OWASP - User contributions [en]

Code Review and Static Analysis with tools

2009-09-15T01:10:23Z

Edalci: /* Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed) */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, September 17th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Erik Klein)
*Time: 2hours and half
*Location: AOL, 22260 Pacific blvd, Sterling, VA. 20166

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor.

===Session 3: Customization Lab for Fortify SCA, date: TBD ===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date to be confirmed)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-09-15T01:10:03Z

Edalci: /* Session 3: Customization Lab for Fortify SCA, September 27th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, September 17th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Erik Klein)
*Time: 2hours and half
*Location: AOL, 22260 Pacific blvd, Sterling, VA. 20166

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor.

===Session 3: Customization Lab for Fortify SCA, date: TBD ===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date to be confirmed)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-09-15T01:09:44Z

Edalci: /* Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, September 17th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Erik Klein)
*Time: 2hours and half
*Location: AOL, 22260 Pacific blvd, Sterling, VA. 20166

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor.

===Session 3: Customization Lab for Fortify SCA, September 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date to be confirmed)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-09-15T01:07:43Z

Edalci: /* Session 3: Customization Lab for Fortify SCA, August 27th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own.

===Session 3: Customization Lab for Fortify SCA, September 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date to be confirmed)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

File:Owasp SAtrack plan.png

2009-09-15T01:05:35Z

Edalci: uploaded a new version of "File:Owasp SAtrack plan.png"

File:Owasp SAtrack plan.png

2009-09-15T01:03:11Z

Edalci: uploaded a new version of "File:Owasp SAtrack plan.png"

Virginia

2009-09-15T00:57:46Z

Edalci: /* Next Meeting */

==== About ====
[[Image:Owasp-nova.JPG|275px|right]]The '''OWASP Washington VA Local Chapter''' meetings are FREE and OPEN to anyone interested in learning more about application security. We encourage individuals to provide knowledge transfer via hands-on training and presentations of specific OWASP projects and research topics and sharing SDLC knowledge.

We the encourage vendor-agnostic presentations to utilize the OWASP Powerpoint template when applicable and individual volunteerism to enable perpetual growth. As a 501(3)c non-profit association donations of meeting space or refreshments sponsorship is encouraged, simply contact the local chapter leaders listed on this page to discuss. Prior to participating with OWASP please review the Chapter Rules.

The original DC Chapter was founded in June 2004 by [mailto:jeff.williams@owasp.org Jeff Williams] and has had members from Virginia to Delaware. In April 2005 a new chapter, OWASP Washington VA Local Chapter, was formed and the DC Chapter was renamed to DC-Maryland. The two are sister chapters and include common members and shared discourse. The chapters meet in opposite halves of the month to facilitate this relationship.

{{Chapter Template|chaptername=Virginia|extra=The chapter leader is [mailto:John.Steven@owasp.org John Steven]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-CHANGEME|emailarchives=http://lists.owasp.org/pipermail/owasp-CHANGEME}}
* [http://lists.owasp.org/mailman/listinfo/owasp-wash_dc_va Click here to join local chapter mailing list]
* Add August 6th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=NjNhbjFsZ3FrdXRqYzVuNW11amhsbmRqZHMgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [http://www.google.com/calendar/event?action=VIEW&eid=djRqZHZramU3bmZtdXQyMnA4aGVmcGxlMzQganN0ZXZlbkBjaWdpdGFsLmNvbQ&tok=MjEjam9obi5zdGV2ZW5Ab3dhc3Aub3JnY2ZmNDM1Nzc1YmZlNDVhMzE2NTcyNzIzMjgwNzNjZGVkZDgxYTJhYQ&ctz=America%2FNew_York&hl=en Exchange Calendar]

==== Locations ====
'''If you plan to attend in person:'''

Directions to Booz Allen's One Dulles facility:

13200 Woodland Park Road
Herndon, VA 20171

From Tyson's Corner:

* Take LEESBURG PIKE / VA-7 WEST
* Merge onto VA-267 WEST / DULLES TOLL ROAD (Portions Toll)
* Take the VA-657 Exit (Exit Number 10 towards Herndon / Chantilly)
* Take the ramp toward CHANTILLY
* Turn Left onto CENTERVILLE ROAD (at end of ramp)
* Turn Left onto WOODLAND PARK ROAD (less than 1⁄2 mile)
* End at 13200 WOODLAND PARK ROAD

 '''If you plan to attend via Webinar:'''

You can attend through [[OWASPNoVA WebEx]]

==== Schedule ====
Meetings are held the first thursday of the month.

===== Next Meeting =====


'''DATE''': Thursday, September 17, 2009. 6:00pm Eastern Daylight Time 
'''LOCATION''': 22260 Pacific blvd, Sterling, VA. 20166 
'''TOPIC''': "Fortify 360" 
'''SPEAKER''': Erik Klein (Fortify Software), Eric Dalci (Cigital)

'''INSTRUCTIONS''': RSVP through [mailto:wade.woolwine@owasp.org?Subject=OWASP%20RSVP Wade Woodline] with “OWASP RSVP” in the subject.

'''DESCRIPTION''':
 We're pleased to invite you to our next week's OWASP Session (Thursday September 17th). We will be hosting a presentation, demo and hands on session of Fortify 360 (http://www.fortify.com). Fortify 360 includes Fortify SCA (Source Code Analyzer) and the Fortify 360 Server which is Fortify's solution for an enterprise deployment of SCA. The session will start with a presentation by Fortify engineers, followed by a demo and finally a hands on session where the audience will be free to install Fortify SCA on the machine and try it the SCA tool on a sample application that we will provide. The audience will also be introduced with the Fortify 360 Server and try some of the enterprise level features such as collaborative code review, metrics and so on. Bring your laptop if you want to try Fortify 360!

The target audience is anyone interested in Secure Code Review with a Static Analysis tool at the desktop level and/or enterprise level. We will need to register visitors before hand...please email wade.woolwine@owasp.org for registration and confirm attendance. Pizza and refreshments will be served.


'''DATE''': Thursday, September 3, 2009. 6:00pm. 
'''LOCATION''': 13200 Woodland Park Road Herndon, VA 20171 
'''TOPIC''': "Conducting Application Assessment" 
'''SPEAKER''': Jeremy Epstein, SRI

'''INSTRUCTIONS''': RSVP through [mailto:wisseman_stan@bah.com?Subject=OWASP%20RSVP Stan Wisseman] with “OWASP RSVP” in the subject.

'''DESCRIPTION''':
After the 2000 election, many states launched headlong into electronic
voting systems to avoid the problems with "hanging chads". Once
problems with those systems started appearing, many localities started
moving to optical scan, which was used by a majority of US voters in
the 2008 election. There are other technologies in use around the
country, including lever machines, vote-by-mail, vote-by-phone, and
Internet voting. What are the tradeoffs among these technologies?
Particularly relevant to OWASP, what are the security issues
associated with different types of equipment, and what measures do
vendors of voting equipment use to try to address the security
problems? Are software security problems important, or can
non-technical measures protect against them? In this talk, we'll
discuss a wide variety of voting technologies, and their pros and cons
from both a technical and societal perspective.

'''ABOUT THE SPEAKER''':
Jeremy Epstein is Senior Computer Scientist at SRI International. His
background includes more than 20 years experience in computer security
research, product development, and consulting. Prior to joining SRI
International, he was Principal Consultant with Cigital, and before
that spent nine years as Senior Director of Product Security at
Software AG, an international business software company. Within the area
of voting systems, Jeremy has been involved for over
five years in voting technology and advocacy, both as an employee and
as an independent consultant.

===== Upcoming Speakers =====

If you want to present, please contact John. We're very open to hearing from all our members.
Future speakers to include Gunnar Peterson and more.

[http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York View the OWASP NoVA Chapter Calendar] 

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. '''REGISTRATION IS OPEN!'''

Please send an email to [mailto:John.Steven@owasp.org John Steven] with your skill level with Statis Analysis tools, your motivation and '''the dates''' that you want to sign in for.
Students are required to bring their own laptop. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one.

===Student’s prerequisites===
All students will need to bring their own laptop

=== Past meetings ===
July 9th 6pm-9pm EST 
LOCATION: 13200 Woodland Park Road Herndon, VA 20171 
TOPIC: "Ounce's 02" 
SPEAKER(S): Dinis Cruz, OWASP, Ounce Labs. 
PANEL: TBD 
INSTRUCTIONS: RSVP through Stan Wisseman wisseman_stan@bah.com with “OWASP RSVP” in the subject. 

DESCRIPTION: So what is O2?

Well in my mind O2 is a combination of advanced tools (Technology) which are designed to be used on a particular way (Process) by knowledgeable Individuals (People)

Think about it as a Fighter Jet who is able to go very fast, has tons of controls, needs to be piloted by somebody who knows what they are doing and needs to have a purpose (i.e. mission).

Basically what I did with O2 was to automate the workflow that I have when I'm engaged on a source-code security review.

Now, here is the catch, this version is NOT for the faint-of-heart. I designed this to suit my needs, which although are the same as most other security consultants, have its own particularities :)

The whole model of O2 development is based around the concept of automating a security consultant’s brain, so I basically ensure that the main O2 Developer (Dinis Cruz) has a very good understanding of the feature requirements of the targeted Security Consultant (Dinis Cruz) :) . And this proved (even to my surprise) spectacularly productive, since suddenly I (i.e. the security consultant) didn't had to wait months for new features to be added to its toolkit. If there was something that needed to be added, it would just be added in days or hours.

* View the OWASP NoVA Chapter [http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York Calendar ]

* The next meeting is '''Thursday, July 9th, 2009.'''
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Knowledge ====

The Northern Virginia (NoVA) chapter is committed to compiling resources on interesting and valuable topic areas. We hope that this structure helps you access information pertinent to your tasks at hand as you move through a secure application development life cycle. Currently, our topic areas of focus include activities such as:

* Threat Modeling
* [[Code Review and Static Analysis with tools]]
* Penetration Testing and Dynamic Analysis tools
* Monitoring/Dynamic patching (WAFs)

Certain projects our members are involved in cross-cut these activities, providing value throughout. They include:

* ASVS

==== Contributors and Sponsors ====

'''Chapter Leader'''

* [mailto:John.Steven@owasp.org John Steven], with assistance from [mailto:paco@cigital.com Paco Hope]

'''Refreshment Sponsors'''

[[Image:Cigital_OWASP.GIF]]

'''Facility Sponsors'''

[[Image:Bah-bw.JPG|215px]]

__NOTOC__
<headertabs/>
<paypal>Northern Virginia</paypal>

== Past Meetings ==

===June 2009===
''Gary McGraw, Cigital Inc.'':''Building Security In Maturity Model'' 
Later, an interview:
''Jim Routh, formerly of DTCC'':''The Economic Advantages of a Resilient Supply Chain- Software Security
'' 

Gary McGraw talked about the experience he, Sammy Migues, and Brian Chess gained conducting a survey of some of America's top Software Security groups. Study results are available under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Share Alike license] at [http://www.bsi-mm.com www.bsi-mm.com]. Gary described the common structural elements and activities of successful software security programs, present the maturity model that resulted from survey data, and discuss lessons learned from listening to those leading these groups.

Jim Routh gave an incredibly insightful interview regarding his own experiences crafting their security group.

Download presentation notes at: [http://www.owasp.org/images/0/03/JMR-Economics_of_Security_Goups.ppt The Economic Advantages of a Resilient Supply Chain- Software Security]

===May 2009 ===
''Eric Dalci, Cigital Inc.'':''Introduction to Static Analysis'' 
Later, a panel:
<UL>
<LI>Steven Lavenhar, Booz Allen Hamilton;
<LI>Eric Dalci, Cigital Inc.
</UL>
Panel moderated by John Steven
 

This session is an introductory to Static Analysis. This session presents the different types of analysis used by today's Static Analysis tools. Examples of direct application to find vulnerabilities will be shown (ex: Data Flow Analysis, Semantic, Control Flow, etc.). Current limitations of Static Analysis will also be exposed. This session is tool agnostic, but will cover the approach taken by various leading commercial (as well as open-source) tools.

Download: [http://www.owasp.org/images/e/ea/OWASP_Virginia_Edalci_May09.pdf Intro to Static Analysis]

===April 2009 ===
''Jeremiah Grossman, Whitehat Security'': '''Top 10 Web Hacking Techniques 2008''' 
Jeremiah Spoke on (what he and colleagues determined were the) top ten web hacking techniques of 2008. This talk was a preview of his RSA '09 talk. 

Download http://www.whitehatsec.com/home/assets/presentations/09PPT/PPT_OWASPNoVA04082008.pdf

Later,
<UL>
<LI>Nate Miller, Stratum Security;
<LI>Jeremiah Grossman, Whitehat Security;
<LI>Tom Brennan, Whitehat Security; and
<LI>Wade Woolwine, AOL
</UL>
served as penetration testing panels answering questions posed and moderated by Ken Van Wyk.

=== February 2009 ===

''Ryan C. Barnett, Breach Security'': '''Patching Challenge: Securing WebGoat with ModSecurity'''

Identification of web application vulnerabilities is only half the battle with remediation efforts as the other. Let's face the facts, there are many real world business scenarios where it is not possible to update web application code in either a timely manner or at all. This is where the tactical use-case of implementing a web application firewall to address identified issues proves its worth.

This talk will provide an overview of the recommended practices for utilizing a web application firewall for virtual patching. After discussing the framework to use, we will then present a very interesting OWASP Summer of Code Project where the challenge was to attempt to mitigate as many of the OWASP WebGoat vulnerabilities as possible using the open source ModSecurity web application firewall. During the talk, we will discuss both WebGoat and ModSecurity and provide in-depth walk-throughs of some of the complex fixes. Examples will include addressing not only attacks but the underlying vulnerabilities, using data persistence for multiple-step processes, content injection and even examples of the new LUA programming language API. The goal of this talk is to both highlight cutting edge mitigation options using a web application firewall and to show how it can effectively be used by security consultants who traditionally could only offer source code fixes.

Ryan C. Barnett is the Director of Application Security Research at Breach Security and leads Breach Security Labs. He is also a Faculty Member for the SANS Institute, Team Lead for the Center for Internet Security Apache Benchmark Project and a Member of the Web Application Security Consortium where he leads the Distributed Open Proxy Honeypot Project. Mr. Barnett has also authored a web security book for Addison/Wesley Publishing entitled "Preventing Web Attacks with Apache."

(This talk is a preview of Ryan's talk at Blackhat Federal the following week - see https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Barnett )

Download [[Media:Virtual_Patching_Ryan_Barnett_Blackhat_Federal_09.zip| WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity]]

''John Steven, Cigital'': '''Moving Beyond Top N Lists'''

Download [[Media:Moving_Beyond_Top_N_Lists.ppt.zip| Moving Beyond Top N Lists]]

Cigital published an article: The Top 11 Reasons Why Top 10 (or 25) Lists Don’t Work. Yet, these lists are a staple of conference abstracts, industry best practice lists, and the like. Are they good or bad? We’ll explore how to get beyond the Top 10 (or 25) list in making your software security effort real.

John is Senior Director, Advanced Technology Consulting at Cigital. His experience includes research in static code analysis and hands-on architecture and implementation of high-performance, scalable Java EE systems. John has provided security consulting services to a broad variety of commercial clients including two of the largest trading platforms in the world and has advised America's largest internet provider in the Midwest on security and forensics. John led the development of Cigital's architectural analysis methodology and its approach to deploying enterprise software security frameworks. He has demonstrated success in building Cigital's intellectual property for providing cutting-edge security. He brings this experience and a track record of effective strategic innovation to clients seeking to change, whether to adopt more cutting-edge approaches, or to solidify ROI. John currently chairs the SD Best Practices security track and co-edits the building security in department of IEEE's Security and Privacy magazine. John has served on numerous conference panels regarding software security, wireless security and Java EE system development. He holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

=== January 2009 ===

To kick off 2009, our January meeting featured a discussion of the relationship between application security and CMMI, and an overview of the OWASP ASVS project.

''Michele Moss, Booz Allen Hamilton'': '''Evolutions In The Relationship Between Application Security And The CMMI'''

Addressing new and complex threats and IT security challenges requires repeatable, reliable, rapid, and cost effective solutions. To implement these solutions, organizations have begun to align their security improvement efforts with their system and software development practices. During a “Birds of a Feather” at the March 2007 SEPG, a group of industry representatives initiated an effort which led to the definition of assurance practices that can be applied in the context of the CMMI. This presentation will provide an understanding how applying the assurance practices in the context of security contribute to the overall increased quality of products and services, illustrate how the a focus on assurance in the context of CMMI practices is related to application security practices, and present and approach to evaluate and improve the repeatability and reliability of assurance practices.

Michele Moss, CISSP, is a security engineer with more than 12 years of experience in process improvement. She specializes in integrating assurance processes and practices into project lifecycles. Michele is the Co-Chair of the DHS Software Assurance Working Group on Processes & Practices. She has assisted numerous organizations with maturing their information technology, information assurance, project management, and support practices through the use of the capability maturity models including the CMMI, and the SSE-CMM. She is one of the key contributors in an effort to apply an assurance focus to CMMI.

Slides available: [[http://www.epsteinmania.com/owasp/Moss-AppSecurityAndCMMI.pdf]]

''Mike Boberski, Booz Allen Hamilton'': '''About OWASP ASVS'''

The primary aim of the OWASP ASVS Project is to normalize the range
of coverage and level of rigor available in the market when it comes to
performing application-level security verification. The goal is to
create a set of commercially-workable open standards that are tailored
to specific web-based technologies.

Mike Boberski works at Booz Allen Hamilton. He has a background in
application security and the use of cryptography by applications. He is
experienced in trusted product evaluation, security-related software
development and integration, and cryptomodule testing. For OWASP, he is
the project lead and a co-author of the OWASP Application Security
Verification Standard, the first OWASP standard.

Slides available: [[https://www.owasp.org/images/5/52/About_OWASP_ASVS_Web_Edition.ppt]]

=== November 2008 ===
For our November 2008 meeting, we had two great presentations on software assurance and security testing.

''Nadya Bartol, Booz Allen Hamilton'': '''Framework for Software Assurance'''

Nadya's presentation will provide an update on the Software Assurance
Forum efforts to establish a comprehensive framework for software
assurance (SwA) and security measurement. The Framework addresses
measuring achievement of SwA goals and objectives within the context of
individual projects, programs, or enterprises. It targets a variety of
audiences including executives, developers, vendors, suppliers, and
buyers. The Framework leverages existing measurement methodologies,
including Practical Software and System Measurement (PSM); CMMI Goal,
Question, Indicator, Measure (GQ(I)M); NIST SP 800-55 Rev1; and ISO/IEC
27004 and identifies commonalities among the methodologies to help
organizations integrate SwA measurement in their overall measurement
efforts cost-effectively and as seamlessly as possible, rather than
establish a standalone SwA measurement effort within an organization.
The presentation will provide an update on the SwA Forum Measurement
Working Group work, present the current version of the Framework and underlying measures
development and implementation processes, and propose example SwA
measures applicable to a variety of SwA stakeholders. The presentation
will update the group on the latest NIST and ISO standards on
information security measurement that are being integrated into the
Framework as the standards are being developed.

Slides available: [[http://www.epsteinmania.com/owasp/Bartol-MeasurementForOWASP11-13-08.pdf]]

''Paco Hope, Cigital'': '''The Web Security Testing Cookbook'''

The Web Security Testing Cookbook (O'Reilly & Associates, October 2008)
gives developers and testers the tools they need to make security
testing a regular part of their development lifecycle. Its recipe style
approach covers manual, exploratory testing as well automated techniques
that you can make part of your unit tests or regression cycle. The
recipes cover the basics like observing messages between clients and
servers, to multi-phase tests that script the login and execution of web
application features. This book complements many of the security texts
in the market that tell you what a vulnerability is, but not how to
systematically test it day in and day out. Leverage the recipes in this
book to add significant security coverage to your testing without adding
significant time and cost to your effort.

