices?<br/><br />
- Where do we start practicing security?<br/><br />
- What should be the most common security practices in software development?<br/><br />
- How much does security cost?<br/><br />
- How does the Systems Security Engineering Capability Maturity Model (SSE-CMM) fit in?<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.com.<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== Meeting schedule 2007 ==<br />
To start the year 2007 with a revived OWASP Netherlands local chapter, I'd like to propose a meeting schedule for 2007. The first meeting is already planned on 11 January and an official meeting announcement will follow.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations:<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
12 April<br />
--------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 September<br />
------------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 December<br />
-----------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=14247Netherlands2006-12-12T13:32:03Z<p>Bkoelewijn: /* Pre-Announcement 11 January meeting */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Pre-Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br />
<br />
This meeting will have at most one or two presentations. After the presentations, a panel will start a discussion and answer your questions. We are searching for people that are willing to share with us how they have managed to put security into practice in their SDLC. They are welcome to join the panel.<br />
<br />
Current presentations:<br/><br />
- Implementation of Security by Design, Martin Knobloch<br />
<br />
Current panel members:<br/><br />
- Martin Knobloch, Sogeti Nederland B.V.<br />
<br />
Suggested discussion topics are:<br/><br />
- SSE-CMM (ISO/IEC 21827)<br/><br />
- Commonly known security best practices: risk analysis, code review, pen-testing, coding, etc.<br/><br />
<br />
More or better suggestions are welcome.<br />
<br />
If you have experience with implementing SSE-CMM or other security best practices and you are willing to share it with us, please volunteer for the panel!<br />
<br />
== Meeting schedule 2007 ==<br />
To start the year 2007 with a revived OWASP Netherlands local chapter, I'd like to propose a meeting schedule for 2007. The first meeting is already planned on 11 January and an official meeting announcement will follow.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations:<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
12 April<br />
--------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 September<br />
------------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 December<br />
-----------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=14236Netherlands2006-12-12T09:40:26Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Pre-Announcement 11 January meeting ==<br />
<br />
The OWASP meeting of 11 January is about putting software security into practice. A lot of books, standards, organizations and consultants tell us how we should develop secure software. But which methods and measures are commonly adopted and which are not and why?<br />
<br />
This meeting will have at most one or two presentations. After the presentations, a panel will start a discussion and answer your questions. We are searching for people that are willing to share with us how they have managed to put security into practice in their SDLC. They are welcome to join the panel.<br />
<br />
Current presentations:<br/><br />
- Implementation of Security by Design, Martin Knobloch<br />
<br />
Current panel members:<br/><br />
- Martin Knobloch, Sogiety<br />
<br />
Suggested discussion topics are:<br/><br />
- SSE-CMM (ISO/IEC 21827)<br/><br />
- Commonly known security best practices: risk analysis, code review, pen-testing, coding, etc.<br/><br />
<br />
More or better suggestions are welcome.<br />
<br />
If you have experience with implementing SSE-CMM or other security best practices and you are willing to share it with us, please volunteer for the panel!<br />
<br />
== Meeting schedule 2007 ==<br />
To start the year 2007 with a revived OWASP Netherlands local chapter, I'd like to propose a meeting schedule for 2007. The first meeting is already planned on 11 January and an official meeting announcement will follow.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations:<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
12 April<br />
--------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 September<br />
------------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 December<br />
-----------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=14220Netherlands2006-12-12T08:35:25Z<p>Bkoelewijn: /* Meeting schedule 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
To start the year 2007 with a revived OWASP Netherlands local chapter, I'd like to propose a meeting schedule for 2007. The first meeting is already planned on 11 January and an official meeting announcement will follow.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations:<br />