Congratulations to Tim Bond who won an autographed copy of Paco's book.
Get your copy here [[http://www.amazon.com/Security-Testing-Cookbook-Paco-Hope/dp/0596514832]]

Slides available: [[http://www.epsteinmania.com/owasp/PacoHope-WebSecCookbook.pdf]]

=== October 2008 ===
For our October 2008 meeting, we had two fascinating talks relating to forensics.

''Dave Merkel, Mandiant'': '''Enterprise Grade Incident Management - Responding to Persistent Threats'''

Dave Merkel is Vice President of Products at Mandiant, a leading provider of information security services, education and products. Mr. Merkel has worked in the information security and incident response industry for over 10 years. His background includes service as a federal agent in the US Air Force and over 7 years experience directing security operations at America Online. He currently oversees the product business at Mandiant, and is in charge of building Mandiant Intelligent Response - an enterprise incident response solution. But no, he won't be selling you anything today.

Slides available: [[http://www.epsteinmania.com/owasp/Mandiant-EnterpriseIRandAPTpresentation.pdf]]

''Inno Eroraha, NetSecurity'': '''[Responding to the Digital Crime Scene: Gathering Volatile Data'''

Inno Eroraha is the founder and chief strategist of NetSecurity Corporation, a company that provides digital forensics, hands-on security consulting, and Hands-on How-To® training solutions that are high-quality, timely, and customer-focused. In this role, Mr. Eroraha helps clients plan, formulate, and execute the best security and forensics strategy that aligns with their business goals and priorities. He has consulted with Fortune 500 companies, IRS, DHS, VA, DoD, and other entities.

Slides available: [[http://www.epsteinmania.com/owasp/NetSecurity-RespondingToTheDigitalCrimeScene-GatheringVolatileData-TechnoForensics-102908.pdf] ]

==Knowledge==
On the [[Knowledge]] page, you'll find links to this chapter's contributions organized by topic area.

[[Category:Virginia]]
[[Category:Washington, DC]]

Virginia

2009-09-15T00:56:47Z

Edalci: /* Next Meeting */

==== About ====
[[Image:Owasp-nova.JPG|275px|right]]The '''OWASP Washington VA Local Chapter''' meetings are FREE and OPEN to anyone interested in learning more about application security. We encourage individuals to provide knowledge transfer via hands-on training and presentations of specific OWASP projects and research topics and sharing SDLC knowledge.

We the encourage vendor-agnostic presentations to utilize the OWASP Powerpoint template when applicable and individual volunteerism to enable perpetual growth. As a 501(3)c non-profit association donations of meeting space or refreshments sponsorship is encouraged, simply contact the local chapter leaders listed on this page to discuss. Prior to participating with OWASP please review the Chapter Rules.

The original DC Chapter was founded in June 2004 by [mailto:jeff.williams@owasp.org Jeff Williams] and has had members from Virginia to Delaware. In April 2005 a new chapter, OWASP Washington VA Local Chapter, was formed and the DC Chapter was renamed to DC-Maryland. The two are sister chapters and include common members and shared discourse. The chapters meet in opposite halves of the month to facilitate this relationship.

{{Chapter Template|chaptername=Virginia|extra=The chapter leader is [mailto:John.Steven@owasp.org John Steven]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-CHANGEME|emailarchives=http://lists.owasp.org/pipermail/owasp-CHANGEME}}
* [http://lists.owasp.org/mailman/listinfo/owasp-wash_dc_va Click here to join local chapter mailing list]
* Add August 6th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=NjNhbjFsZ3FrdXRqYzVuNW11amhsbmRqZHMgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [http://www.google.com/calendar/event?action=VIEW&eid=djRqZHZramU3bmZtdXQyMnA4aGVmcGxlMzQganN0ZXZlbkBjaWdpdGFsLmNvbQ&tok=MjEjam9obi5zdGV2ZW5Ab3dhc3Aub3JnY2ZmNDM1Nzc1YmZlNDVhMzE2NTcyNzIzMjgwNzNjZGVkZDgxYTJhYQ&ctz=America%2FNew_York&hl=en Exchange Calendar]

==== Locations ====
'''If you plan to attend in person:'''

Directions to Booz Allen's One Dulles facility:

13200 Woodland Park Road
Herndon, VA 20171

From Tyson's Corner:

* Take LEESBURG PIKE / VA-7 WEST
* Merge onto VA-267 WEST / DULLES TOLL ROAD (Portions Toll)
* Take the VA-657 Exit (Exit Number 10 towards Herndon / Chantilly)
* Take the ramp toward CHANTILLY
* Turn Left onto CENTERVILLE ROAD (at end of ramp)
* Turn Left onto WOODLAND PARK ROAD (less than 1⁄2 mile)
* End at 13200 WOODLAND PARK ROAD

 '''If you plan to attend via Webinar:'''

You can attend through [[OWASPNoVA WebEx]]

==== Schedule ====
Meetings are held the first thursday of the month.

===== Next Meeting =====


'''DATE''': Thursday, September 17, 2009. 6:00pm Eastern Daylight Time 
'''LOCATION''': 22260 Pacific blvd, Sterling, VA. 20166 
'''TOPIC''': "Fortify 360" 
'''SPEAKER''': Erik Klein (Fortify Software), Eric Dalci (Cigital)

'''INSTRUCTIONS''': RSVP through [mailto:wade.woolwine@owasp.org?Subject=OWASP%20RSVP Wade Woodline] with “OWASP RSVP” in the subject.

'''DESCRIPTION''':
 We're pleased to invite you to our next week's OWASP Session (Thursday September 17th). We will be hosting a presentation, demo and hands on session of Fortify 360 (http://www.fortify.com). Fortify 360 includes Fortify SCA (Source Code Analyzer) and the Fortify 360 Server which is Fortify's solution for an enterprise deployment of SCA. The session will start with a presentation by Fortify engineers, followed by a demo and finally a hands on session where the audience will be free to install Fortify SCA on the machine and try it the SCA tool on a sample application that we will provide. The audience will also be introduced with the Fortify 360 Server and try some of the enterprise level features such as collaborative code review, metrics and so on. Bring your laptop if you want to try Fortify 360!

The target audience is anyone interested in Secure Code Review with a Static Analysis tool at the desktop level and/or enterprise level. We will need to register visitors before hand...please email wade.woolwine@owasp.org for registration and confirm attendance. Pizza and refreshments will be served.


'''DATE''': Thursday, September 3, 2009. 6:00pm. 
'''LOCATION''': 13200 Woodland Park Road Herndon, VA 20171 
'''TOPIC''': "Conducting Application Assessment" 
'''SPEAKER''': Jeremy Epstein, SRI

'''INSTRUCTIONS''': RSVP through [mailto:wisseman_stan@bah.com?Subject=OWASP%20RSVP Stan Wisseman] with “OWASP RSVP” in the subject.

'''DESCRIPTION''':
After the 2000 election, many states launched headlong into electronic
voting systems to avoid the problems with "hanging chads". Once
problems with those systems started appearing, many localities started
moving to optical scan, which was used by a majority of US voters in
the 2008 election. There are other technologies in use around the
country, including lever machines, vote-by-mail, vote-by-phone, and
Internet voting. What are the tradeoffs among these technologies?
Particularly relevant to OWASP, what are the security issues
associated with different types of equipment, and what measures do
vendors of voting equipment use to try to address the security
problems? Are software security problems important, or can
non-technical measures protect against them? In this talk, we'll
discuss a wide variety of voting technologies, and their pros and cons
from both a technical and societal perspective.

'''ABOUT THE SPEAKER''':
Jeremy Epstein is Senior Computer Scientist at SRI International. His
background includes more than 20 years experience in computer security
research, product development, and consulting. Prior to joining SRI
International, he was Principal Consultant with Cigital, and before
that spent nine years as Senior Director of Product Security at
Software AG, an international business software company. Within the area
of voting systems, Jeremy has been involved for over
five years in voting technology and advocacy, both as an employee and
as an independent consultant.

===== Upcoming Speakers =====

If you want to present, please contact John. We're very open to hearing from all our members.
Future speakers to include Gunnar Peterson and more.

[http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York View the OWASP NoVA Chapter Calendar] 

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. '''REGISTRATION IS OPEN!'''

Please send an email to [mailto:John.Steven@owasp.org John Steven] with your skill level with Statis Analysis tools, your motivation and '''the dates''' that you want to sign in for.
Students are required to bring their own laptop. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one.

===Student’s prerequisites===
All students will need to bring their own laptop

=== Past meetings ===
July 9th 6pm-9pm EST 
LOCATION: 13200 Woodland Park Road Herndon, VA 20171 
TOPIC: "Ounce's 02" 
SPEAKER(S): Dinis Cruz, OWASP, Ounce Labs. 
PANEL: TBD 
INSTRUCTIONS: RSVP through Stan Wisseman wisseman_stan@bah.com with “OWASP RSVP” in the subject. 

DESCRIPTION: So what is O2?

Well in my mind O2 is a combination of advanced tools (Technology) which are designed to be used on a particular way (Process) by knowledgeable Individuals (People)

Think about it as a Fighter Jet who is able to go very fast, has tons of controls, needs to be piloted by somebody who knows what they are doing and needs to have a purpose (i.e. mission).

Basically what I did with O2 was to automate the workflow that I have when I'm engaged on a source-code security review.

Now, here is the catch, this version is NOT for the faint-of-heart. I designed this to suit my needs, which although are the same as most other security consultants, have its own particularities :)

The whole model of O2 development is based around the concept of automating a security consultant’s brain, so I basically ensure that the main O2 Developer (Dinis Cruz) has a very good understanding of the feature requirements of the targeted Security Consultant (Dinis Cruz) :) . And this proved (even to my surprise) spectacularly productive, since suddenly I (i.e. the security consultant) didn't had to wait months for new features to be added to its toolkit. If there was something that needed to be added, it would just be added in days or hours.

* View the OWASP NoVA Chapter [http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York Calendar ]

* The next meeting is '''Thursday, July 9th, 2009.'''
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Knowledge ====

The Northern Virginia (NoVA) chapter is committed to compiling resources on interesting and valuable topic areas. We hope that this structure helps you access information pertinent to your tasks at hand as you move through a secure application development life cycle. Currently, our topic areas of focus include activities such as:

* Threat Modeling
* [[Code Review and Static Analysis with tools]]
* Penetration Testing and Dynamic Analysis tools
* Monitoring/Dynamic patching (WAFs)

Certain projects our members are involved in cross-cut these activities, providing value throughout. They include:

* ASVS

==== Contributors and Sponsors ====

'''Chapter Leader'''

* [mailto:John.Steven@owasp.org John Steven], with assistance from [mailto:paco@cigital.com Paco Hope]

'''Refreshment Sponsors'''

[[Image:Cigital_OWASP.GIF]]

'''Facility Sponsors'''

[[Image:Bah-bw.JPG|215px]]

__NOTOC__
<headertabs/>
<paypal>Northern Virginia</paypal>

== Past Meetings ==

===June 2009===
''Gary McGraw, Cigital Inc.'':''Building Security In Maturity Model'' 
Later, an interview:
''Jim Routh, formerly of DTCC'':''The Economic Advantages of a Resilient Supply Chain- Software Security
'' 

Gary McGraw talked about the experience he, Sammy Migues, and Brian Chess gained conducting a survey of some of America's top Software Security groups. Study results are available under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Share Alike license] at [http://www.bsi-mm.com www.bsi-mm.com]. Gary described the common structural elements and activities of successful software security programs, present the maturity model that resulted from survey data, and discuss lessons learned from listening to those leading these groups.

Jim Routh gave an incredibly insightful interview regarding his own experiences crafting their security group.

Download presentation notes at: [http://www.owasp.org/images/0/03/JMR-Economics_of_Security_Goups.ppt The Economic Advantages of a Resilient Supply Chain- Software Security]

===May 2009 ===
''Eric Dalci, Cigital Inc.'':''Introduction to Static Analysis'' 
Later, a panel:
<UL>
<LI>Steven Lavenhar, Booz Allen Hamilton;
<LI>Eric Dalci, Cigital Inc.
</UL>
Panel moderated by John Steven
 

This session is an introductory to Static Analysis. This session presents the different types of analysis used by today's Static Analysis tools. Examples of direct application to find vulnerabilities will be shown (ex: Data Flow Analysis, Semantic, Control Flow, etc.). Current limitations of Static Analysis will also be exposed. This session is tool agnostic, but will cover the approach taken by various leading commercial (as well as open-source) tools.

Download: [http://www.owasp.org/images/e/ea/OWASP_Virginia_Edalci_May09.pdf Intro to Static Analysis]

===April 2009 ===
''Jeremiah Grossman, Whitehat Security'': '''Top 10 Web Hacking Techniques 2008''' 
Jeremiah Spoke on (what he and colleagues determined were the) top ten web hacking techniques of 2008. This talk was a preview of his RSA '09 talk. 

Download http://www.whitehatsec.com/home/assets/presentations/09PPT/PPT_OWASPNoVA04082008.pdf

Later,
<UL>
<LI>Nate Miller, Stratum Security;
<LI>Jeremiah Grossman, Whitehat Security;
<LI>Tom Brennan, Whitehat Security; and
<LI>Wade Woolwine, AOL
</UL>
served as penetration testing panels answering questions posed and moderated by Ken Van Wyk.

=== February 2009 ===

''Ryan C. Barnett, Breach Security'': '''Patching Challenge: Securing WebGoat with ModSecurity'''

Identification of web application vulnerabilities is only half the battle with remediation efforts as the other. Let's face the facts, there are many real world business scenarios where it is not possible to update web application code in either a timely manner or at all. This is where the tactical use-case of implementing a web application firewall to address identified issues proves its worth.

This talk will provide an overview of the recommended practices for utilizing a web application firewall for virtual patching. After discussing the framework to use, we will then present a very interesting OWASP Summer of Code Project where the challenge was to attempt to mitigate as many of the OWASP WebGoat vulnerabilities as possible using the open source ModSecurity web application firewall. During the talk, we will discuss both WebGoat and ModSecurity and provide in-depth walk-throughs of some of the complex fixes. Examples will include addressing not only attacks but the underlying vulnerabilities, using data persistence for multiple-step processes, content injection and even examples of the new LUA programming language API. The goal of this talk is to both highlight cutting edge mitigation options using a web application firewall and to show how it can effectively be used by security consultants who traditionally could only offer source code fixes.

Ryan C. Barnett is the Director of Application Security Research at Breach Security and leads Breach Security Labs. He is also a Faculty Member for the SANS Institute, Team Lead for the Center for Internet Security Apache Benchmark Project and a Member of the Web Application Security Consortium where he leads the Distributed Open Proxy Honeypot Project. Mr. Barnett has also authored a web security book for Addison/Wesley Publishing entitled "Preventing Web Attacks with Apache."

(This talk is a preview of Ryan's talk at Blackhat Federal the following week - see https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Barnett )

Download [[Media:Virtual_Patching_Ryan_Barnett_Blackhat_Federal_09.zip| WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity]]

''John Steven, Cigital'': '''Moving Beyond Top N Lists'''

Download [[Media:Moving_Beyond_Top_N_Lists.ppt.zip| Moving Beyond Top N Lists]]

Cigital published an article: The Top 11 Reasons Why Top 10 (or 25) Lists Don’t Work. Yet, these lists are a staple of conference abstracts, industry best practice lists, and the like. Are they good or bad? We’ll explore how to get beyond the Top 10 (or 25) list in making your software security effort real.

John is Senior Director, Advanced Technology Consulting at Cigital. His experience includes research in static code analysis and hands-on architecture and implementation of high-performance, scalable Java EE systems. John has provided security consulting services to a broad variety of commercial clients including two of the largest trading platforms in the world and has advised America's largest internet provider in the Midwest on security and forensics. John led the development of Cigital's architectural analysis methodology and its approach to deploying enterprise software security frameworks. He has demonstrated success in building Cigital's intellectual property for providing cutting-edge security. He brings this experience and a track record of effective strategic innovation to clients seeking to change, whether to adopt more cutting-edge approaches, or to solidify ROI. John currently chairs the SD Best Practices security track and co-edits the building security in department of IEEE's Security and Privacy magazine. John has served on numerous conference panels regarding software security, wireless security and Java EE system development. He holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

=== January 2009 ===

To kick off 2009, our January meeting featured a discussion of the relationship between application security and CMMI, and an overview of the OWASP ASVS project.

''Michele Moss, Booz Allen Hamilton'': '''Evolutions In The Relationship Between Application Security And The CMMI'''

Addressing new and complex threats and IT security challenges requires repeatable, reliable, rapid, and cost effective solutions. To implement these solutions, organizations have begun to align their security improvement efforts with their system and software development practices. During a “Birds of a Feather” at the March 2007 SEPG, a group of industry representatives initiated an effort which led to the definition of assurance practices that can be applied in the context of the CMMI. This presentation will provide an understanding how applying the assurance practices in the context of security contribute to the overall increased quality of products and services, illustrate how the a focus on assurance in the context of CMMI practices is related to application security practices, and present and approach to evaluate and improve the repeatability and reliability of assurance practices.

Michele Moss, CISSP, is a security engineer with more than 12 years of experience in process improvement. She specializes in integrating assurance processes and practices into project lifecycles. Michele is the Co-Chair of the DHS Software Assurance Working Group on Processes & Practices. She has assisted numerous organizations with maturing their information technology, information assurance, project management, and support practices through the use of the capability maturity models including the CMMI, and the SSE-CMM. She is one of the key contributors in an effort to apply an assurance focus to CMMI.

Slides available: [[http://www.epsteinmania.com/owasp/Moss-AppSecurityAndCMMI.pdf]]

''Mike Boberski, Booz Allen Hamilton'': '''About OWASP ASVS'''

The primary aim of the OWASP ASVS Project is to normalize the range
of coverage and level of rigor available in the market when it comes to
performing application-level security verification. The goal is to
create a set of commercially-workable open standards that are tailored
to specific web-based technologies.

Mike Boberski works at Booz Allen Hamilton. He has a background in
application security and the use of cryptography by applications. He is
experienced in trusted product evaluation, security-related software
development and integration, and cryptomodule testing. For OWASP, he is
the project lead and a co-author of the OWASP Application Security
Verification Standard, the first OWASP standard.

Slides available: [[https://www.owasp.org/images/5/52/About_OWASP_ASVS_Web_Edition.ppt]]

=== November 2008 ===
For our November 2008 meeting, we had two great presentations on software assurance and security testing.

''Nadya Bartol, Booz Allen Hamilton'': '''Framework for Software Assurance'''

Nadya's presentation will provide an update on the Software Assurance
Forum efforts to establish a comprehensive framework for software
assurance (SwA) and security measurement. The Framework addresses
measuring achievement of SwA goals and objectives within the context of
individual projects, programs, or enterprises. It targets a variety of
audiences including executives, developers, vendors, suppliers, and
buyers. The Framework leverages existing measurement methodologies,
including Practical Software and System Measurement (PSM); CMMI Goal,
Question, Indicator, Measure (GQ(I)M); NIST SP 800-55 Rev1; and ISO/IEC
27004 and identifies commonalities among the methodologies to help
organizations integrate SwA measurement in their overall measurement
efforts cost-effectively and as seamlessly as possible, rather than
establish a standalone SwA measurement effort within an organization.
The presentation will provide an update on the SwA Forum Measurement
Working Group work, present the current version of the Framework and underlying measures
development and implementation processes, and propose example SwA
measures applicable to a variety of SwA stakeholders. The presentation
will update the group on the latest NIST and ISO standards on
information security measurement that are being integrated into the
Framework as the standards are being developed.