Location : "La Charmille" building, Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
12 April<br />
--------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 September<br />
------------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 December<br />
-----------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=13683Netherlands2006-11-25T14:34:21Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
== Meeting schedule 2007 ==<br />
To start the year 2007 with a revived OWASP Netherlands local chapter, I'd like to propose a meeting schedule for 2007. The first meeting is already planned on 11 January and an official meeting announcement will follow.<br />
<pre><br />
11 January<br />
----------<br />
Time : 18.00 - 21.30<br />
Main Topic : Security in practice: how it's done!<br />
Presentations:<br />
Location : Lange Dreef 17, 4131 NJ Vianen<br />
Sponsor : Sogeti Nederland B.V.<br />
<br />
<br />
12 April<br />
--------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 September<br />
------------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
<br />
<br />
13 December<br />
-----------<br />
Time :<br />
Main Topic :<br />
Presentations:<br />
Location :<br />
Sponsor :<br />
</pre><br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=13680Netherlands2006-11-25T13:36:31Z<p>Bkoelewijn: /* OWASP Netherlands meeting minutes */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
<br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
[[Media:OWASP_NL_Fortify_Software.pdf]]<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=13679Netherlands2006-11-25T13:35:22Z<p>Bkoelewijn: /* OWASP Netherlands kick-off meeting minutes */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
<br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
http://www.owasp.org/docroot/owasp/misc/FortifySoftwareOWASPChapterPresent_NL.pdf<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf]]<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=13678Netherlands2006-11-25T13:33:25Z<p>Bkoelewijn: /* OWASP Netherlands kick-off meeting minutes */</p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|extra=The chapter leader is [mailto:owasp@irc2.nl Bert Koelewijn]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}}<br />
<br />
<br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
http://www.owasp.org/docroot/owasp/misc/FortifySoftwareOWASPChapterPresent_NL.pdf<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
[[Media:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf]]<br />
http://www.owasp.org/docroot/owasp/misc/veilige_web_app_boven_alles.ppt<br/><br />
http://www.owasp.org/docroot/owasp/misc/Introduction_to_OWASP_NL.ppt<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:OWASP_NL_Fortify_Software.pdf&diff=13677File:OWASP NL Fortify Software.pdf2006-11-25T13:28:31Z<p>Bkoelewijn: Presentation at the second OWASP NL meeting.</p>
<hr />
<div>Presentation at the second OWASP NL meeting.</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:OWASP_NL_Top_Ten_Web_Application_Vulnerabilities_in_J2EE.pdf&diff=13676File:OWASP NL Top Ten Web Application Vulnerabilities in J2EE.pdf2006-11-25T13:27:07Z<p>Bkoelewijn: Presentation at the first OWASP NL meeting.</p>
<hr />
<div>Presentation at the first OWASP NL meeting.</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=File:OWASP_NL_Veilige_Web_App_Boven_Alles.pdf&diff=13675File:OWASP NL Veilige Web App Boven Alles.pdf2006-11-25T13:23:50Z<p>Bkoelewijn: Presentation at the first OWASP NL meeting.</p>
<hr />
<div>Presentation at the first OWASP NL meeting.</div>Bkoelewijnhttps://wiki.owasp.org/index.php?title=Netherlands&diff=3671Netherlands2006-05-25T11:50:33Z<p>Bkoelewijn: </p>
<hr />
<div>{{Chapter Template|chaptername=Netherlands|leaderemail=owasp@irc2.nl|leadername=Bert Koelewijn|mailinglistsite=http://lists.sourceforge.net/lists/listinfo/owasp-netherlands/}}<br />
<br />
<br />
<br />
== OWASP Netherlands meeting minutes ==<br />
<br />
On 9 march, the second meeting of OWASP Netherlands local chapter took place. GetronicsPinkRoccade provided the venue, in their luxury conference centre: Connection I.<br/><br />
<br/><br />
Agenda:<br/><br />
18.00 - 18.45 Check-In (bread & drinks)<br/><br />
18.45 - 19.00 Opening<br/><br />
19.00 - 20.00 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
20.00 - 20.15 Coffee break<br/><br />
20.15 - 22.00 Form focus groups<br/><br />
<br/><br />
The presentation of Migchiel de Jong was found very interesting by the audience. At the end of his presentation, he demonstrated a static code analysis of the OWASP webgoat application.<br/><br />
<br/><br />
After the coffee break, the attendances started discussing about the largest common topics of interest in the web application security field, in relation to the OWASP Netherlands chapter. As a result, the following focus groups are formed:<br/><br />