Slides available: [[http://www.epsteinmania.com/owasp/Bartol-MeasurementForOWASP11-13-08.pdf]]

''Paco Hope, Cigital'': '''The Web Security Testing Cookbook'''

The Web Security Testing Cookbook (O'Reilly & Associates, October 2008)
gives developers and testers the tools they need to make security
testing a regular part of their development lifecycle. Its recipe style
approach covers manual, exploratory testing as well automated techniques
that you can make part of your unit tests or regression cycle. The
recipes cover the basics like observing messages between clients and
servers, to multi-phase tests that script the login and execution of web
application features. This book complements many of the security texts
in the market that tell you what a vulnerability is, but not how to
systematically test it day in and day out. Leverage the recipes in this
book to add significant security coverage to your testing without adding
significant time and cost to your effort.

Congratulations to Tim Bond who won an autographed copy of Paco's book.
Get your copy here [[http://www.amazon.com/Security-Testing-Cookbook-Paco-Hope/dp/0596514832]]

Slides available: [[http://www.epsteinmania.com/owasp/PacoHope-WebSecCookbook.pdf]]

=== October 2008 ===
For our October 2008 meeting, we had two fascinating talks relating to forensics.

''Dave Merkel, Mandiant'': '''Enterprise Grade Incident Management - Responding to Persistent Threats'''

Dave Merkel is Vice President of Products at Mandiant, a leading provider of information security services, education and products. Mr. Merkel has worked in the information security and incident response industry for over 10 years. His background includes service as a federal agent in the US Air Force and over 7 years experience directing security operations at America Online. He currently oversees the product business at Mandiant, and is in charge of building Mandiant Intelligent Response - an enterprise incident response solution. But no, he won't be selling you anything today.

Slides available: [[http://www.epsteinmania.com/owasp/Mandiant-EnterpriseIRandAPTpresentation.pdf]]

''Inno Eroraha, NetSecurity'': '''[Responding to the Digital Crime Scene: Gathering Volatile Data'''

Inno Eroraha is the founder and chief strategist of NetSecurity Corporation, a company that provides digital forensics, hands-on security consulting, and Hands-on How-To® training solutions that are high-quality, timely, and customer-focused. In this role, Mr. Eroraha helps clients plan, formulate, and execute the best security and forensics strategy that aligns with their business goals and priorities. He has consulted with Fortune 500 companies, IRS, DHS, VA, DoD, and other entities.

Slides available: [[http://www.epsteinmania.com/owasp/NetSecurity-RespondingToTheDigitalCrimeScene-GatheringVolatileData-TechnoForensics-102908.pdf] ]

==Knowledge==
On the [[Knowledge]] page, you'll find links to this chapter's contributions organized by topic area.

[[Category:Virginia]]
[[Category:Washington, DC]]

Code Review and Static Analysis with tools

2009-08-04T18:06:07Z

Edalci: /* Tool license and Vendor IP */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date to be confirmed)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-08-04T18:05:12Z

Edalci: /* Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date to be confirmed)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:40:33Z

Edalci: /* Session 6: Tool Adoption and Deployment, September 2009 (date not set) */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date to be confirmed)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:40:07Z

Edalci: /* Session 5: Customization Lab for Ounce Lab, September 2009 (date not set) */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date not set)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:39:53Z

Edalci: /* Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date not set) */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date to be confirmed)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date not set)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date not set)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:38:43Z

Edalci: /* Session 5: Tool Adoption and Deployment, September 2009 (date not set) */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date not set)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date not set)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 6: Tool Adoption and Deployment, September 2009 (date not set)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:36:35Z

Edalci: /* Session 5: Tool Adoption and Deployment, September 17th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date not set)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date not set)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 2009 (date not set)===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:36:19Z

Edalci: /* Session 5: Customization Lab for Ounce Lab, August 27th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date not set)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, September 2009 (date not set)===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:35:49Z

Edalci: /* Session 4: Customization Lab (Ounce Lab), August 27th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Tool Assisted Code Reviews with Ounce Lab, September 2009 (date not set)===
*Speaker: Dalci, Eric (Cigital), Ounce Lab (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Ounce Lab Static Analysis tool:
* Ounce Lab will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 5: Customization Lab for Ounce Lab, August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:33:43Z

Edalci: /* Session 3: Customization Lab (Fortify), August 27th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab for Fortify SCA, August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:33:20Z

Edalci: /* Session 2: Tool Assisted Code Reviews, August 13th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews with Fortify SCA, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab (Fortify), August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:32:40Z

Edalci: /* Session 3: Customization Lab (Fortify), August 13th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab (Fortify), August 27th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:32:17Z

Edalci: /* Session 2: Tool Assisted Code Reviews, August 13th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to the Fortify SCA Static Analysis tool:
* Fortify will demo its tool and scan Webgoat. We will have an open discussion session after the demo for students to ask questions to the vendor. After this course, student should be able to scan code by their own. Student should feel free to bring code to scan.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:28:00Z

Edalci: /* Session 2: Tool Assisted Code Reviews, August 6th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews, August 13th 2009===
*Speaker: Dalci, Eric (Cigital), Fortify (Mike Mauro)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: AOL, 22000 AOL Way, Dulles, VA 20166
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat. Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison. We will have an open discussion session after each demo for students to ask questions to the vendors. Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-07-27T00:25:47Z

Edalci: /* Static Analysis Curriculum */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews, August 6th 2009===
*Speaker: Dalci, Eric (Cigital), Bruce Mayhew (Ounce Lab) and Fortify (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat. Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison. We will have an open discussion session after each demo for students to ask questions to the vendors. Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

File:Owasp SAtrack plan.png

2009-07-27T00:25:03Z

Edalci: uploaded a new version of "File:Owasp SAtrack plan.png"

Virginia

2009-07-27T00:22:48Z

Edalci: /* Static Analysis Curriculum */

==== About ====
[[Image:Owasp-nova.JPG|275px|right]]The '''OWASP Washington VA Local Chapter''' meetings are FREE and OPEN to anyone interested in learning more about application security. We encourage individuals to provide knowledge transfer via hands-on training and presentations of specific OWASP projects and research topics and sharing SDLC knowledge.

We the encourage vendor-agnostic presentations to utilize the OWASP Powerpoint template when applicable and individual volunteerism to enable perpetual growth. As a 501(3)c non-profit association donations of meeting space or refreshments sponsorship is encouraged, simply contact the local chapter leaders listed on this page to discuss. Prior to participating with OWASP please review the Chapter Rules.

The original DC Chapter was founded in June 2004 by [mailto:jeff.williams@owasp.org Jeff Williams] and has had members from Virginia to Delaware. In April 2005 a new chapter, OWASP Washington VA Local Chapter, was formed and the DC Chapter was renamed to DC-Maryland. The two are sister chapters and include common members and shared discourse. The chapters meet in opposite halves of the month to facilitate this relationship.

{{Chapter Template|chaptername=Virginia|extra=The chapter leader is [mailto:John.Steven@owasp.org John Steven]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-CHANGEME|emailarchives=http://lists.owasp.org/pipermail/owasp-CHANGEME}}
* [http://lists.owasp.org/mailman/listinfo/owasp-wash_dc_va Click here to join local chapter mailing list]
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Locations ====
'''If you plan to attend in person:'''

Directions to Booz Allen's One Dulles facility:

13200 Woodland Park Road
Herndon, VA 20171

From Tyson's Corner:

* Take LEESBURG PIKE / VA-7 WEST
* Merge onto VA-267 WEST / DULLES TOLL ROAD (Portions Toll)
* Take the VA-657 Exit (Exit Number 10 towards Herndon / Chantilly)
* Take the ramp toward CHANTILLY
* Turn Left onto CENTERVILLE ROAD (at end of ramp)
* Turn Left onto WOODLAND PARK ROAD (less than 1⁄2 mile)
* End at 13200 WOODLAND PARK ROAD

 '''If you plan to attend via Webinar:'''

You can attend through [[OWASPNoVA WebEx]]

==== Schedule ====
'''Next Meeting'''
Future speakers to include Gunnar Peterson, Dan Cornell, and more.

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owasp SAtrack plan.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. '''REGISTRATION IS OPEN!'''

Please send an email to [mailto:John.Steven@owasp.org John Steven] with your skill level with Statis Analysis tools, your motivation and '''the dates''' that you want to sign in for.
Students are required to bring their own laptop. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one.

===Student’s prerequisites===
All students will need to bring their own laptop

=== Past meetings ===
July 9th 6pm-9pm EST 
LOCATION: 13200 Woodland Park Road Herndon, VA 20171 
TOPIC: "Ounce's 02" 
SPEAKER(S): Dinis Cruz, OWASP, Ounce Labs. 
PANEL: TBD 
INSTRUCTIONS: RSVP through Stan Wisseman wisseman_stan@bah.com with “OWASP RSVP” in the subject. 

DESCRIPTION: So what is O2?

Well in my mind O2 is a combination of advanced tools (Technology) which are designed to be used on a particular way (Process) by knowledgeable Individuals (People)

Think about it as a Fighter Jet who is able to go very fast, has tons of controls, needs to be piloted by somebody who knows what they are doing and needs to have a purpose (i.e. mission).

Basically what I did with O2 was to automate the workflow that I have when I'm engaged on a source-code security review.

Now, here is the catch, this version is NOT for the faint-of-heart. I designed this to suit my needs, which although are the same as most other security consultants, have its own particularities :)

The whole model of O2 development is based around the concept of automating a security consultant’s brain, so I basically ensure that the main O2 Developer (Dinis Cruz) has a very good understanding of the feature requirements of the targeted Security Consultant (Dinis Cruz) :) . And this proved (even to my surprise) spectacularly productive, since suddenly I (i.e. the security consultant) didn't had to wait months for new features to be added to its toolkit. If there was something that needed to be added, it would just be added in days or hours.

* View the OWASP NoVA Chapter [http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York Calendar ]

* The next meeting is '''Thursday, July 9th, 2009.'''
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Knowledge ====

The Northern Virginia (NoVA) chapter is committed to compiling resources on interesting and valuable topic areas. We hope that this structure helps you access information pertinent to your tasks at hand as you move through a secure application development life cycle. Currently, our topic areas of focus include activities such as:

* Threat Modeling
* [[Code Review and Static Analysis with tools]]
* Penetration Testing and Dynamic Analysis tools
* Monitoring/Dynamic patching (WAFs)

Certain projects our members are involved in cross-cut these activities, providing value throughout. They include:

* ASVS

==== Contributors and Sponsors ====

'''Chapter Leader'''

* [mailto:John.Steven@owasp.org John Steven], with assistance from [mailto:paco@cigital.com Paco Hope]

'''Refreshment Sponsors'''

[[Image:Cigital_OWASP.GIF]]

'''Facility Sponsors'''

[[Image:Bah-bw.JPG|215px]]

__NOTOC__
<headertabs/>
<paypal>Northern Virginia</paypal>

== Past Meetings ==

===June 2009===
''Gary McGraw, Cigital Inc.'':''Building Security In Maturity Model'' 
Later, an interview:
''Jim Routh, formerly of DTCC'':''The Economic Advantages of a Resilient Supply Chain- Software Security
'' 

Gary McGraw talked about the experience he, Sammy Migues, and Brian Chess gained conducting a survey of some of America's top Software Security groups. Study results are available under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Share Alike license] at [http://www.bsi-mm.com www.bsi-mm.com]. Gary described the common structural elements and activities of successful software security programs, present the maturity model that resulted from survey data, and discuss lessons learned from listening to those leading these groups.

Jim Routh gave an incredibly insightful interview regarding his own experiences crafting their security group.

Download presentation notes at: [http://www.owasp.org/images/0/03/JMR-Economics_of_Security_Goups.ppt The Economic Advantages of a Resilient Supply Chain- Software Security]

===May 2009 ===
''Eric Dalci, Cigital Inc.'':''Introduction to Static Analysis'' 
Later, a panel:
<UL>
<LI>Steven Lavenhar, Booz Allen Hamilton;
<LI>Eric Dalci, Cigital Inc.
</UL>
Panel moderated by John Steven
 

This session is an introductory to Static Analysis. This session presents the different types of analysis used by today's Static Analysis tools. Examples of direct application to find vulnerabilities will be shown (ex: Data Flow Analysis, Semantic, Control Flow, etc.). Current limitations of Static Analysis will also be exposed. This session is tool agnostic, but will cover the approach taken by various leading commercial (as well as open-source) tools.

Download: [http://www.owasp.org/images/e/ea/OWASP_Virginia_Edalci_May09.pdf Intro to Static Analysis]

===April 2009 ===
''Jeremiah Grossman, Whitehat Security'': '''Top 10 Web Hacking Techniques 2008''' 
Jeremiah Spoke on (what he and colleagues determined were the) top ten web hacking techniques of 2008. This talk was a preview of his RSA '09 talk. 

Download http://www.whitehatsec.com/home/assets/presentations/09PPT/PPT_OWASPNoVA04082008.pdf

Later,
<UL>
<LI>Nate Miller, Stratum Security;
<LI>Jeremiah Grossman, Whitehat Security;
<LI>Tom Brennan, Whitehat Security; and
<LI>Wade Woolwine, AOL
</UL>
served as penetration testing panels answering questions posed and moderated by Ken Van Wyk.

=== February 2009 ===

''Ryan C. Barnett, Breach Security'': '''Patching Challenge: Securing WebGoat with ModSecurity'''

Identification of web application vulnerabilities is only half the battle with remediation efforts as the other. Let's face the facts, there are many real world business scenarios where it is not possible to update web application code in either a timely manner or at all. This is where the tactical use-case of implementing a web application firewall to address identified issues proves its worth.

This talk will provide an overview of the recommended practices for utilizing a web application firewall for virtual patching. After discussing the framework to use, we will then present a very interesting OWASP Summer of Code Project where the challenge was to attempt to mitigate as many of the OWASP WebGoat vulnerabilities as possible using the open source ModSecurity web application firewall. During the talk, we will discuss both WebGoat and ModSecurity and provide in-depth walk-throughs of some of the complex fixes. Examples will include addressing not only attacks but the underlying vulnerabilities, using data persistence for multiple-step processes, content injection and even examples of the new LUA programming language API. The goal of this talk is to both highlight cutting edge mitigation options using a web application firewall and to show how it can effectively be used by security consultants who traditionally could only offer source code fixes.

Ryan C. Barnett is the Director of Application Security Research at Breach Security and leads Breach Security Labs. He is also a Faculty Member for the SANS Institute, Team Lead for the Center for Internet Security Apache Benchmark Project and a Member of the Web Application Security Consortium where he leads the Distributed Open Proxy Honeypot Project. Mr. Barnett has also authored a web security book for Addison/Wesley Publishing entitled "Preventing Web Attacks with Apache."

(This talk is a preview of Ryan's talk at Blackhat Federal the following week - see https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Barnett )

Download [[Media:Virtual_Patching_Ryan_Barnett_Blackhat_Federal_09.zip| WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity]]

''John Steven, Cigital'': '''Moving Beyond Top N Lists'''

Download [[Media:Moving_Beyond_Top_N_Lists.ppt.zip| Moving Beyond Top N Lists]]

Cigital published an article: The Top 11 Reasons Why Top 10 (or 25) Lists Don’t Work. Yet, these lists are a staple of conference abstracts, industry best practice lists, and the like. Are they good or bad? We’ll explore how to get beyond the Top 10 (or 25) list in making your software security effort real.

John is Senior Director, Advanced Technology Consulting at Cigital. His experience includes research in static code analysis and hands-on architecture and implementation of high-performance, scalable Java EE systems. John has provided security consulting services to a broad variety of commercial clients including two of the largest trading platforms in the world and has advised America's largest internet provider in the Midwest on security and forensics. John led the development of Cigital's architectural analysis methodology and its approach to deploying enterprise software security frameworks. He has demonstrated success in building Cigital's intellectual property for providing cutting-edge security. He brings this experience and a track record of effective strategic innovation to clients seeking to change, whether to adopt more cutting-edge approaches, or to solidify ROI. John currently chairs the SD Best Practices security track and co-edits the building security in department of IEEE's Security and Privacy magazine. John has served on numerous conference panels regarding software security, wireless security and Java EE system development. He holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

=== January 2009 ===

To kick off 2009, our January meeting featured a discussion of the relationship between application security and CMMI, and an overview of the OWASP ASVS project.

''Michele Moss, Booz Allen Hamilton'': '''Evolutions In The Relationship Between Application Security And The CMMI'''

Addressing new and complex threats and IT security challenges requires repeatable, reliable, rapid, and cost effective solutions. To implement these solutions, organizations have begun to align their security improvement efforts with their system and software development practices. During a “Birds of a Feather” at the March 2007 SEPG, a group of industry representatives initiated an effort which led to the definition of assurance practices that can be applied in the context of the CMMI. This presentation will provide an understanding how applying the assurance practices in the context of security contribute to the overall increased quality of products and services, illustrate how the a focus on assurance in the context of CMMI practices is related to application security practices, and present and approach to evaluate and improve the repeatability and reliability of assurance practices.

Michele Moss, CISSP, is a security engineer with more than 12 years of experience in process improvement. She specializes in integrating assurance processes and practices into project lifecycles. Michele is the Co-Chair of the DHS Software Assurance Working Group on Processes & Practices. She has assisted numerous organizations with maturing their information technology, information assurance, project management, and support practices through the use of the capability maturity models including the CMMI, and the SSE-CMM. She is one of the key contributors in an effort to apply an assurance focus to CMMI.

Slides available: [[http://www.epsteinmania.com/owasp/Moss-AppSecurityAndCMMI.pdf]]

''Mike Boberski, Booz Allen Hamilton'': '''About OWASP ASVS'''

The primary aim of the OWASP ASVS Project is to normalize the range
of coverage and level of rigor available in the market when it comes to
performing application-level security verification. The goal is to
create a set of commercially-workable open standards that are tailored
to specific web-based technologies.

Mike Boberski works at Booz Allen Hamilton. He has a background in
application security and the use of cryptography by applications. He is
experienced in trusted product evaluation, security-related software
development and integration, and cryptomodule testing. For OWASP, he is
the project lead and a co-author of the OWASP Application Security
Verification Standard, the first OWASP standard.

Slides available: [[https://www.owasp.org/images/5/52/About_OWASP_ASVS_Web_Edition.ppt]]

=== November 2008 ===
For our November 2008 meeting, we had two great presentations on software assurance and security testing.

''Nadya Bartol, Booz Allen Hamilton'': '''Framework for Software Assurance'''

Nadya's presentation will provide an update on the Software Assurance
Forum efforts to establish a comprehensive framework for software
assurance (SwA) and security measurement. The Framework addresses
measuring achievement of SwA goals and objectives within the context of
individual projects, programs, or enterprises. It targets a variety of
audiences including executives, developers, vendors, suppliers, and
buyers. The Framework leverages existing measurement methodologies,
including Practical Software and System Measurement (PSM); CMMI Goal,
Question, Indicator, Measure (GQ(I)M); NIST SP 800-55 Rev1; and ISO/IEC
27004 and identifies commonalities among the methodologies to help
organizations integrate SwA measurement in their overall measurement
efforts cost-effectively and as seamlessly as possible, rather than
establish a standalone SwA measurement effort within an organization.
The presentation will provide an update on the SwA Forum Measurement
Working Group work, present the current version of the Framework and underlying measures
development and implementation processes, and propose example SwA
measures applicable to a variety of SwA stakeholders. The presentation
will update the group on the latest NIST and ISO standards on
information security measurement that are being integrated into the
Framework as the standards are being developed.

Slides available: [[http://www.epsteinmania.com/owasp/Bartol-MeasurementForOWASP11-13-08.pdf]]

''Paco Hope, Cigital'': '''The Web Security Testing Cookbook'''

The Web Security Testing Cookbook (O'Reilly & Associates, October 2008)
gives developers and testers the tools they need to make security
testing a regular part of their development lifecycle. Its recipe style
approach covers manual, exploratory testing as well automated techniques
that you can make part of your unit tests or regression cycle. The
recipes cover the basics like observing messages between clients and
servers, to multi-phase tests that script the login and execution of web
application features. This book complements many of the security texts
in the market that tell you what a vulnerability is, but not how to
systematically test it day in and day out. Leverage the recipes in this
book to add significant security coverage to your testing without adding
significant time and cost to your effort.

Congratulations to Tim Bond who won an autographed copy of Paco's book.
Get your copy here [[http://www.amazon.com/Security-Testing-Cookbook-Paco-Hope/dp/0596514832]]

Slides available: [[http://www.epsteinmania.com/owasp/PacoHope-WebSecCookbook.pdf]]

=== October 2008 ===
For our October 2008 meeting, we had two fascinating talks relating to forensics.

''Dave Merkel, Mandiant'': '''Enterprise Grade Incident Management - Responding to Persistent Threats'''

Dave Merkel is Vice President of Products at Mandiant, a leading provider of information security services, education and products. Mr. Merkel has worked in the information security and incident response industry for over 10 years. His background includes service as a federal agent in the US Air Force and over 7 years experience directing security operations at America Online. He currently oversees the product business at Mandiant, and is in charge of building Mandiant Intelligent Response - an enterprise incident response solution. But no, he won't be selling you anything today.

Slides available: [[http://www.epsteinmania.com/owasp/Mandiant-EnterpriseIRandAPTpresentation.pdf]]

''Inno Eroraha, NetSecurity'': '''[Responding to the Digital Crime Scene: Gathering Volatile Data'''

Inno Eroraha is the founder and chief strategist of NetSecurity Corporation, a company that provides digital forensics, hands-on security consulting, and Hands-on How-To® training solutions that are high-quality, timely, and customer-focused. In this role, Mr. Eroraha helps clients plan, formulate, and execute the best security and forensics strategy that aligns with their business goals and priorities. He has consulted with Fortune 500 companies, IRS, DHS, VA, DoD, and other entities.

Slides available: [[http://www.epsteinmania.com/owasp/NetSecurity-RespondingToTheDigitalCrimeScene-GatheringVolatileData-TechnoForensics-102908.pdf] ]

==Knowledge==
On the [[Knowledge]] page, you'll find links to this chapter's contributions organized by topic area.

[[Category:Virginia]]
[[Category:Washington, DC]]

File:Owasp SAtrack plan.png

2009-07-27T00:22:05Z

Edalci:

Code Review and Static Analysis with tools

2009-07-24T14:45:29Z

Edalci:

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owaspsa-track2.PNG|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews, August 6th 2009===
*Speaker: Dalci, Eric (Cigital), Bruce Mayhew (Ounce Lab) and Fortify (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat. Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison. We will have an open discussion session after each demo for students to ask questions to the vendors. Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Virginia

2009-07-15T18:34:31Z

Edalci: /* Student’s prerequisites */

==== About ====
[[Image:Owasp-nova.JPG|275px|right]]The '''OWASP Washington VA Local Chapter''' meetings are FREE and OPEN to anyone interested in learning more about application security. We encourage individuals to provide knowledge transfer via hands-on training and presentations of specific OWASP projects and research topics and sharing SDLC knowledge.

We the encourage vendor-agnostic presentations to utilize the OWASP Powerpoint template when applicable and individual volunteerism to enable perpetual growth. As a 501(3)c non-profit association donations of meeting space or refreshments sponsorship is encouraged, simply contact the local chapter leaders listed on this page to discuss. Prior to participating with OWASP please review the Chapter Rules.

The original DC Chapter was founded in June 2004 by [mailto:jeff.williams@owasp.org Jeff Williams] and has had members from Virginia to Delaware. In April 2005 a new chapter, OWASP Washington VA Local Chapter, was formed and the DC Chapter was renamed to DC-Maryland. The two are sister chapters and include common members and shared discourse. The chapters meet in opposite halves of the month to facilitate this relationship.

{{Chapter Template|chaptername=Virginia|extra=The chapter leader is [mailto:John.Steven@owasp.org John Steven]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-CHANGEME|emailarchives=http://lists.owasp.org/pipermail/owasp-CHANGEME}}
* [http://lists.owasp.org/mailman/listinfo/owasp-wash_dc_va Click here to join local chapter mailing list]
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Locations ====
'''If you plan to attend in person:'''

Directions to Booz Allen's One Dulles facility:

13200 Woodland Park Road
Herndon, VA 20171

From Tyson's Corner:

* Take LEESBURG PIKE / VA-7 WEST
* Merge onto VA-267 WEST / DULLES TOLL ROAD (Portions Toll)
* Take the VA-657 Exit (Exit Number 10 towards Herndon / Chantilly)
* Take the ramp toward CHANTILLY
* Turn Left onto CENTERVILLE ROAD (at end of ramp)
* Turn Left onto WOODLAND PARK ROAD (less than 1⁄2 mile)
* End at 13200 WOODLAND PARK ROAD

 '''If you plan to attend via Webinar:'''

You can attend through [[OWASPNoVA WebEx]]

==== Schedule ====
'''Next Meeting'''
Future speakers to include Gunnar Peterson, Dan Cornell, and more.

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owaspsa-track2.PNG|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. '''REGISTRATION IS OPEN!'''

Please send an email to [mailto:John.Steven@owasp.org John Steven] with your skill level with Statis Analysis tools, your motivation and '''the dates''' that you want to sign in for.
Students are required to bring their own laptop. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one.

===Student’s prerequisites===
All students will need to bring their own laptop

=== Past meetings ===
July 9th 6pm-9pm EST 
LOCATION: 13200 Woodland Park Road Herndon, VA 20171 
TOPIC: "Ounce's 02" 
SPEAKER(S): Dinis Cruz, OWASP, Ounce Labs. 
PANEL: TBD 
INSTRUCTIONS: RSVP through Stan Wisseman wisseman_stan@bah.com with “OWASP RSVP” in the subject. 

DESCRIPTION: So what is O2?

Well in my mind O2 is a combination of advanced tools (Technology) which are designed to be used on a particular way (Process) by knowledgeable Individuals (People)

Think about it as a Fighter Jet who is able to go very fast, has tons of controls, needs to be piloted by somebody who knows what they are doing and needs to have a purpose (i.e. mission).

Basically what I did with O2 was to automate the workflow that I have when I'm engaged on a source-code security review.

Now, here is the catch, this version is NOT for the faint-of-heart. I designed this to suit my needs, which although are the same as most other security consultants, have its own particularities :)

The whole model of O2 development is based around the concept of automating a security consultant’s brain, so I basically ensure that the main O2 Developer (Dinis Cruz) has a very good understanding of the feature requirements of the targeted Security Consultant (Dinis Cruz) :) . And this proved (even to my surprise) spectacularly productive, since suddenly I (i.e. the security consultant) didn't had to wait months for new features to be added to its toolkit. If there was something that needed to be added, it would just be added in days or hours.

* View the OWASP NoVA Chapter [http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York Calendar ]

* The next meeting is '''Thursday, July 9th, 2009.'''
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Knowledge ====

The Northern Virginia (NoVA) chapter is committed to compiling resources on interesting and valuable topic areas. We hope that this structure helps you access information pertinent to your tasks at hand as you move through a secure application development life cycle. Currently, our topic areas of focus include activities such as:

* Threat Modeling
* [[Code Review and Static Analysis with tools]]
* Penetration Testing and Dynamic Analysis tools
* Monitoring/Dynamic patching (WAFs)

Certain projects our members are involved in cross-cut these activities, providing value throughout. They include:

* ASVS

==== Contributors and Sponsors ====

'''Chapter Leader'''

* [mailto:John.Steven@owasp.org John Steven], with assistance from [mailto:paco@cigital.com Paco Hope]

'''Refreshment Sponsors'''

[[Image:Cigital_OWASP.GIF]]

'''Facility Sponsors'''

[[Image:Bah-bw.JPG|215px]]

__NOTOC__
<headertabs/>
<paypal>Northern Virginia</paypal>

== Past Meetings ==

===June 2009===
''Gary McGraw, Cigital Inc.'':''Building Security In Maturity Model'' 
Later, an interview:
''Jim Routh, formerly of DTCC'':''The Economic Advantages of a Resilient Supply Chain- Software Security
'' 

Gary McGraw talked about the experience he, Sammy Migues, and Brian Chess gained conducting a survey of some of America's top Software Security groups. Study results are available under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Share Alike license] at [http://www.bsi-mm.com www.bsi-mm.com]. Gary described the common structural elements and activities of successful software security programs, present the maturity model that resulted from survey data, and discuss lessons learned from listening to those leading these groups.

Jim Routh gave an incredibly insightful interview regarding his own experiences crafting their security group.

Download presentation notes at: [http://www.owasp.org/images/0/03/JMR-Economics_of_Security_Goups.ppt The Economic Advantages of a Resilient Supply Chain- Software Security]

===May 2009 ===
''Eric Dalci, Cigital Inc.'':''Introduction to Static Analysis'' 
Later, a panel:
<UL>
<LI>Steven Lavenhar, Booz Allen Hamilton;
<LI>Eric Dalci, Cigital Inc.
</UL>
Panel moderated by John Steven
 

This session is an introductory to Static Analysis. This session presents the different types of analysis used by today's Static Analysis tools. Examples of direct application to find vulnerabilities will be shown (ex: Data Flow Analysis, Semantic, Control Flow, etc.). Current limitations of Static Analysis will also be exposed. This session is tool agnostic, but will cover the approach taken by various leading commercial (as well as open-source) tools.

Download: [http://www.owasp.org/images/e/ea/OWASP_Virginia_Edalci_May09.pdf Intro to Static Analysis]

===April 2009 ===
''Jeremiah Grossman, Whitehat Security'': '''Top 10 Web Hacking Techniques 2008''' 
Jeremiah Spoke on (what he and colleagues determined were the) top ten web hacking techniques of 2008. This talk was a preview of his RSA '09 talk. 

Download http://www.whitehatsec.com/home/assets/presentations/09PPT/PPT_OWASPNoVA04082008.pdf

Later,
<UL>
<LI>Nate Miller, Stratum Security;
<LI>Jeremiah Grossman, Whitehat Security;
<LI>Tom Brennan, Whitehat Security; and
<LI>Wade Woolwine, AOL
</UL>
served as penetration testing panels answering questions posed and moderated by Ken Van Wyk.

=== February 2009 ===

''Ryan C. Barnett, Breach Security'': '''Patching Challenge: Securing WebGoat with ModSecurity'''

Identification of web application vulnerabilities is only half the battle with remediation efforts as the other. Let's face the facts, there are many real world business scenarios where it is not possible to update web application code in either a timely manner or at all. This is where the tactical use-case of implementing a web application firewall to address identified issues proves its worth.

This talk will provide an overview of the recommended practices for utilizing a web application firewall for virtual patching. After discussing the framework to use, we will then present a very interesting OWASP Summer of Code Project where the challenge was to attempt to mitigate as many of the OWASP WebGoat vulnerabilities as possible using the open source ModSecurity web application firewall. During the talk, we will discuss both WebGoat and ModSecurity and provide in-depth walk-throughs of some of the complex fixes. Examples will include addressing not only attacks but the underlying vulnerabilities, using data persistence for multiple-step processes, content injection and even examples of the new LUA programming language API. The goal of this talk is to both highlight cutting edge mitigation options using a web application firewall and to show how it can effectively be used by security consultants who traditionally could only offer source code fixes.

Ryan C. Barnett is the Director of Application Security Research at Breach Security and leads Breach Security Labs. He is also a Faculty Member for the SANS Institute, Team Lead for the Center for Internet Security Apache Benchmark Project and a Member of the Web Application Security Consortium where he leads the Distributed Open Proxy Honeypot Project. Mr. Barnett has also authored a web security book for Addison/Wesley Publishing entitled "Preventing Web Attacks with Apache."

(This talk is a preview of Ryan's talk at Blackhat Federal the following week - see https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Barnett )

Download [[Media:Virtual_Patching_Ryan_Barnett_Blackhat_Federal_09.zip| WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity]]

''John Steven, Cigital'': '''Moving Beyond Top N Lists'''

Download [[Media:Moving_Beyond_Top_N_Lists.ppt.zip| Moving Beyond Top N Lists]]

Cigital published an article: The Top 11 Reasons Why Top 10 (or 25) Lists Don’t Work. Yet, these lists are a staple of conference abstracts, industry best practice lists, and the like. Are they good or bad? We’ll explore how to get beyond the Top 10 (or 25) list in making your software security effort real.

John is Senior Director, Advanced Technology Consulting at Cigital. His experience includes research in static code analysis and hands-on architecture and implementation of high-performance, scalable Java EE systems. John has provided security consulting services to a broad variety of commercial clients including two of the largest trading platforms in the world and has advised America's largest internet provider in the Midwest on security and forensics. John led the development of Cigital's architectural analysis methodology and its approach to deploying enterprise software security frameworks. He has demonstrated success in building Cigital's intellectual property for providing cutting-edge security. He brings this experience and a track record of effective strategic innovation to clients seeking to change, whether to adopt more cutting-edge approaches, or to solidify ROI. John currently chairs the SD Best Practices security track and co-edits the building security in department of IEEE's Security and Privacy magazine. John has served on numerous conference panels regarding software security, wireless security and Java EE system development. He holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

=== January 2009 ===

To kick off 2009, our January meeting featured a discussion of the relationship between application security and CMMI, and an overview of the OWASP ASVS project.

''Michele Moss, Booz Allen Hamilton'': '''Evolutions In The Relationship Between Application Security And The CMMI'''

Addressing new and complex threats and IT security challenges requires repeatable, reliable, rapid, and cost effective solutions. To implement these solutions, organizations have begun to align their security improvement efforts with their system and software development practices. During a “Birds of a Feather” at the March 2007 SEPG, a group of industry representatives initiated an effort which led to the definition of assurance practices that can be applied in the context of the CMMI. This presentation will provide an understanding how applying the assurance practices in the context of security contribute to the overall increased quality of products and services, illustrate how the a focus on assurance in the context of CMMI practices is related to application security practices, and present and approach to evaluate and improve the repeatability and reliability of assurance practices.

Michele Moss, CISSP, is a security engineer with more than 12 years of experience in process improvement. She specializes in integrating assurance processes and practices into project lifecycles. Michele is the Co-Chair of the DHS Software Assurance Working Group on Processes & Practices. She has assisted numerous organizations with maturing their information technology, information assurance, project management, and support practices through the use of the capability maturity models including the CMMI, and the SSE-CMM. She is one of the key contributors in an effort to apply an assurance focus to CMMI.

Slides available: [[http://www.epsteinmania.com/owasp/Moss-AppSecurityAndCMMI.pdf]]

''Mike Boberski, Booz Allen Hamilton'': '''About OWASP ASVS'''

The primary aim of the OWASP ASVS Project is to normalize the range
of coverage and level of rigor available in the market when it comes to
performing application-level security verification. The goal is to
create a set of commercially-workable open standards that are tailored
to specific web-based technologies.

Mike Boberski works at Booz Allen Hamilton. He has a background in
application security and the use of cryptography by applications. He is
experienced in trusted product evaluation, security-related software
development and integration, and cryptomodule testing. For OWASP, he is
the project lead and a co-author of the OWASP Application Security
Verification Standard, the first OWASP standard.

Slides available: [[https://www.owasp.org/images/5/52/About_OWASP_ASVS_Web_Edition.ppt]]

=== November 2008 ===
For our November 2008 meeting, we had two great presentations on software assurance and security testing.

''Nadya Bartol, Booz Allen Hamilton'': '''Framework for Software Assurance'''

Nadya's presentation will provide an update on the Software Assurance
Forum efforts to establish a comprehensive framework for software
assurance (SwA) and security measurement. The Framework addresses
measuring achievement of SwA goals and objectives within the context of
individual projects, programs, or enterprises. It targets a variety of
audiences including executives, developers, vendors, suppliers, and
buyers. The Framework leverages existing measurement methodologies,
including Practical Software and System Measurement (PSM); CMMI Goal,
Question, Indicator, Measure (GQ(I)M); NIST SP 800-55 Rev1; and ISO/IEC
27004 and identifies commonalities among the methodologies to help
organizations integrate SwA measurement in their overall measurement
efforts cost-effectively and as seamlessly as possible, rather than
establish a standalone SwA measurement effort within an organization.
The presentation will provide an update on the SwA Forum Measurement
Working Group work, present the current version of the Framework and underlying measures
development and implementation processes, and propose example SwA
measures applicable to a variety of SwA stakeholders. The presentation
will update the group on the latest NIST and ISO standards on
information security measurement that are being integrated into the
Framework as the standards are being developed.

Slides available: [[http://www.epsteinmania.com/owasp/Bartol-MeasurementForOWASP11-13-08.pdf]]

''Paco Hope, Cigital'': '''The Web Security Testing Cookbook'''

The Web Security Testing Cookbook (O'Reilly & Associates, October 2008)
gives developers and testers the tools they need to make security
testing a regular part of their development lifecycle. Its recipe style
approach covers manual, exploratory testing as well automated techniques
that you can make part of your unit tests or regression cycle. The
recipes cover the basics like observing messages between clients and
servers, to multi-phase tests that script the login and execution of web
application features. This book complements many of the security texts
in the market that tell you what a vulnerability is, but not how to
systematically test it day in and day out. Leverage the recipes in this
book to add significant security coverage to your testing without adding
significant time and cost to your effort.

Congratulations to Tim Bond who won an autographed copy of Paco's book.
Get your copy here [[http://www.amazon.com/Security-Testing-Cookbook-Paco-Hope/dp/0596514832]]

Slides available: [[http://www.epsteinmania.com/owasp/PacoHope-WebSecCookbook.pdf]]

=== October 2008 ===
For our October 2008 meeting, we had two fascinating talks relating to forensics.

''Dave Merkel, Mandiant'': '''Enterprise Grade Incident Management - Responding to Persistent Threats'''

Dave Merkel is Vice President of Products at Mandiant, a leading provider of information security services, education and products. Mr. Merkel has worked in the information security and incident response industry for over 10 years. His background includes service as a federal agent in the US Air Force and over 7 years experience directing security operations at America Online. He currently oversees the product business at Mandiant, and is in charge of building Mandiant Intelligent Response - an enterprise incident response solution. But no, he won't be selling you anything today.

Slides available: [[http://www.epsteinmania.com/owasp/Mandiant-EnterpriseIRandAPTpresentation.pdf]]

''Inno Eroraha, NetSecurity'': '''[Responding to the Digital Crime Scene: Gathering Volatile Data'''

Inno Eroraha is the founder and chief strategist of NetSecurity Corporation, a company that provides digital forensics, hands-on security consulting, and Hands-on How-To® training solutions that are high-quality, timely, and customer-focused. In this role, Mr. Eroraha helps clients plan, formulate, and execute the best security and forensics strategy that aligns with their business goals and priorities. He has consulted with Fortune 500 companies, IRS, DHS, VA, DoD, and other entities.

Slides available: [[http://www.epsteinmania.com/owasp/NetSecurity-RespondingToTheDigitalCrimeScene-GatheringVolatileData-TechnoForensics-102908.pdf] ]

==Knowledge==
On the [[Knowledge]] page, you'll find links to this chapter's contributions organized by topic area.

[[Category:Virginia]]
[[Category:Washington, DC]]

Virginia

2009-07-15T18:32:36Z

Edalci: /* Registration */

==== About ====
[[Image:Owasp-nova.JPG|275px|right]]The '''OWASP Washington VA Local Chapter''' meetings are FREE and OPEN to anyone interested in learning more about application security. We encourage individuals to provide knowledge transfer via hands-on training and presentations of specific OWASP projects and research topics and sharing SDLC knowledge.

We the encourage vendor-agnostic presentations to utilize the OWASP Powerpoint template when applicable and individual volunteerism to enable perpetual growth. As a 501(3)c non-profit association donations of meeting space or refreshments sponsorship is encouraged, simply contact the local chapter leaders listed on this page to discuss. Prior to participating with OWASP please review the Chapter Rules.

The original DC Chapter was founded in June 2004 by [mailto:jeff.williams@owasp.org Jeff Williams] and has had members from Virginia to Delaware. In April 2005 a new chapter, OWASP Washington VA Local Chapter, was formed and the DC Chapter was renamed to DC-Maryland. The two are sister chapters and include common members and shared discourse. The chapters meet in opposite halves of the month to facilitate this relationship.