<br/><br />
Testing<br/><br />
The current OWASP Testing project and the Open Source Security Testing Methodology Manual of ISECOM, provide guidelines and best practices for testers. These guidelines can be used to formalize a standard structure and a set of minimum requirements for a security test. Clients could ask a tester to adhere to these guidelines.<br/><br />
A second idea is to standardize the testing results management report. In practice, testing could result in piles of paper with all the findings. The real value is reporting it in a usable way. For example: mapping technical findings to business risks.<br/><br />
<br/><br />
Frans v. Buul<br/><br />
Peter Gouwentak<br/><br />
Arthur Donkers<br/><br />
Eelco Klaver<br/><br />
Migchiel de Jong<br/><br />
Mario de Boer<br/><br />
<br/><br />
First focus group meeting: Monday 27 march, 18:00h, PwC Utrecht<br/><br />
<br/><br />
<br/><br />
Public Relations<br/><br />
This focus group will try to make business aware of the security impact that developing, hosting and using web applications has. What OWASP is and how OWASP can help. This can be done by giving presentations, writing papers and articles, word of mouth, etc. etc.<br/><br />
<br/><br />
Remco Bakker<br/><br />
Ronald Eygendaal<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
Eelco Klaver<br/><br />
<br/><br />
First presentation of OWASP materials: Edwin van Vliet, TestNet - Voorjaarsevenement, 5 april<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
<br/><br />
Education<br/><br />
OWASP and universities/schools could benefit from working together. For example:<br/><br />
- OWASP provides lot's of materials usable in colleges.<br/><br />
- Develop OWASP training course.<br/><br />
- Students can participate in OWASP projects<br/><br />
- OWASP can provide a platform for supporting research. Such as thesis projects, etc.<br/><br />
- OWASP representatives could provide guest colleges.<br/><br />
<br/><br />
Ronald Eygendaal<br/><br />
Erik Poll<br/><br />
Bas van Vossen<br/><br />
Edwin van Vliet<br/><br />
<br/><br />
First focus group meeting: To be planned!<br/><br />
<br/><br />
The presentation is available here:<br/><br />
http://www.owasp.org/docroot/owasp/misc/FortifySoftwareOWASPChapterPresent_NL.pdf<br/><br />
<br />
== 9 March: Second meeting of the OWASP Netherlands local chapter! ==<br />
<br />
In this second meeting focus groups are to be formed, to discuss common problems, develop and research common solutions in a vendor neutral environment. So this is a very good opportunity to get in contact with others, to exchange knowledge and experiences on specific topics.<br/><br />
<br/><br />
For every focus group the following questions has to be answered:<br/><br />
1. Which specific topic is to be addressed?<br/><br />
2. What are the deliverables?<br/><br />
3. What is the relation to OWASP? (Current projects, materials, expertise and knowledge interchange, etc.)<br/><br />
4. Who is the central contact of the subgroup?<br/><br />
<br/><br />
It would be nice to have a bigger and more diverse group, compared to the first meeting. So let's recall: "Please, bring at least one friend, next time." And don't hesitate to send this announcement to everybody who may be interested!<br/><br />
<br/><br />
We thank Getronics PinkRoccade for offering us a venue:<br/><br />
Getronics PinkRoccade<br/><br />
Fauststraat 1<br/><br />
7323 BA Apeldoorn <br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In<br/><br />
18.30 - 18.45 Opening<br/><br />
18.45 - 19.30 Improving Security in the Application Development Life-cycle, Migchiel de Jong<br/><br />
19.30 - 20.00 Collecting focus group initiatives<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Form focus groups<br/><br />
<br/><br />
Presentation Abstract<br/><br />
Rather than spending large amounts of time and money on proving that we have security vulnerabilities after programs go into production, companies should go to the source and correct vulnerabilities as early as possible in the development stage. It is unquestionably faster, simpler, and cheaper for developers to correct vulnerabilities as they build programs.<br/><br />
But how can development management ensure that developers focus on security when there is no time or budget for security at the development stage? Even with the correct focus, how can they learn what to look for? How can they stay ahead of the dedicated and resourceful hacker?<br/><br />
The answer is effective processes and better tools. With advanced software security tools, a developer can pinpoint vulnerabilities in a matter of seconds — the same vulnerabilities that would take a hacker or manual code reviewer weeks or even months to find. These same tools can give development and information security managers useful metrics on application vulnerabilities before they are released into deployment.<br/><br />