{{Chapter Template|chaptername=Virginia|extra=The chapter leader is [mailto:John.Steven@owasp.org John Steven]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-CHANGEME|emailarchives=http://lists.owasp.org/pipermail/owasp-CHANGEME}}
* [http://lists.owasp.org/mailman/listinfo/owasp-wash_dc_va Click here to join local chapter mailing list]
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Locations ====
'''If you plan to attend in person:'''

Directions to Booz Allen's One Dulles facility:

13200 Woodland Park Road
Herndon, VA 20171

From Tyson's Corner:

* Take LEESBURG PIKE / VA-7 WEST
* Merge onto VA-267 WEST / DULLES TOLL ROAD (Portions Toll)
* Take the VA-657 Exit (Exit Number 10 towards Herndon / Chantilly)
* Take the ramp toward CHANTILLY
* Turn Left onto CENTERVILLE ROAD (at end of ramp)
* Turn Left onto WOODLAND PARK ROAD (less than 1⁄2 mile)
* End at 13200 WOODLAND PARK ROAD

 '''If you plan to attend via Webinar:'''

You can attend through [[OWASPNoVA WebEx]]

==== Schedule ====
'''Next Meeting'''
Future speakers to include Gunnar Peterson, Dan Cornell, and more.

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owaspsa-track2.PNG|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. '''REGISTRATION IS OPEN!'''

Please send an email to [mailto:John.Steven@owasp.org John Steven] with your skill level with Statis Analysis tools, your motivation and '''the dates''' that you want to sign in for.
Students are required to bring their own laptop. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one.

===Student’s prerequisites===
All students will need to bring their own laptop

July 9th 6pm-9pm EST 
LOCATION: 13200 Woodland Park Road Herndon, VA 20171 
TOPIC: "Ounce's 02" 
SPEAKER(S): Dinis Cruz, OWASP, Ounce Labs. 
PANEL: TBD 
INSTRUCTIONS: RSVP through Stan Wisseman wisseman_stan@bah.com with “OWASP RSVP” in the subject. 

DESCRIPTION: So what is O2?

Well in my mind O2 is a combination of advanced tools (Technology) which are designed to be used on a particular way (Process) by knowledgeable Individuals (People)

Think about it as a Fighter Jet who is able to go very fast, has tons of controls, needs to be piloted by somebody who knows what they are doing and needs to have a purpose (i.e. mission).

Basically what I did with O2 was to automate the workflow that I have when I'm engaged on a source-code security review.

Now, here is the catch, this version is NOT for the faint-of-heart. I designed this to suit my needs, which although are the same as most other security consultants, have its own particularities :)

The whole model of O2 development is based around the concept of automating a security consultant’s brain, so I basically ensure that the main O2 Developer (Dinis Cruz) has a very good understanding of the feature requirements of the targeted Security Consultant (Dinis Cruz) :) . And this proved (even to my surprise) spectacularly productive, since suddenly I (i.e. the security consultant) didn't had to wait months for new features to be added to its toolkit. If there was something that needed to be added, it would just be added in days or hours.

* View the OWASP NoVA Chapter [http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York Calendar ]

* The next meeting is '''Thursday, July 9th, 2009.'''
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Knowledge ====

The Northern Virginia (NoVA) chapter is committed to compiling resources on interesting and valuable topic areas. We hope that this structure helps you access information pertinent to your tasks at hand as you move through a secure application development life cycle. Currently, our topic areas of focus include activities such as:

* Threat Modeling
* [[Code Review and Static Analysis with tools]]
* Penetration Testing and Dynamic Analysis tools
* Monitoring/Dynamic patching (WAFs)

Certain projects our members are involved in cross-cut these activities, providing value throughout. They include:

* ASVS

==== Contributors and Sponsors ====

'''Chapter Leader'''

* [mailto:John.Steven@owasp.org John Steven], with assistance from [mailto:paco@cigital.com Paco Hope]

'''Refreshment Sponsors'''

[[Image:Cigital_OWASP.GIF]]

'''Facility Sponsors'''

[[Image:Bah-bw.JPG|215px]]

__NOTOC__
<headertabs/>
<paypal>Northern Virginia</paypal>

== Past Meetings ==

===June 2009===
''Gary McGraw, Cigital Inc.'':''Building Security In Maturity Model'' 
Later, an interview:
''Jim Routh, formerly of DTCC'':''The Economic Advantages of a Resilient Supply Chain- Software Security
'' 

Gary McGraw talked about the experience he, Sammy Migues, and Brian Chess gained conducting a survey of some of America's top Software Security groups. Study results are available under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Share Alike license] at [http://www.bsi-mm.com www.bsi-mm.com]. Gary described the common structural elements and activities of successful software security programs, present the maturity model that resulted from survey data, and discuss lessons learned from listening to those leading these groups.

Jim Routh gave an incredibly insightful interview regarding his own experiences crafting their security group.

Download presentation notes at: [http://www.owasp.org/images/0/03/JMR-Economics_of_Security_Goups.ppt The Economic Advantages of a Resilient Supply Chain- Software Security]

===May 2009 ===
''Eric Dalci, Cigital Inc.'':''Introduction to Static Analysis'' 
Later, a panel:
<UL>
<LI>Steven Lavenhar, Booz Allen Hamilton;
<LI>Eric Dalci, Cigital Inc.
</UL>
Panel moderated by John Steven
 

This session is an introductory to Static Analysis. This session presents the different types of analysis used by today's Static Analysis tools. Examples of direct application to find vulnerabilities will be shown (ex: Data Flow Analysis, Semantic, Control Flow, etc.). Current limitations of Static Analysis will also be exposed. This session is tool agnostic, but will cover the approach taken by various leading commercial (as well as open-source) tools.

Download: [http://www.owasp.org/images/e/ea/OWASP_Virginia_Edalci_May09.pdf Intro to Static Analysis]

===April 2009 ===
''Jeremiah Grossman, Whitehat Security'': '''Top 10 Web Hacking Techniques 2008''' 
Jeremiah Spoke on (what he and colleagues determined were the) top ten web hacking techniques of 2008. This talk was a preview of his RSA '09 talk. 

Download http://www.whitehatsec.com/home/assets/presentations/09PPT/PPT_OWASPNoVA04082008.pdf

Later,
<UL>
<LI>Nate Miller, Stratum Security;
<LI>Jeremiah Grossman, Whitehat Security;
<LI>Tom Brennan, Whitehat Security; and
<LI>Wade Woolwine, AOL
</UL>
served as penetration testing panels answering questions posed and moderated by Ken Van Wyk.

=== February 2009 ===

''Ryan C. Barnett, Breach Security'': '''Patching Challenge: Securing WebGoat with ModSecurity'''

Identification of web application vulnerabilities is only half the battle with remediation efforts as the other. Let's face the facts, there are many real world business scenarios where it is not possible to update web application code in either a timely manner or at all. This is where the tactical use-case of implementing a web application firewall to address identified issues proves its worth.

This talk will provide an overview of the recommended practices for utilizing a web application firewall for virtual patching. After discussing the framework to use, we will then present a very interesting OWASP Summer of Code Project where the challenge was to attempt to mitigate as many of the OWASP WebGoat vulnerabilities as possible using the open source ModSecurity web application firewall. During the talk, we will discuss both WebGoat and ModSecurity and provide in-depth walk-throughs of some of the complex fixes. Examples will include addressing not only attacks but the underlying vulnerabilities, using data persistence for multiple-step processes, content injection and even examples of the new LUA programming language API. The goal of this talk is to both highlight cutting edge mitigation options using a web application firewall and to show how it can effectively be used by security consultants who traditionally could only offer source code fixes.

Ryan C. Barnett is the Director of Application Security Research at Breach Security and leads Breach Security Labs. He is also a Faculty Member for the SANS Institute, Team Lead for the Center for Internet Security Apache Benchmark Project and a Member of the Web Application Security Consortium where he leads the Distributed Open Proxy Honeypot Project. Mr. Barnett has also authored a web security book for Addison/Wesley Publishing entitled "Preventing Web Attacks with Apache."

(This talk is a preview of Ryan's talk at Blackhat Federal the following week - see https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Barnett )

Download [[Media:Virtual_Patching_Ryan_Barnett_Blackhat_Federal_09.zip| WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity]]

''John Steven, Cigital'': '''Moving Beyond Top N Lists'''

Download [[Media:Moving_Beyond_Top_N_Lists.ppt.zip| Moving Beyond Top N Lists]]

Cigital published an article: The Top 11 Reasons Why Top 10 (or 25) Lists Don’t Work. Yet, these lists are a staple of conference abstracts, industry best practice lists, and the like. Are they good or bad? We’ll explore how to get beyond the Top 10 (or 25) list in making your software security effort real.

John is Senior Director, Advanced Technology Consulting at Cigital. His experience includes research in static code analysis and hands-on architecture and implementation of high-performance, scalable Java EE systems. John has provided security consulting services to a broad variety of commercial clients including two of the largest trading platforms in the world and has advised America's largest internet provider in the Midwest on security and forensics. John led the development of Cigital's architectural analysis methodology and its approach to deploying enterprise software security frameworks. He has demonstrated success in building Cigital's intellectual property for providing cutting-edge security. He brings this experience and a track record of effective strategic innovation to clients seeking to change, whether to adopt more cutting-edge approaches, or to solidify ROI. John currently chairs the SD Best Practices security track and co-edits the building security in department of IEEE's Security and Privacy magazine. John has served on numerous conference panels regarding software security, wireless security and Java EE system development. He holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

=== January 2009 ===

To kick off 2009, our January meeting featured a discussion of the relationship between application security and CMMI, and an overview of the OWASP ASVS project.

''Michele Moss, Booz Allen Hamilton'': '''Evolutions In The Relationship Between Application Security And The CMMI'''

Addressing new and complex threats and IT security challenges requires repeatable, reliable, rapid, and cost effective solutions. To implement these solutions, organizations have begun to align their security improvement efforts with their system and software development practices. During a “Birds of a Feather” at the March 2007 SEPG, a group of industry representatives initiated an effort which led to the definition of assurance practices that can be applied in the context of the CMMI. This presentation will provide an understanding how applying the assurance practices in the context of security contribute to the overall increased quality of products and services, illustrate how the a focus on assurance in the context of CMMI practices is related to application security practices, and present and approach to evaluate and improve the repeatability and reliability of assurance practices.

Michele Moss, CISSP, is a security engineer with more than 12 years of experience in process improvement. She specializes in integrating assurance processes and practices into project lifecycles. Michele is the Co-Chair of the DHS Software Assurance Working Group on Processes & Practices. She has assisted numerous organizations with maturing their information technology, information assurance, project management, and support practices through the use of the capability maturity models including the CMMI, and the SSE-CMM. She is one of the key contributors in an effort to apply an assurance focus to CMMI.

Slides available: [[http://www.epsteinmania.com/owasp/Moss-AppSecurityAndCMMI.pdf]]

''Mike Boberski, Booz Allen Hamilton'': '''About OWASP ASVS'''

The primary aim of the OWASP ASVS Project is to normalize the range
of coverage and level of rigor available in the market when it comes to
performing application-level security verification. The goal is to
create a set of commercially-workable open standards that are tailored
to specific web-based technologies.

Mike Boberski works at Booz Allen Hamilton. He has a background in
application security and the use of cryptography by applications. He is
experienced in trusted product evaluation, security-related software
development and integration, and cryptomodule testing. For OWASP, he is
the project lead and a co-author of the OWASP Application Security
Verification Standard, the first OWASP standard.

Slides available: [[https://www.owasp.org/images/5/52/About_OWASP_ASVS_Web_Edition.ppt]]

=== November 2008 ===
For our November 2008 meeting, we had two great presentations on software assurance and security testing.

''Nadya Bartol, Booz Allen Hamilton'': '''Framework for Software Assurance'''

Nadya's presentation will provide an update on the Software Assurance
Forum efforts to establish a comprehensive framework for software
assurance (SwA) and security measurement. The Framework addresses
measuring achievement of SwA goals and objectives within the context of
individual projects, programs, or enterprises. It targets a variety of
audiences including executives, developers, vendors, suppliers, and
buyers. The Framework leverages existing measurement methodologies,
including Practical Software and System Measurement (PSM); CMMI Goal,
Question, Indicator, Measure (GQ(I)M); NIST SP 800-55 Rev1; and ISO/IEC
27004 and identifies commonalities among the methodologies to help
organizations integrate SwA measurement in their overall measurement
efforts cost-effectively and as seamlessly as possible, rather than
establish a standalone SwA measurement effort within an organization.
The presentation will provide an update on the SwA Forum Measurement
Working Group work, present the current version of the Framework and underlying measures
development and implementation processes, and propose example SwA
measures applicable to a variety of SwA stakeholders. The presentation
will update the group on the latest NIST and ISO standards on
information security measurement that are being integrated into the
Framework as the standards are being developed.

Slides available: [[http://www.epsteinmania.com/owasp/Bartol-MeasurementForOWASP11-13-08.pdf]]

''Paco Hope, Cigital'': '''The Web Security Testing Cookbook'''

The Web Security Testing Cookbook (O'Reilly & Associates, October 2008)
gives developers and testers the tools they need to make security
testing a regular part of their development lifecycle. Its recipe style
approach covers manual, exploratory testing as well automated techniques
that you can make part of your unit tests or regression cycle. The
recipes cover the basics like observing messages between clients and
servers, to multi-phase tests that script the login and execution of web
application features. This book complements many of the security texts
in the market that tell you what a vulnerability is, but not how to
systematically test it day in and day out. Leverage the recipes in this
book to add significant security coverage to your testing without adding
significant time and cost to your effort.

Congratulations to Tim Bond who won an autographed copy of Paco's book.
Get your copy here [[http://www.amazon.com/Security-Testing-Cookbook-Paco-Hope/dp/0596514832]]

Slides available: [[http://www.epsteinmania.com/owasp/PacoHope-WebSecCookbook.pdf]]

=== October 2008 ===
For our October 2008 meeting, we had two fascinating talks relating to forensics.

''Dave Merkel, Mandiant'': '''Enterprise Grade Incident Management - Responding to Persistent Threats'''

Dave Merkel is Vice President of Products at Mandiant, a leading provider of information security services, education and products. Mr. Merkel has worked in the information security and incident response industry for over 10 years. His background includes service as a federal agent in the US Air Force and over 7 years experience directing security operations at America Online. He currently oversees the product business at Mandiant, and is in charge of building Mandiant Intelligent Response - an enterprise incident response solution. But no, he won't be selling you anything today.

Slides available: [[http://www.epsteinmania.com/owasp/Mandiant-EnterpriseIRandAPTpresentation.pdf]]

''Inno Eroraha, NetSecurity'': '''[Responding to the Digital Crime Scene: Gathering Volatile Data'''

Inno Eroraha is the founder and chief strategist of NetSecurity Corporation, a company that provides digital forensics, hands-on security consulting, and Hands-on How-To® training solutions that are high-quality, timely, and customer-focused. In this role, Mr. Eroraha helps clients plan, formulate, and execute the best security and forensics strategy that aligns with their business goals and priorities. He has consulted with Fortune 500 companies, IRS, DHS, VA, DoD, and other entities.

Slides available: [[http://www.epsteinmania.com/owasp/NetSecurity-RespondingToTheDigitalCrimeScene-GatheringVolatileData-TechnoForensics-102908.pdf] ]

==Knowledge==
On the [[Knowledge]] page, you'll find links to this chapter's contributions organized by topic area.

[[Category:Virginia]]
[[Category:Washington, DC]]

Virginia

2009-07-15T18:30:55Z

Edalci:

==== About ====
[[Image:Owasp-nova.JPG|275px|right]]The '''OWASP Washington VA Local Chapter''' meetings are FREE and OPEN to anyone interested in learning more about application security. We encourage individuals to provide knowledge transfer via hands-on training and presentations of specific OWASP projects and research topics and sharing SDLC knowledge.

We the encourage vendor-agnostic presentations to utilize the OWASP Powerpoint template when applicable and individual volunteerism to enable perpetual growth. As a 501(3)c non-profit association donations of meeting space or refreshments sponsorship is encouraged, simply contact the local chapter leaders listed on this page to discuss. Prior to participating with OWASP please review the Chapter Rules.

The original DC Chapter was founded in June 2004 by [mailto:jeff.williams@owasp.org Jeff Williams] and has had members from Virginia to Delaware. In April 2005 a new chapter, OWASP Washington VA Local Chapter, was formed and the DC Chapter was renamed to DC-Maryland. The two are sister chapters and include common members and shared discourse. The chapters meet in opposite halves of the month to facilitate this relationship.

{{Chapter Template|chaptername=Virginia|extra=The chapter leader is [mailto:John.Steven@owasp.org John Steven]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-CHANGEME|emailarchives=http://lists.owasp.org/pipermail/owasp-CHANGEME}}
* [http://lists.owasp.org/mailman/listinfo/owasp-wash_dc_va Click here to join local chapter mailing list]
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Locations ====
'''If you plan to attend in person:'''

Directions to Booz Allen's One Dulles facility:

13200 Woodland Park Road
Herndon, VA 20171

From Tyson's Corner:

* Take LEESBURG PIKE / VA-7 WEST
* Merge onto VA-267 WEST / DULLES TOLL ROAD (Portions Toll)
* Take the VA-657 Exit (Exit Number 10 towards Herndon / Chantilly)
* Take the ramp toward CHANTILLY
* Turn Left onto CENTERVILLE ROAD (at end of ramp)
* Turn Left onto WOODLAND PARK ROAD (less than 1⁄2 mile)
* End at 13200 WOODLAND PARK ROAD

 '''If you plan to attend via Webinar:'''

You can attend through [[OWASPNoVA WebEx]]

==== Schedule ====
'''Next Meeting'''
Future speakers to include Gunnar Peterson, Dan Cornell, and more.

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owaspsa-track2.PNG|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. '''REGISTRATION IS OPEN!'''

Please send an email to [mailto:John.Steven@owasp.org John Steven] with your skills level with Statis Analysis and your motivation. Students are required to bring their own laptop. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one.

===Student’s prerequisites===
All students will need to bring their own laptop

July 9th 6pm-9pm EST 
LOCATION: 13200 Woodland Park Road Herndon, VA 20171 
TOPIC: "Ounce's 02" 
SPEAKER(S): Dinis Cruz, OWASP, Ounce Labs. 
PANEL: TBD 
INSTRUCTIONS: RSVP through Stan Wisseman wisseman_stan@bah.com with “OWASP RSVP” in the subject. 

DESCRIPTION: So what is O2?

Well in my mind O2 is a combination of advanced tools (Technology) which are designed to be used on a particular way (Process) by knowledgeable Individuals (People)

Think about it as a Fighter Jet who is able to go very fast, has tons of controls, needs to be piloted by somebody who knows what they are doing and needs to have a purpose (i.e. mission).

Basically what I did with O2 was to automate the workflow that I have when I'm engaged on a source-code security review.

Now, here is the catch, this version is NOT for the faint-of-heart. I designed this to suit my needs, which although are the same as most other security consultants, have its own particularities :)

The whole model of O2 development is based around the concept of automating a security consultant’s brain, so I basically ensure that the main O2 Developer (Dinis Cruz) has a very good understanding of the feature requirements of the targeted Security Consultant (Dinis Cruz) :) . And this proved (even to my surprise) spectacularly productive, since suddenly I (i.e. the security consultant) didn't had to wait months for new features to be added to its toolkit. If there was something that needed to be added, it would just be added in days or hours.

* View the OWASP NoVA Chapter [http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York Calendar ]

* The next meeting is '''Thursday, July 9th, 2009.'''
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Knowledge ====

The Northern Virginia (NoVA) chapter is committed to compiling resources on interesting and valuable topic areas. We hope that this structure helps you access information pertinent to your tasks at hand as you move through a secure application development life cycle. Currently, our topic areas of focus include activities such as:

* Threat Modeling
* [[Code Review and Static Analysis with tools]]
* Penetration Testing and Dynamic Analysis tools
* Monitoring/Dynamic patching (WAFs)

Certain projects our members are involved in cross-cut these activities, providing value throughout. They include:

* ASVS

==== Contributors and Sponsors ====

'''Chapter Leader'''

* [mailto:John.Steven@owasp.org John Steven], with assistance from [mailto:paco@cigital.com Paco Hope]

'''Refreshment Sponsors'''

[[Image:Cigital_OWASP.GIF]]

'''Facility Sponsors'''

[[Image:Bah-bw.JPG|215px]]

__NOTOC__
<headertabs/>
<paypal>Northern Virginia</paypal>

== Past Meetings ==

===June 2009===
''Gary McGraw, Cigital Inc.'':''Building Security In Maturity Model'' 
Later, an interview:
''Jim Routh, formerly of DTCC'':''The Economic Advantages of a Resilient Supply Chain- Software Security
'' 

Gary McGraw talked about the experience he, Sammy Migues, and Brian Chess gained conducting a survey of some of America's top Software Security groups. Study results are available under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Share Alike license] at [http://www.bsi-mm.com www.bsi-mm.com]. Gary described the common structural elements and activities of successful software security programs, present the maturity model that resulted from survey data, and discuss lessons learned from listening to those leading these groups.

Jim Routh gave an incredibly insightful interview regarding his own experiences crafting their security group.

Download presentation notes at: [http://www.owasp.org/images/0/03/JMR-Economics_of_Security_Goups.ppt The Economic Advantages of a Resilient Supply Chain- Software Security]

===May 2009 ===
''Eric Dalci, Cigital Inc.'':''Introduction to Static Analysis'' 
Later, a panel:
<UL>
<LI>Steven Lavenhar, Booz Allen Hamilton;
<LI>Eric Dalci, Cigital Inc.
</UL>
Panel moderated by John Steven
 

This session is an introductory to Static Analysis. This session presents the different types of analysis used by today's Static Analysis tools. Examples of direct application to find vulnerabilities will be shown (ex: Data Flow Analysis, Semantic, Control Flow, etc.). Current limitations of Static Analysis will also be exposed. This session is tool agnostic, but will cover the approach taken by various leading commercial (as well as open-source) tools.

Download: [http://www.owasp.org/images/e/ea/OWASP_Virginia_Edalci_May09.pdf Intro to Static Analysis]

===April 2009 ===
''Jeremiah Grossman, Whitehat Security'': '''Top 10 Web Hacking Techniques 2008''' 
Jeremiah Spoke on (what he and colleagues determined were the) top ten web hacking techniques of 2008. This talk was a preview of his RSA '09 talk. 

Download http://www.whitehatsec.com/home/assets/presentations/09PPT/PPT_OWASPNoVA04082008.pdf

Later,
<UL>
<LI>Nate Miller, Stratum Security;
<LI>Jeremiah Grossman, Whitehat Security;
<LI>Tom Brennan, Whitehat Security; and
<LI>Wade Woolwine, AOL
</UL>
served as penetration testing panels answering questions posed and moderated by Ken Van Wyk.

=== February 2009 ===

''Ryan C. Barnett, Breach Security'': '''Patching Challenge: Securing WebGoat with ModSecurity'''

Identification of web application vulnerabilities is only half the battle with remediation efforts as the other. Let's face the facts, there are many real world business scenarios where it is not possible to update web application code in either a timely manner or at all. This is where the tactical use-case of implementing a web application firewall to address identified issues proves its worth.

This talk will provide an overview of the recommended practices for utilizing a web application firewall for virtual patching. After discussing the framework to use, we will then present a very interesting OWASP Summer of Code Project where the challenge was to attempt to mitigate as many of the OWASP WebGoat vulnerabilities as possible using the open source ModSecurity web application firewall. During the talk, we will discuss both WebGoat and ModSecurity and provide in-depth walk-throughs of some of the complex fixes. Examples will include addressing not only attacks but the underlying vulnerabilities, using data persistence for multiple-step processes, content injection and even examples of the new LUA programming language API. The goal of this talk is to both highlight cutting edge mitigation options using a web application firewall and to show how it can effectively be used by security consultants who traditionally could only offer source code fixes.

Ryan C. Barnett is the Director of Application Security Research at Breach Security and leads Breach Security Labs. He is also a Faculty Member for the SANS Institute, Team Lead for the Center for Internet Security Apache Benchmark Project and a Member of the Web Application Security Consortium where he leads the Distributed Open Proxy Honeypot Project. Mr. Barnett has also authored a web security book for Addison/Wesley Publishing entitled "Preventing Web Attacks with Apache."

(This talk is a preview of Ryan's talk at Blackhat Federal the following week - see https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Barnett )

Download [[Media:Virtual_Patching_Ryan_Barnett_Blackhat_Federal_09.zip| WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity]]

''John Steven, Cigital'': '''Moving Beyond Top N Lists'''

Download [[Media:Moving_Beyond_Top_N_Lists.ppt.zip| Moving Beyond Top N Lists]]

Cigital published an article: The Top 11 Reasons Why Top 10 (or 25) Lists Don’t Work. Yet, these lists are a staple of conference abstracts, industry best practice lists, and the like. Are they good or bad? We’ll explore how to get beyond the Top 10 (or 25) list in making your software security effort real.

John is Senior Director, Advanced Technology Consulting at Cigital. His experience includes research in static code analysis and hands-on architecture and implementation of high-performance, scalable Java EE systems. John has provided security consulting services to a broad variety of commercial clients including two of the largest trading platforms in the world and has advised America's largest internet provider in the Midwest on security and forensics. John led the development of Cigital's architectural analysis methodology and its approach to deploying enterprise software security frameworks. He has demonstrated success in building Cigital's intellectual property for providing cutting-edge security. He brings this experience and a track record of effective strategic innovation to clients seeking to change, whether to adopt more cutting-edge approaches, or to solidify ROI. John currently chairs the SD Best Practices security track and co-edits the building security in department of IEEE's Security and Privacy magazine. John has served on numerous conference panels regarding software security, wireless security and Java EE system development. He holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

=== January 2009 ===

To kick off 2009, our January meeting featured a discussion of the relationship between application security and CMMI, and an overview of the OWASP ASVS project.

''Michele Moss, Booz Allen Hamilton'': '''Evolutions In The Relationship Between Application Security And The CMMI'''

Addressing new and complex threats and IT security challenges requires repeatable, reliable, rapid, and cost effective solutions. To implement these solutions, organizations have begun to align their security improvement efforts with their system and software development practices. During a “Birds of a Feather” at the March 2007 SEPG, a group of industry representatives initiated an effort which led to the definition of assurance practices that can be applied in the context of the CMMI. This presentation will provide an understanding how applying the assurance practices in the context of security contribute to the overall increased quality of products and services, illustrate how the a focus on assurance in the context of CMMI practices is related to application security practices, and present and approach to evaluate and improve the repeatability and reliability of assurance practices.

Michele Moss, CISSP, is a security engineer with more than 12 years of experience in process improvement. She specializes in integrating assurance processes and practices into project lifecycles. Michele is the Co-Chair of the DHS Software Assurance Working Group on Processes & Practices. She has assisted numerous organizations with maturing their information technology, information assurance, project management, and support practices through the use of the capability maturity models including the CMMI, and the SSE-CMM. She is one of the key contributors in an effort to apply an assurance focus to CMMI.

Slides available: [[http://www.epsteinmania.com/owasp/Moss-AppSecurityAndCMMI.pdf]]

''Mike Boberski, Booz Allen Hamilton'': '''About OWASP ASVS'''

The primary aim of the OWASP ASVS Project is to normalize the range
of coverage and level of rigor available in the market when it comes to
performing application-level security verification. The goal is to
create a set of commercially-workable open standards that are tailored
to specific web-based technologies.

Mike Boberski works at Booz Allen Hamilton. He has a background in
application security and the use of cryptography by applications. He is
experienced in trusted product evaluation, security-related software
development and integration, and cryptomodule testing. For OWASP, he is
the project lead and a co-author of the OWASP Application Security
Verification Standard, the first OWASP standard.

Slides available: [[https://www.owasp.org/images/5/52/About_OWASP_ASVS_Web_Edition.ppt]]

=== November 2008 ===
For our November 2008 meeting, we had two great presentations on software assurance and security testing.

''Nadya Bartol, Booz Allen Hamilton'': '''Framework for Software Assurance'''

Nadya's presentation will provide an update on the Software Assurance
Forum efforts to establish a comprehensive framework for software
assurance (SwA) and security measurement. The Framework addresses
measuring achievement of SwA goals and objectives within the context of
individual projects, programs, or enterprises. It targets a variety of
audiences including executives, developers, vendors, suppliers, and
buyers. The Framework leverages existing measurement methodologies,
including Practical Software and System Measurement (PSM); CMMI Goal,
Question, Indicator, Measure (GQ(I)M); NIST SP 800-55 Rev1; and ISO/IEC
27004 and identifies commonalities among the methodologies to help
organizations integrate SwA measurement in their overall measurement
efforts cost-effectively and as seamlessly as possible, rather than
establish a standalone SwA measurement effort within an organization.
The presentation will provide an update on the SwA Forum Measurement
Working Group work, present the current version of the Framework and underlying measures
development and implementation processes, and propose example SwA
measures applicable to a variety of SwA stakeholders. The presentation
will update the group on the latest NIST and ISO standards on
information security measurement that are being integrated into the
Framework as the standards are being developed.

Slides available: [[http://www.epsteinmania.com/owasp/Bartol-MeasurementForOWASP11-13-08.pdf]]

''Paco Hope, Cigital'': '''The Web Security Testing Cookbook'''

The Web Security Testing Cookbook (O'Reilly & Associates, October 2008)
gives developers and testers the tools they need to make security
testing a regular part of their development lifecycle. Its recipe style
approach covers manual, exploratory testing as well automated techniques
that you can make part of your unit tests or regression cycle. The
recipes cover the basics like observing messages between clients and
servers, to multi-phase tests that script the login and execution of web
application features. This book complements many of the security texts
in the market that tell you what a vulnerability is, but not how to
systematically test it day in and day out. Leverage the recipes in this
book to add significant security coverage to your testing without adding
significant time and cost to your effort.

Congratulations to Tim Bond who won an autographed copy of Paco's book.
Get your copy here [[http://www.amazon.com/Security-Testing-Cookbook-Paco-Hope/dp/0596514832]]

Slides available: [[http://www.epsteinmania.com/owasp/PacoHope-WebSecCookbook.pdf]]

=== October 2008 ===
For our October 2008 meeting, we had two fascinating talks relating to forensics.

''Dave Merkel, Mandiant'': '''Enterprise Grade Incident Management - Responding to Persistent Threats'''

Dave Merkel is Vice President of Products at Mandiant, a leading provider of information security services, education and products. Mr. Merkel has worked in the information security and incident response industry for over 10 years. His background includes service as a federal agent in the US Air Force and over 7 years experience directing security operations at America Online. He currently oversees the product business at Mandiant, and is in charge of building Mandiant Intelligent Response - an enterprise incident response solution. But no, he won't be selling you anything today.

Slides available: [[http://www.epsteinmania.com/owasp/Mandiant-EnterpriseIRandAPTpresentation.pdf]]

''Inno Eroraha, NetSecurity'': '''[Responding to the Digital Crime Scene: Gathering Volatile Data'''

Inno Eroraha is the founder and chief strategist of NetSecurity Corporation, a company that provides digital forensics, hands-on security consulting, and Hands-on How-To® training solutions that are high-quality, timely, and customer-focused. In this role, Mr. Eroraha helps clients plan, formulate, and execute the best security and forensics strategy that aligns with their business goals and priorities. He has consulted with Fortune 500 companies, IRS, DHS, VA, DoD, and other entities.

Slides available: [[http://www.epsteinmania.com/owasp/NetSecurity-RespondingToTheDigitalCrimeScene-GatheringVolatileData-TechnoForensics-102908.pdf] ]

==Knowledge==
On the [[Knowledge]] page, you'll find links to this chapter's contributions organized by topic area.

[[Category:Virginia]]
[[Category:Washington, DC]]

Virginia

2009-07-15T18:21:57Z

Edalci:

==== About ====
[[Image:Owasp-nova.JPG|275px|right]]The '''OWASP Washington VA Local Chapter''' meetings are FREE and OPEN to anyone interested in learning more about application security. We encourage individuals to provide knowledge transfer via hands-on training and presentations of specific OWASP projects and research topics and sharing SDLC knowledge.

We the encourage vendor-agnostic presentations to utilize the OWASP Powerpoint template when applicable and individual volunteerism to enable perpetual growth. As a 501(3)c non-profit association donations of meeting space or refreshments sponsorship is encouraged, simply contact the local chapter leaders listed on this page to discuss. Prior to participating with OWASP please review the Chapter Rules.

The original DC Chapter was founded in June 2004 by [mailto:jeff.williams@owasp.org Jeff Williams] and has had members from Virginia to Delaware. In April 2005 a new chapter, OWASP Washington VA Local Chapter, was formed and the DC Chapter was renamed to DC-Maryland. The two are sister chapters and include common members and shared discourse. The chapters meet in opposite halves of the month to facilitate this relationship.

{{Chapter Template|chaptername=Virginia|extra=The chapter leader is [mailto:John.Steven@owasp.org John Steven]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-CHANGEME|emailarchives=http://lists.owasp.org/pipermail/owasp-CHANGEME}}
* [http://lists.owasp.org/mailman/listinfo/owasp-wash_dc_va Click here to join local chapter mailing list]
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Locations ====
'''If you plan to attend in person:'''

Directions to Booz Allen's One Dulles facility:

13200 Woodland Park Road
Herndon, VA 20171

From Tyson's Corner:

* Take LEESBURG PIKE / VA-7 WEST
* Merge onto VA-267 WEST / DULLES TOLL ROAD (Portions Toll)
* Take the VA-657 Exit (Exit Number 10 towards Herndon / Chantilly)
* Take the ramp toward CHANTILLY
* Turn Left onto CENTERVILLE ROAD (at end of ramp)
* Turn Left onto WOODLAND PARK ROAD (less than 1⁄2 mile)
* End at 13200 WOODLAND PARK ROAD

 '''If you plan to attend via Webinar:'''

You can attend through [[OWASPNoVA WebEx]]

==== Schedule ====
'''Next Meeting'''
Future speakers to include Gunnar Peterson, Dan Cornell, and more.
July 9th 6pm-9pm EST 
LOCATION: 13200 Woodland Park Road Herndon, VA 20171 
TOPIC: "Ounce's 02" 
SPEAKER(S): Dinis Cruz, OWASP, Ounce Labs. 
PANEL: TBD 
INSTRUCTIONS: RSVP through Stan Wisseman wisseman_stan@bah.com with “OWASP RSVP” in the subject. 

DESCRIPTION: So what is O2?

Well in my mind O2 is a combination of advanced tools (Technology) which are designed to be used on a particular way (Process) by knowledgeable Individuals (People)

Think about it as a Fighter Jet who is able to go very fast, has tons of controls, needs to be piloted by somebody who knows what they are doing and needs to have a purpose (i.e. mission).

Basically what I did with O2 was to automate the workflow that I have when I'm engaged on a source-code security review.

Now, here is the catch, this version is NOT for the faint-of-heart. I designed this to suit my needs, which although are the same as most other security consultants, have its own particularities :)

The whole model of O2 development is based around the concept of automating a security consultant’s brain, so I basically ensure that the main O2 Developer (Dinis Cruz) has a very good understanding of the feature requirements of the targeted Security Consultant (Dinis Cruz) :) . And this proved (even to my surprise) spectacularly productive, since suddenly I (i.e. the security consultant) didn't had to wait months for new features to be added to its toolkit. If there was something that needed to be added, it would just be added in days or hours.

* View the OWASP NoVA Chapter [http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York Calendar ]

* The next meeting is '''Thursday, July 9th, 2009.'''
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Knowledge ====

The Northern Virginia (NoVA) chapter is committed to compiling resources on interesting and valuable topic areas. We hope that this structure helps you access information pertinent to your tasks at hand as you move through a secure application development life cycle. Currently, our topic areas of focus include activities such as:

* Threat Modeling
* [[Code Review and Static Analysis with tools]]
* Penetration Testing and Dynamic Analysis tools
* Monitoring/Dynamic patching (WAFs)

Certain projects our members are involved in cross-cut these activities, providing value throughout. They include:

* ASVS

==== Contributors and Sponsors ====

'''Chapter Leader'''

* [mailto:John.Steven@owasp.org John Steven], with assistance from [mailto:paco@cigital.com Paco Hope]

'''Refreshment Sponsors'''

[[Image:Cigital_OWASP.GIF]]

'''Facility Sponsors'''

[[Image:Bah-bw.JPG|215px]]

__NOTOC__
<headertabs/>
<paypal>Northern Virginia</paypal>

== Past Meetings ==

===June 2009===
''Gary McGraw, Cigital Inc.'':''Building Security In Maturity Model'' 
Later, an interview:
''Jim Routh, formerly of DTCC'':''The Economic Advantages of a Resilient Supply Chain- Software Security
'' 

Gary McGraw talked about the experience he, Sammy Migues, and Brian Chess gained conducting a survey of some of America's top Software Security groups. Study results are available under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Share Alike license] at [http://www.bsi-mm.com www.bsi-mm.com]. Gary described the common structural elements and activities of successful software security programs, present the maturity model that resulted from survey data, and discuss lessons learned from listening to those leading these groups.

Jim Routh gave an incredibly insightful interview regarding his own experiences crafting their security group.

Download presentation notes at: [http://www.owasp.org/images/0/03/JMR-Economics_of_Security_Goups.ppt The Economic Advantages of a Resilient Supply Chain- Software Security]

===May 2009 ===
''Eric Dalci, Cigital Inc.'':''Introduction to Static Analysis'' 
Later, a panel:
<UL>
<LI>Steven Lavenhar, Booz Allen Hamilton;
<LI>Eric Dalci, Cigital Inc.
</UL>
Panel moderated by John Steven
 

This session is an introductory to Static Analysis. This session presents the different types of analysis used by today's Static Analysis tools. Examples of direct application to find vulnerabilities will be shown (ex: Data Flow Analysis, Semantic, Control Flow, etc.). Current limitations of Static Analysis will also be exposed. This session is tool agnostic, but will cover the approach taken by various leading commercial (as well as open-source) tools.

Download: [http://www.owasp.org/images/e/ea/OWASP_Virginia_Edalci_May09.pdf Intro to Static Analysis]

===April 2009 ===
''Jeremiah Grossman, Whitehat Security'': '''Top 10 Web Hacking Techniques 2008''' 
Jeremiah Spoke on (what he and colleagues determined were the) top ten web hacking techniques of 2008. This talk was a preview of his RSA '09 talk. 

Download http://www.whitehatsec.com/home/assets/presentations/09PPT/PPT_OWASPNoVA04082008.pdf

Later,
<UL>
<LI>Nate Miller, Stratum Security;
<LI>Jeremiah Grossman, Whitehat Security;
<LI>Tom Brennan, Whitehat Security; and
<LI>Wade Woolwine, AOL
</UL>
served as penetration testing panels answering questions posed and moderated by Ken Van Wyk.

=== February 2009 ===

''Ryan C. Barnett, Breach Security'': '''Patching Challenge: Securing WebGoat with ModSecurity'''

Identification of web application vulnerabilities is only half the battle with remediation efforts as the other. Let's face the facts, there are many real world business scenarios where it is not possible to update web application code in either a timely manner or at all. This is where the tactical use-case of implementing a web application firewall to address identified issues proves its worth.