This talk will walk through the Application Development Life-Cycle and discuss how tools can help come to grips with software security issues in a particular phase.<br/><br />
<br/><br />
About the presenter<br/><br />
Migchiel de Jong has developed hardware and software for 10 years before joining Rational Software. During the 5 years at Rational Software (later acquired by IBM) he was involved in many software development process improvement projects. Currently Migchiel de Jong is working at Fortify Software, Palo Alto, California, as a software security engineer.<br/><br />
<br/><br />
If you want to attend send an email to owasp@irc2.nl. Please don't wait, 9 march is not that long anymore!<br/><br />
<br/><br />
All OWASP chapter meetings are free, there are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br />
== OWASP Netherlands kick-off meeting minutes ==<br />
<br />
On 17 November, OWASP Netherlands had it's first meeting. We moved to a bigger location, the Mercure hotel in Nieuwegein, to host all the 35 attendees.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
The discussion took place in a 'round table' session, where all attendees were able to take part. The focus of the discussion was how to give the OWASP Netherlands local chapter additional value, next to the OWASP project. What the goals and tasks will be. And which actions will have to be taken at short term.<br/><br />
Different people have interest in different subjects. In general meetings there is no time to address all subjects and address them specific enough. Therefore subgroups can be formed, focusing on specific topics. They can have their own communication channel and meetings, but should keep close contact with the OWASP body.<br/><br />
<br/><br />
An inventarisation:<br/><br />
<br/><br />
Discussion Topics<br/><br />
- Awareness: writing articles, press publications, interviews<br/><br />
- Education: contact universities, schools and their common boards. Develop and gather education materials.<br/><br />
- General: discuss ideas for OWASP NL<br/><br />
<br/><br />
Focusgroup Topics<br/><br />
- (dutch) metrics project<br/><br />
- (dutch) legal project<br/><br />
- standard framework for pentest reports<br/><br />
- safe outsourcing<br/><br />
<br/><br />
Actions that should be taken on short term are:<br/><br />
- provide communication channels<br/><br />
- plan next (sub)meetings<br/><br />
- start discussions and focusgroups<br/><br />
<br/><br />
The presentations are available here:<br/><br />
<br/><br />
http://www.owasp.org/docroot/owasp/misc/OWASP-TopTenWebApplicationVulnerabilities_in_J2EE.pdf<br/><br />
http://www.owasp.org/docroot/owasp/misc/veilige_web_app_boven_alles.ppt<br/><br />
http://www.owasp.org/docroot/owasp/misc/Introduction_to_OWASP_NL.ppt<br/><br />
<br />
== You are welcome to the OWASP Netherlands local chapter kick-off meeting! ==<br />
<br />
Thursday, November 17th (2005) at 18.00h.<br/><br />
<br/><br />
ATTENTION! Because of the large amount of attendees, the location has changed:<br/><br />
<br/><br />
Hotel Mercure Utrecht/Nieuwegein<br/><br />
Buizerdlaan 10<br/><br />
3435 SB NIEUWEGEIN<br/><br />
Tel: 00 31 (0) 30 60 84 122<br/><br />
Fax: 00 31 (0) 30 60 38 374<br/><br />
<br/><br />
This first meeting will be an introduction to the OWASP. A constructive discussion will be held about the actual form of the OWASP Netherlands local chapter.<br/><br />
<br/><br />
The agenda:<br/><br />
18.00 - 18.30 Check-In (bread & drinks)<br/><br />
18.30 - 18.45 Chapter opening<br/><br />
18.45 - 19.30 Presentation - 'Top tien web applicatie kwetsbaarheden in J2EE', Eelco Klaver<br/><br />
19.30 - 19.45 Presentation - 'Veilige webapplicaties boven alles', Mike Wardi<br/><br />
19.45 - 20.00 Coffee break<br/><br />
20.00 - 21.00 Discussion - About the OWASP Netherlands local chapter<br/><br />
<br/><br />
About the presenters<br/><br />
<br/><br />
Eelco Klaver<br/><br />
Eelco Klaver is a senior consultant for Xebia IT Architects, since 2003. Doing software reviews, security audits and giving security workshops are part of his job. He has almost 10 years experience with developing enterprise applications in J2EE for different employees. At the moment, Eelco is the front man of the security business unit for Xebia, focussing on the security aspects of enterprise applications build on J2EE.<br/><br />
<br/><br />
Mike Wardi<br/><br />
Mike Wardi is an internet application manager for a financial institute. He's responsible for the safety of internet applications provided to customers and the implementation of the security policies in software developement.<br/><br />
<br/><br />
<br/><br />
If you want to attend, please send an email to owasp-nl@ascure.com or the mailing list.<br/><br />
<br/><br />
All OWASP chapter meetings are free! There are never vendor pitches or sales presentations at OWASP meetings.<br/><br />
<br/><br />
NOTE TO CISSP’s: OWASP Meetings count towards CPE Credits.<br/><br />
<br/></div>Bkoelewijn