This talk will provide an overview of the recommended practices for utilizing a web application firewall for virtual patching. After discussing the framework to use, we will then present a very interesting OWASP Summer of Code Project where the challenge was to attempt to mitigate as many of the OWASP WebGoat vulnerabilities as possible using the open source ModSecurity web application firewall. During the talk, we will discuss both WebGoat and ModSecurity and provide in-depth walk-throughs of some of the complex fixes. Examples will include addressing not only attacks but the underlying vulnerabilities, using data persistence for multiple-step processes, content injection and even examples of the new LUA programming language API. The goal of this talk is to both highlight cutting edge mitigation options using a web application firewall and to show how it can effectively be used by security consultants who traditionally could only offer source code fixes.

Ryan C. Barnett is the Director of Application Security Research at Breach Security and leads Breach Security Labs. He is also a Faculty Member for the SANS Institute, Team Lead for the Center for Internet Security Apache Benchmark Project and a Member of the Web Application Security Consortium where he leads the Distributed Open Proxy Honeypot Project. Mr. Barnett has also authored a web security book for Addison/Wesley Publishing entitled "Preventing Web Attacks with Apache."

(This talk is a preview of Ryan's talk at Blackhat Federal the following week - see https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Barnett )

Download [[Media:Virtual_Patching_Ryan_Barnett_Blackhat_Federal_09.zip| WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity]]

''John Steven, Cigital'': '''Moving Beyond Top N Lists'''

Download [[Media:Moving_Beyond_Top_N_Lists.ppt.zip| Moving Beyond Top N Lists]]

Cigital published an article: The Top 11 Reasons Why Top 10 (or 25) Lists Don’t Work. Yet, these lists are a staple of conference abstracts, industry best practice lists, and the like. Are they good or bad? We’ll explore how to get beyond the Top 10 (or 25) list in making your software security effort real.

John is Senior Director, Advanced Technology Consulting at Cigital. His experience includes research in static code analysis and hands-on architecture and implementation of high-performance, scalable Java EE systems. John has provided security consulting services to a broad variety of commercial clients including two of the largest trading platforms in the world and has advised America's largest internet provider in the Midwest on security and forensics. John led the development of Cigital's architectural analysis methodology and its approach to deploying enterprise software security frameworks. He has demonstrated success in building Cigital's intellectual property for providing cutting-edge security. He brings this experience and a track record of effective strategic innovation to clients seeking to change, whether to adopt more cutting-edge approaches, or to solidify ROI. John currently chairs the SD Best Practices security track and co-edits the building security in department of IEEE's Security and Privacy magazine. John has served on numerous conference panels regarding software security, wireless security and Java EE system development. He holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

=== January 2009 ===

To kick off 2009, our January meeting featured a discussion of the relationship between application security and CMMI, and an overview of the OWASP ASVS project.

''Michele Moss, Booz Allen Hamilton'': '''Evolutions In The Relationship Between Application Security And The CMMI'''

Addressing new and complex threats and IT security challenges requires repeatable, reliable, rapid, and cost effective solutions. To implement these solutions, organizations have begun to align their security improvement efforts with their system and software development practices. During a “Birds of a Feather” at the March 2007 SEPG, a group of industry representatives initiated an effort which led to the definition of assurance practices that can be applied in the context of the CMMI. This presentation will provide an understanding how applying the assurance practices in the context of security contribute to the overall increased quality of products and services, illustrate how the a focus on assurance in the context of CMMI practices is related to application security practices, and present and approach to evaluate and improve the repeatability and reliability of assurance practices.

Michele Moss, CISSP, is a security engineer with more than 12 years of experience in process improvement. She specializes in integrating assurance processes and practices into project lifecycles. Michele is the Co-Chair of the DHS Software Assurance Working Group on Processes & Practices. She has assisted numerous organizations with maturing their information technology, information assurance, project management, and support practices through the use of the capability maturity models including the CMMI, and the SSE-CMM. She is one of the key contributors in an effort to apply an assurance focus to CMMI.

Slides available: [[http://www.epsteinmania.com/owasp/Moss-AppSecurityAndCMMI.pdf]]

''Mike Boberski, Booz Allen Hamilton'': '''About OWASP ASVS'''

The primary aim of the OWASP ASVS Project is to normalize the range
of coverage and level of rigor available in the market when it comes to
performing application-level security verification. The goal is to
create a set of commercially-workable open standards that are tailored
to specific web-based technologies.

Mike Boberski works at Booz Allen Hamilton. He has a background in
application security and the use of cryptography by applications. He is
experienced in trusted product evaluation, security-related software
development and integration, and cryptomodule testing. For OWASP, he is
the project lead and a co-author of the OWASP Application Security
Verification Standard, the first OWASP standard.

Slides available: [[https://www.owasp.org/images/5/52/About_OWASP_ASVS_Web_Edition.ppt]]

=== November 2008 ===
For our November 2008 meeting, we had two great presentations on software assurance and security testing.

''Nadya Bartol, Booz Allen Hamilton'': '''Framework for Software Assurance'''

Nadya's presentation will provide an update on the Software Assurance
Forum efforts to establish a comprehensive framework for software
assurance (SwA) and security measurement. The Framework addresses
measuring achievement of SwA goals and objectives within the context of
individual projects, programs, or enterprises. It targets a variety of
audiences including executives, developers, vendors, suppliers, and
buyers. The Framework leverages existing measurement methodologies,
including Practical Software and System Measurement (PSM); CMMI Goal,
Question, Indicator, Measure (GQ(I)M); NIST SP 800-55 Rev1; and ISO/IEC
27004 and identifies commonalities among the methodologies to help
organizations integrate SwA measurement in their overall measurement
efforts cost-effectively and as seamlessly as possible, rather than
establish a standalone SwA measurement effort within an organization.
The presentation will provide an update on the SwA Forum Measurement
Working Group work, present the current version of the Framework and underlying measures
development and implementation processes, and propose example SwA
measures applicable to a variety of SwA stakeholders. The presentation
will update the group on the latest NIST and ISO standards on
information security measurement that are being integrated into the
Framework as the standards are being developed.

Slides available: [[http://www.epsteinmania.com/owasp/Bartol-MeasurementForOWASP11-13-08.pdf]]

''Paco Hope, Cigital'': '''The Web Security Testing Cookbook'''

The Web Security Testing Cookbook (O'Reilly & Associates, October 2008)
gives developers and testers the tools they need to make security
testing a regular part of their development lifecycle. Its recipe style
approach covers manual, exploratory testing as well automated techniques
that you can make part of your unit tests or regression cycle. The
recipes cover the basics like observing messages between clients and
servers, to multi-phase tests that script the login and execution of web
application features. This book complements many of the security texts
in the market that tell you what a vulnerability is, but not how to
systematically test it day in and day out. Leverage the recipes in this
book to add significant security coverage to your testing without adding
significant time and cost to your effort.

Congratulations to Tim Bond who won an autographed copy of Paco's book.
Get your copy here [[http://www.amazon.com/Security-Testing-Cookbook-Paco-Hope/dp/0596514832]]

Slides available: [[http://www.epsteinmania.com/owasp/PacoHope-WebSecCookbook.pdf]]

=== October 2008 ===
For our October 2008 meeting, we had two fascinating talks relating to forensics.

''Dave Merkel, Mandiant'': '''Enterprise Grade Incident Management - Responding to Persistent Threats'''

Dave Merkel is Vice President of Products at Mandiant, a leading provider of information security services, education and products. Mr. Merkel has worked in the information security and incident response industry for over 10 years. His background includes service as a federal agent in the US Air Force and over 7 years experience directing security operations at America Online. He currently oversees the product business at Mandiant, and is in charge of building Mandiant Intelligent Response - an enterprise incident response solution. But no, he won't be selling you anything today.

Slides available: [[http://www.epsteinmania.com/owasp/Mandiant-EnterpriseIRandAPTpresentation.pdf]]

''Inno Eroraha, NetSecurity'': '''[Responding to the Digital Crime Scene: Gathering Volatile Data'''

Inno Eroraha is the founder and chief strategist of NetSecurity Corporation, a company that provides digital forensics, hands-on security consulting, and Hands-on How-To® training solutions that are high-quality, timely, and customer-focused. In this role, Mr. Eroraha helps clients plan, formulate, and execute the best security and forensics strategy that aligns with their business goals and priorities. He has consulted with Fortune 500 companies, IRS, DHS, VA, DoD, and other entities.

Slides available: [[http://www.epsteinmania.com/owasp/NetSecurity-RespondingToTheDigitalCrimeScene-GatheringVolatileData-TechnoForensics-102908.pdf] ]

==Knowledge==
On the [[Knowledge]] page, you'll find links to this chapter's contributions organized by topic area.

[[Category:Virginia]]
[[Category:Washington, DC]]

Virginia

2009-07-15T18:20:50Z

Edalci:

==== About ====
[[Image:Owasp-nova.JPG|275px|right]]The '''OWASP Washington VA Local Chapter''' meetings are FREE and OPEN to anyone interested in learning more about application security. We encourage individuals to provide knowledge transfer via hands-on training and presentations of specific OWASP projects and research topics and sharing SDLC knowledge.

We the encourage vendor-agnostic presentations to utilize the OWASP Powerpoint template when applicable and individual volunteerism to enable perpetual growth. As a 501(3)c non-profit association donations of meeting space or refreshments sponsorship is encouraged, simply contact the local chapter leaders listed on this page to discuss. Prior to participating with OWASP please review the Chapter Rules.

The original DC Chapter was founded in June 2004 by [mailto:jeff.williams@owasp.org Jeff Williams] and has had members from Virginia to Delaware. In April 2005 a new chapter, OWASP Washington VA Local Chapter, was formed and the DC Chapter was renamed to DC-Maryland. The two are sister chapters and include common members and shared discourse. The chapters meet in opposite halves of the month to facilitate this relationship.

{{Chapter Template|chaptername=Virginia|extra=The chapter leader is [mailto:John.Steven@owasp.org John Steven]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-CHANGEME|emailarchives=http://lists.owasp.org/pipermail/owasp-CHANGEME}}
* [http://lists.owasp.org/mailman/listinfo/owasp-wash_dc_va Click here to join local chapter mailing list]
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Locations ====
'''If you plan to attend in person:'''

Directions to Booz Allen's One Dulles facility:

13200 Woodland Park Road
Herndon, VA 20171

From Tyson's Corner:

* Take LEESBURG PIKE / VA-7 WEST
* Merge onto VA-267 WEST / DULLES TOLL ROAD (Portions Toll)
* Take the VA-657 Exit (Exit Number 10 towards Herndon / Chantilly)
* Take the ramp toward CHANTILLY
* Turn Left onto CENTERVILLE ROAD (at end of ramp)
* Turn Left onto WOODLAND PARK ROAD (less than 1⁄2 mile)
* End at 13200 WOODLAND PARK ROAD

 '''If you plan to attend via Webinar:'''

You can attend through [[OWASPNoVA WebEx]]

==== Schedule ====
'''Next Meeting'''
Future speakers to include Gunnar Peterson, Dan Cornell, and more.
July 9th 6pm-9pm EST 
LOCATION: 13200 Woodland Park Road Herndon, VA 20171 
TOPIC: "Ounce's 02" 
SPEAKER(S): Dinis Cruz, OWASP, Ounce Labs. 
PANEL: TBD 
INSTRUCTIONS: RSVP through Stan Wisseman wisseman_stan@bah.com with “OWASP RSVP” in the subject. 

DESCRIPTION: So what is O2?

Well in my mind O2 is a combination of advanced tools (Technology) which are designed to be used on a particular way (Process) by knowledgeable Individuals (People)

Think about it as a Fighter Jet who is able to go very fast, has tons of controls, needs to be piloted by somebody who knows what they are doing and needs to have a purpose (i.e. mission).

Basically what I did with O2 was to automate the workflow that I have when I'm engaged on a source-code security review.

Now, here is the catch, this version is NOT for the faint-of-heart. I designed this to suit my needs, which although are the same as most other security consultants, have its own particularities :)

The whole model of O2 development is based around the concept of automating a security consultant’s brain, so I basically ensure that the main O2 Developer (Dinis Cruz) has a very good understanding of the feature requirements of the targeted Security Consultant (Dinis Cruz) :) . And this proved (even to my surprise) spectacularly productive, since suddenly I (i.e. the security consultant) didn't had to wait months for new features to be added to its toolkit. If there was something that needed to be added, it would just be added in days or hours.

* View the OWASP NoVA Chapter [http://www.google.com/calendar/hosted/owasp.org/embed?src=owasp.org_1ht5oegk8kd0dtat5cko71e7dc%40group.calendar.google.com&ctz=America/New_York Calendar ]

* The next meeting is '''Thursday, July 9th, 2009.'''
* Add July 9th to my [https://www.google.com/calendar/hosted/owasp.org/event?action=TEMPLATE&tmeid=azV2NGU4Zjc0M2w1a3NxMG4zam84cXZyMmcgb3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGc&tmsrc=b3dhc3Aub3JnXzFodDVvZWdrOGtkMGR0YXQ1Y2tvNzFlN2RjQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20 Google Calendar], [https://cigital.webex.com/cigital/j.php?ED=124134682&UID=1012271922&ICS=MI&LD=1&RD=2&ST=1&SHA2=CWCN2pMk85HfkpUHyB/6CNfutu79JBWjL2LWsdybwEw= Exchange Calendar]

==== Knowledge ====

==== Contributors and Sponsors ====

'''Chapter Leader'''

* [mailto:John.Steven@owasp.org John Steven], with assistance from [mailto:paco@cigital.com Paco Hope]

'''Refreshment Sponsors'''

[[Image:Cigital_OWASP.GIF]]

'''Facility Sponsors'''

[[Image:Bah-bw.JPG|215px]]

__NOTOC__
<headertabs/>
<paypal>Northern Virginia</paypal>

== Past Meetings ==

===June 2009===
''Gary McGraw, Cigital Inc.'':''Building Security In Maturity Model'' 
Later, an interview:
''Jim Routh, formerly of DTCC'':''The Economic Advantages of a Resilient Supply Chain- Software Security
'' 

Gary McGraw talked about the experience he, Sammy Migues, and Brian Chess gained conducting a survey of some of America's top Software Security groups. Study results are available under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Share Alike license] at [http://www.bsi-mm.com www.bsi-mm.com]. Gary described the common structural elements and activities of successful software security programs, present the maturity model that resulted from survey data, and discuss lessons learned from listening to those leading these groups.

Jim Routh gave an incredibly insightful interview regarding his own experiences crafting their security group.

Download presentation notes at: [http://www.owasp.org/images/0/03/JMR-Economics_of_Security_Goups.ppt The Economic Advantages of a Resilient Supply Chain- Software Security]

===May 2009 ===
''Eric Dalci, Cigital Inc.'':''Introduction to Static Analysis'' 
Later, a panel:
<UL>
<LI>Steven Lavenhar, Booz Allen Hamilton;
<LI>Eric Dalci, Cigital Inc.
</UL>
Panel moderated by John Steven
 

This session is an introductory to Static Analysis. This session presents the different types of analysis used by today's Static Analysis tools. Examples of direct application to find vulnerabilities will be shown (ex: Data Flow Analysis, Semantic, Control Flow, etc.). Current limitations of Static Analysis will also be exposed. This session is tool agnostic, but will cover the approach taken by various leading commercial (as well as open-source) tools.

Download: [http://www.owasp.org/images/e/ea/OWASP_Virginia_Edalci_May09.pdf Intro to Static Analysis]

===April 2009 ===
''Jeremiah Grossman, Whitehat Security'': '''Top 10 Web Hacking Techniques 2008''' 
Jeremiah Spoke on (what he and colleagues determined were the) top ten web hacking techniques of 2008. This talk was a preview of his RSA '09 talk. 

Download http://www.whitehatsec.com/home/assets/presentations/09PPT/PPT_OWASPNoVA04082008.pdf

Later,
<UL>
<LI>Nate Miller, Stratum Security;
<LI>Jeremiah Grossman, Whitehat Security;
<LI>Tom Brennan, Whitehat Security; and
<LI>Wade Woolwine, AOL
</UL>
served as penetration testing panels answering questions posed and moderated by Ken Van Wyk.

=== February 2009 ===

''Ryan C. Barnett, Breach Security'': '''Patching Challenge: Securing WebGoat with ModSecurity'''

Identification of web application vulnerabilities is only half the battle with remediation efforts as the other. Let's face the facts, there are many real world business scenarios where it is not possible to update web application code in either a timely manner or at all. This is where the tactical use-case of implementing a web application firewall to address identified issues proves its worth.

This talk will provide an overview of the recommended practices for utilizing a web application firewall for virtual patching. After discussing the framework to use, we will then present a very interesting OWASP Summer of Code Project where the challenge was to attempt to mitigate as many of the OWASP WebGoat vulnerabilities as possible using the open source ModSecurity web application firewall. During the talk, we will discuss both WebGoat and ModSecurity and provide in-depth walk-throughs of some of the complex fixes. Examples will include addressing not only attacks but the underlying vulnerabilities, using data persistence for multiple-step processes, content injection and even examples of the new LUA programming language API. The goal of this talk is to both highlight cutting edge mitigation options using a web application firewall and to show how it can effectively be used by security consultants who traditionally could only offer source code fixes.

Ryan C. Barnett is the Director of Application Security Research at Breach Security and leads Breach Security Labs. He is also a Faculty Member for the SANS Institute, Team Lead for the Center for Internet Security Apache Benchmark Project and a Member of the Web Application Security Consortium where he leads the Distributed Open Proxy Honeypot Project. Mr. Barnett has also authored a web security book for Addison/Wesley Publishing entitled "Preventing Web Attacks with Apache."

(This talk is a preview of Ryan's talk at Blackhat Federal the following week - see https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Barnett )

Download [[Media:Virtual_Patching_Ryan_Barnett_Blackhat_Federal_09.zip| WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity]]

''John Steven, Cigital'': '''Moving Beyond Top N Lists'''

Download [[Media:Moving_Beyond_Top_N_Lists.ppt.zip| Moving Beyond Top N Lists]]

Cigital published an article: The Top 11 Reasons Why Top 10 (or 25) Lists Don’t Work. Yet, these lists are a staple of conference abstracts, industry best practice lists, and the like. Are they good or bad? We’ll explore how to get beyond the Top 10 (or 25) list in making your software security effort real.

John is Senior Director, Advanced Technology Consulting at Cigital. His experience includes research in static code analysis and hands-on architecture and implementation of high-performance, scalable Java EE systems. John has provided security consulting services to a broad variety of commercial clients including two of the largest trading platforms in the world and has advised America's largest internet provider in the Midwest on security and forensics. John led the development of Cigital's architectural analysis methodology and its approach to deploying enterprise software security frameworks. He has demonstrated success in building Cigital's intellectual property for providing cutting-edge security. He brings this experience and a track record of effective strategic innovation to clients seeking to change, whether to adopt more cutting-edge approaches, or to solidify ROI. John currently chairs the SD Best Practices security track and co-edits the building security in department of IEEE's Security and Privacy magazine. John has served on numerous conference panels regarding software security, wireless security and Java EE system development. He holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

=== January 2009 ===

To kick off 2009, our January meeting featured a discussion of the relationship between application security and CMMI, and an overview of the OWASP ASVS project.

''Michele Moss, Booz Allen Hamilton'': '''Evolutions In The Relationship Between Application Security And The CMMI'''

Addressing new and complex threats and IT security challenges requires repeatable, reliable, rapid, and cost effective solutions. To implement these solutions, organizations have begun to align their security improvement efforts with their system and software development practices. During a “Birds of a Feather” at the March 2007 SEPG, a group of industry representatives initiated an effort which led to the definition of assurance practices that can be applied in the context of the CMMI. This presentation will provide an understanding how applying the assurance practices in the context of security contribute to the overall increased quality of products and services, illustrate how the a focus on assurance in the context of CMMI practices is related to application security practices, and present and approach to evaluate and improve the repeatability and reliability of assurance practices.

Michele Moss, CISSP, is a security engineer with more than 12 years of experience in process improvement. She specializes in integrating assurance processes and practices into project lifecycles. Michele is the Co-Chair of the DHS Software Assurance Working Group on Processes & Practices. She has assisted numerous organizations with maturing their information technology, information assurance, project management, and support practices through the use of the capability maturity models including the CMMI, and the SSE-CMM. She is one of the key contributors in an effort to apply an assurance focus to CMMI.

Slides available: [[http://www.epsteinmania.com/owasp/Moss-AppSecurityAndCMMI.pdf]]

''Mike Boberski, Booz Allen Hamilton'': '''About OWASP ASVS'''

The primary aim of the OWASP ASVS Project is to normalize the range
of coverage and level of rigor available in the market when it comes to
performing application-level security verification. The goal is to
create a set of commercially-workable open standards that are tailored
to specific web-based technologies.

Mike Boberski works at Booz Allen Hamilton. He has a background in
application security and the use of cryptography by applications. He is
experienced in trusted product evaluation, security-related software
development and integration, and cryptomodule testing. For OWASP, he is
the project lead and a co-author of the OWASP Application Security
Verification Standard, the first OWASP standard.

Slides available: [[https://www.owasp.org/images/5/52/About_OWASP_ASVS_Web_Edition.ppt]]

=== November 2008 ===
For our November 2008 meeting, we had two great presentations on software assurance and security testing.

''Nadya Bartol, Booz Allen Hamilton'': '''Framework for Software Assurance'''

Nadya's presentation will provide an update on the Software Assurance
Forum efforts to establish a comprehensive framework for software
assurance (SwA) and security measurement. The Framework addresses
measuring achievement of SwA goals and objectives within the context of
individual projects, programs, or enterprises. It targets a variety of
audiences including executives, developers, vendors, suppliers, and
buyers. The Framework leverages existing measurement methodologies,
including Practical Software and System Measurement (PSM); CMMI Goal,
Question, Indicator, Measure (GQ(I)M); NIST SP 800-55 Rev1; and ISO/IEC
27004 and identifies commonalities among the methodologies to help
organizations integrate SwA measurement in their overall measurement
efforts cost-effectively and as seamlessly as possible, rather than
establish a standalone SwA measurement effort within an organization.
The presentation will provide an update on the SwA Forum Measurement
Working Group work, present the current version of the Framework and underlying measures
development and implementation processes, and propose example SwA
measures applicable to a variety of SwA stakeholders. The presentation
will update the group on the latest NIST and ISO standards on
information security measurement that are being integrated into the
Framework as the standards are being developed.

Slides available: [[http://www.epsteinmania.com/owasp/Bartol-MeasurementForOWASP11-13-08.pdf]]

''Paco Hope, Cigital'': '''The Web Security Testing Cookbook'''

The Web Security Testing Cookbook (O'Reilly & Associates, October 2008)
gives developers and testers the tools they need to make security
testing a regular part of their development lifecycle. Its recipe style
approach covers manual, exploratory testing as well automated techniques
that you can make part of your unit tests or regression cycle. The
recipes cover the basics like observing messages between clients and
servers, to multi-phase tests that script the login and execution of web
application features. This book complements many of the security texts
in the market that tell you what a vulnerability is, but not how to
systematically test it day in and day out. Leverage the recipes in this
book to add significant security coverage to your testing without adding
significant time and cost to your effort.

Congratulations to Tim Bond who won an autographed copy of Paco's book.
Get your copy here [[http://www.amazon.com/Security-Testing-Cookbook-Paco-Hope/dp/0596514832]]

Slides available: [[http://www.epsteinmania.com/owasp/PacoHope-WebSecCookbook.pdf]]

=== October 2008 ===
For our October 2008 meeting, we had two fascinating talks relating to forensics.

''Dave Merkel, Mandiant'': '''Enterprise Grade Incident Management - Responding to Persistent Threats'''

Dave Merkel is Vice President of Products at Mandiant, a leading provider of information security services, education and products. Mr. Merkel has worked in the information security and incident response industry for over 10 years. His background includes service as a federal agent in the US Air Force and over 7 years experience directing security operations at America Online. He currently oversees the product business at Mandiant, and is in charge of building Mandiant Intelligent Response - an enterprise incident response solution. But no, he won't be selling you anything today.

Slides available: [[http://www.epsteinmania.com/owasp/Mandiant-EnterpriseIRandAPTpresentation.pdf]]

''Inno Eroraha, NetSecurity'': '''[Responding to the Digital Crime Scene: Gathering Volatile Data'''

Inno Eroraha is the founder and chief strategist of NetSecurity Corporation, a company that provides digital forensics, hands-on security consulting, and Hands-on How-To® training solutions that are high-quality, timely, and customer-focused. In this role, Mr. Eroraha helps clients plan, formulate, and execute the best security and forensics strategy that aligns with their business goals and priorities. He has consulted with Fortune 500 companies, IRS, DHS, VA, DoD, and other entities.

Slides available: [[http://www.epsteinmania.com/owasp/NetSecurity-RespondingToTheDigitalCrimeScene-GatheringVolatileData-TechnoForensics-102908.pdf] ]

==Knowledge==
On the [[Knowledge]] page, you'll find links to this chapter's contributions organized by topic area.

[[Category:Virginia]]
[[Category:Washington, DC]]

Code Review and Static Analysis with tools

2009-07-15T18:19:03Z

Edalci: /* Static Analysis Curriculum */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:Owaspsa-track2.PNG|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric (Cigital), Bruce Mayhew (Ounce Lab) and Fortify (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat. Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison. We will have an open discussion session after each demo for students to ask questions to the vendors. Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

File:Owaspsa-track2.PNG

2009-07-15T18:18:29Z

Edalci:

Code Review and Static Analysis with tools

2009-05-28T07:59:58Z

Edalci: /* Session 2: Tool Assisted Code Reviews, July 30th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric (Cigital), Bruce Mayhew (Ounce Lab) and Fortify (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat. Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison. We will have an open discussion session after each demo for students to ask questions to the vendors. Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:58:30Z

Edalci:

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) Northern Virginia Chapter].

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.
*Download slide from [http://www.owasp.org/index.php/Virginia_(Northern_Virginia) here]

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric (Cigital), Bruce Mayhew (Ounce Lab) and Fortify (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:56:49Z

Edalci:

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric (Cigital)
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric (Cigital), Bruce Mayhew (Ounce Lab) and Fortify (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan (Cigital)
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi (Cigital)
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:55:54Z

Edalci: /* Session 2: Tool Assisted Code Reviews, July 30th 2009 */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric (Cigital), Bruce Mayhew (Ounce Lab) and Fortify (tbd)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:54:58Z

Edalci: /* Contacts */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this curriculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric, Bruce Mayhew (Ounce Lab) and Fortify (?)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:54:40Z

Edalci: /* Static Analysis Curriculum */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Contacts===
Questions related to this currculum should be sent to [mailto:John.Steven@owasp.org John Steven], who is the Northern Virginia chapter leader.

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric, Bruce Mayhew (Ounce Lab) and Fortify (?)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:52:05Z

Edalci:

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we may have a hard limit of 40 students.

Registration for sessions will be on first come and first served basis. Although we will give preference to people who show regularity and sign up for many sessions. Students will have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH pre-installed. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. Vendors are not allowed to interfere with other vendors’ session or demo. Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric, Bruce Mayhew (Ounce Lab) and Fortify (?)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:47:38Z

Edalci:

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Registration===
Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we will have to put a hard limit of 40 attendees.

Registration for sessions will be on first come and first served basis. But we will give preference to people who show regularity and sign up for many sessions. Students will also have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH preinstalled. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. This will mitigate side-by-side comparison of tool & findings. Vendors are not allowed to interfere with other vendors’ session or demo (Note: we have only 2 vendors: Fortify & Ounce Lab). Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric, Bruce Mayhew (Ounce Lab) and Fortify (?)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:46:57Z

Edalci:

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Logistics Preparation for hands on===

Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we will have to put a hard limit of 40 attendees.

===Registration===
Registration for sessions will be on first come and first served basis. But we will give preference to people who show regularity and sign up for many sessions. Students will also have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH preinstalled. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

===Student’s prerequisites===
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

===Tool license and Vendor IP===
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. This will mitigate side-by-side comparison of tool & findings. Vendors are not allowed to interfere with other vendors’ session or demo (Note: we have only 2 vendors: Fortify & Ounce Lab). Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

===Session 1: Intro To Static Analysis, May 7th 2009===
*Speaker: Dalci, Eric
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.

===Session 2: Tool Assisted Code Reviews, July 30th 2009===
*Speaker: Dalci, Eric, Bruce Mayhew (Ounce Lab) and Fortify (?)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

===Session 3: Customization Lab (Fortify), August 13th 2009===
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

===Session 4: Customization Lab (Ounce Lab), August 27th 2009===
*Speaker: Nabil Hannan
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

===Session 5: Tool Adoption and Deployment, September 17th 2009===
*Speaker: Shivang Trivedi
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:45:33Z

Edalci:

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Logistics Preparation for hands on===

Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we will have to put a hard limit of 40 attendees.

====Registration====
Registration for sessions will be on first come and first served basis. But we will give preference to people who show regularity and sign up for many sessions. Students will also have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH preinstalled. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

====Student’s prerequisites====
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

====Tool license and Vendor IP====
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. This will mitigate side-by-side comparison of tool & findings. Vendors are not allowed to interfere with other vendors’ session or demo (Note: we have only 2 vendors: Fortify & Ounce Lab). Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

====Session 1: Intro To Static Analysis, May 7th 2009====
*Speaker: Dalci, Eric
*Time: 2 hours + open discussion
*Classroom size: This is open.
This presentation will give a taste about what Static Analysis is.

====Session 2: Tool Assisted Code Reviews, July 30th 2009====
*Speaker: Dalci, Eric, Bruce Mayhew (Ounce Lab) and Fortify (?)
*Time: 2hours and half
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max

This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
* Fortify will demo its tool and scan Webgoat.
* Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
* We will have an open discussion session after each demo for students to ask questions to the vendors.
* Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.

====Session 3: Customization Lab (Fortify), August 13th 2009====
*Speaker: Mike Ware
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (2 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
* Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
* Semantic [use of a sensitive API [getEmployeeSSN()]
* Structural [all Struts ActionForms must extend custom base ActionForm]
* Configuration [properties: data.encryption = off]
* Control flow [always call securityCheck() before downloadFile()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Priority filters (e.g., P1, P2, etc)
** Isolating findings ("security controls" example)
* Authentication
* Authorization
* Data validation
* Session management
* Etc.

====Session 4: Customization Lab (Ounce Lab), August 27th 2009====
*Speaker: Nabil Hannan
*Time: 3 hours
*Logistics: Hands on setup as in logistic section.
*Location: TBD
*Classroom size: 30 stations, 40 attendees max
*Prerequisite: Attended session 2

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
* Approach to auditing scan results to determine true positives and false positives (.5 hours)
* Custom rules (1.5 hours)
** Hands on examples of different rule types applied to code that resembles real business logic
* Data flow sources and sinks [private data sent to custom logger]
* Data flow cleanse [cleanse: HTML encoding]
* Semantic [use of a sensitive API e.g. getEmployeeSSN()]
* Filtering (.5 hours)
** Prioritizing remediation efforts
* Understanding the Ounce Vulnerability Matrix
* Modifying finding severity/category
** Isolating findings (using "bundles")
* Input Validation
* SQL Injection
* Cross-Site Scripting
* Etc.
* Reporting (.5 hours)
** Demonstrate compliance with industry regulations and best practices
* OWASP Top 10
* PCI

====Session 5: Tool Adoption and Deployment, September 17th 2009====
*Speaker: Shivang Trivedi
*Time: 2 hours
*Location: TBD
*Prerequisite: Preferably attended session 2, but not mandatory
*Classroom size: Open

Shivang will talk about integration of a Static Analysis tool into the SDLC.
Agenda (draft):
* Tool Selection
** Flexible with Static Analysis and/or Penetration Testing
** Coverage
** Enterprise Support
** Quality of Security Findings
* Phases of Integration
** Pre-requisites
** Goals and Challenges
** Distribution of Roles and Responsibilities
** Considering LOE
* Model Per Activity
** Activity Flow
** Phase Transition
* Deployment Model
** Advantages
** Disadvantages
* Free and Handy Tools to
** Continuously Integrate
** Join activity flow
* Improvements and Lessons Learned
** Effective use of tool’s capabilities
** Expanding Coverage
** Analysis Techniques
** Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

File:OWASP roadmap.png

2009-05-28T07:38:31Z

Edalci: uploaded a new version of "Image:OWASP roadmap.png"

Code Review and Static Analysis with tools

2009-05-28T07:38:08Z

Edalci: /* Static Analysis Curriculum */

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

The following is the agenda of the OWASP Static Analysis track roadmap for the Northern Virginia Chapter.

[[Image:OWASP roadmap.png|OWASP Static Analysis Roadmap - Northern Virginia Chapter 2009]]

===Logistics Preparation for hands on===

Classroom’s size estimate for hands on: 30 stations max. Physical number of students can be larger as people may want to pair up. But we will have to put a hard limit of 40 attendees.

====Registration====
Registration for sessions will be on first come and first served basis. But we will give preference to people who show regularity and sign up for many sessions. Students will also have to fill up a small interview before the session so the instructors get to know their skill level and motivation. Students are required to meet the prerequisites for the sessions that they sign for. We ask to the students to bring their laptop in the hands on session, and to have software such as SSH preinstalled. Basic knowledge about code is also required in all sessions, except the last one. We will start registration by email mid-June or earlier.

====Student’s prerequisites====
All students will need to bring their own laptop and use them as client to connect to the host machines; we will support windows users, MacOS and Unix. They should have at least 2 Gig of Ram, and have a version of SSH installed.

====Tool license and Vendor IP====
Vendors will need to provide tools license for the hands on sessions. Students will not have tool installation on their machine. They will be piloting copies of the tool in a remote VM image. This is NOT a competition. The purpose is NOT to compare tools, different source code will be picked for each vendor. This will mitigate side-by-side comparison of tool & findings. Vendors are not allowed to interfere with other vendors’ session or demo (Note: we have only 2 vendors: Fortify & Ounce Lab). Questions related to tool comparison between the present vendors are out of scope. Vendors are free to present features and particularities exclusive to their tools.

====Session 1: Intro To Static Analysis, July 16th 2009====
Speaker: Dalci, Eric
Time: 2 hours + open discussion
Logistics: Slideware and projector
Location: <TBD>: AOL, Booz ?
Classroom size: This is open.
The last couple meetings have been averaging to about 40 attendees or so. This presentation will give a taste about what Static Analysis is. We will also try to raise interest for people to sign up for the successive session. People may want to sign up early for the session 2 and 3 since those will have limited seats.
Outcome: Sign up sheet with preregistered students for other sessions
To-dos:
• Keep students engaged and mail them prerequisites about the following sessions.
• Continue to prepare logistics for other sessions
Session 2: Tool Assisted Code Reviews, July 30th 2009
Speaker: Dalci, Eric, Bruce Mayhew (Ounce Lab) and Fortify (?)
Time: 2hours and half
Logistics: Hands on setup as in logistic section.
Location: TBD
Classroom size: 30 stations, 40 attendees max
Outcome: Sign up sheet with preregistered students for other sessions
To-dos:
• Keep students engaged and mail them prerequisites about the following sessions.
• Continue to prepare logistics for other sessions

Eric will introduce the session and the vendors. This is an introduction course to two Static Analysis tools (Fortify SCA and Ounce Labs 6):
• Fortify will demo its tool and scan Webgoat.
• Ounce Lab will demo its tool, but we may scan a different project such as HacmeBank just to avoid tool comparison.
• We will have an open discussion session after each demo for students to ask questions to the vendors.
• Vendors should not interfere with each other’s session. Questions related to tool comparison will not be answered since this is not the goal of this session.
Session 3: Customization Lab (Fortify), August 13th 2009
Speaker: Mike Ware
Time: 3 hours
Logistics: Hands on setup as in logistic section.
Location: TBD
Classroom size: 30 stations, 40 attendees max
Prerequisite: Attended session 2
Outcome: Sign up sheet with preregistered students for other sessions
To-dos:
• Keep students engaged and mail them prerequisites about the following sessions.
• Continue to prepare logistics for other sessions

Mike will train the students on how to customize the Fortify Source Code Analyzer (SCA)
Agenda (draft):
• Approach to auditing scan results to determine true positives and false positives (.5 hours)
• Custom rules (2 hours)
o Hands on examples of different rule types applied to code that resembles real business logic
• Data flow sources and sinks [private data sent to custom logger, turn web service entry points into data flow rules?]
• Data flow cleanse and pass through [cleanse: HTML escaping, pass through: third party library]
• Semantic [use of a sensitive API [getEmployeeSSN()]
• Structural [all Struts ActionForms must extend custom base ActionForm]
• Configuration [properties: data.encryption = off]
• Control flow [always call securityCheck() before downloadFile()]
• Filtering (.5 hours)
o Prioritizing remediation efforts
• Priority filters (e.g., P1, P2, etc)
o Isolating findings ("security controls" example)
• Authentication
• Authorization
• Data validation
• Session management
• Etc.

Session 4: Customization Lab (Ounce Lab), August 27th 2009
Speaker: Nabil Hannan
Time: 3 hours
Logistics: Hands on setup as in logistic section.
Location: TBD
Classroom size: 30 stations, 40 attendees max
Prerequisite: Attended session 2
Outcome: Sign up sheet with preregistered students for other sessions
To-dos:
• Keep students engaged and mail them prerequisites about the following sessions.
• Continue to prepare logistics for other sessions

Nabil will train the students on how to customize the Ounce Labs 6 tool
Agenda (draft):
• Approach to auditing scan results to determine true positives and false positives (.5 hours)
• Custom rules (1.5 hours)
o Hands on examples of different rule types applied to code that resembles real business logic
• Data flow sources and sinks [private data sent to custom logger]
• Data flow cleanse [cleanse: HTML encoding]
• Semantic [use of a sensitive API e.g. getEmployeeSSN()]
• Filtering (.5 hours)
o Prioritizing remediation efforts
• Understanding the Ounce Vulnerability Matrix
• Modifying finding severity/category
o Isolating findings (using "bundles")
• Input Validation
• SQL Injection
• Cross-Site Scripting
• Etc.
• Reporting (.5 hours)
o Demonstrate compliance with industry regulations and best practices
• OWASP Top 10
• PCI

Session 5: Tool Adoption and Deployment, September 10th 2009
Speaker: Shivang Trivedi
Time: 2 hours
Logistics: Slideware and projector
Location: TBD
Prerequisite: Preferably attended session 2, but not mandatory
Classroom size: Open
Outcome: Sign up sheet with preregistered students for other sessions
To-dos:
• Keep students engaged and mail them prerequisites about the following sessions.
• Continue to prepare logistics for other sessions

Shivang will talk about integration of a Static Analysis tool into the SDLC.

Agenda (draft):

• Tool Selection
o Flexible with Static Analysis and/or Penetration Testing
o Coverage
o Enterprise Support
o Quality of Security Findings
• Phases of Integration
o Pre-requisites
o Goals and Challenges
o Distribution of Roles and Responsibilities
o Considering LOE
• Model Per Activity
o Activity Flow
o Phase Transition
• Deployment Model
o Advantages
o Disadvantages
• Free and Handy Tools to
o Continuously Integrate
o Join activity flow
• Improvements and Lessons Learned
o Effective use of tool’s capabilities
o Expanding Coverage
o Analysis Techniques
o Improving Results Accuracy

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost. 

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]] 

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Code Review and Static Analysis with tools

2009-05-28T07:27:18Z

Edalci: /* Static Analysis Curriculum */

File:OWASP roadmap.png

2009-05-28T07:26:18Z

Edalci: uploaded a new version of "Image:OWASP roadmap.png"

Code Review and Static Analysis with tools

2009-05-28T07:25:37Z

Edalci: /* Static Analysis Curriculum */

File:OWASP roadmap.png

2009-05-28T07:19:07Z

Edalci: