https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Jm04469 2026-05-03T19:01:56Z User contributions MediaWiki 1.27.2 https://wiki.owasp.org/index.php?title=Hartford&diff=227965 2017-03-27T20:05:20Z

<p>Jm04469: UConn</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:jmcgovern@massmutual.com James McGovern] and [mailto:alvin.fong@owasp.org Alvin Fong]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.travelers.com/ Travelers Insurance]for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@owasp.org James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Risk Rating Methodologies<br /> * Breaking CAPTCHA<br /> * Internet of Things (IOT) Security<br /> * Information Security 101 for Business Executives<br /> * Enterprise Risk Management - Understanding true risks<br /> <br /> == Upcoming Events ==<br /> <br /> Outlook events:<br /> <br /> '''Agenda: Wednesday, Mar 29th 2017'''&lt;br&gt;<br /> 6:30PM - 9PM&lt;br&gt;<br /> OWASP UCONN &lt;br&gt;<br /> https://cc.callinfo.com/r/1jtu5l8injwjx&amp;eom&lt;br&gt;&lt;br&gt;<br /> <br /> The next OWASP Hartford chapter meeting will be held at the ITE Building Room 301 on the University of Connecticut Campus in Storrs. We are conducting an interactive session with students of the cybersecurity club and will be inviting participation from students attending Law, Business and Medical schools for an enlightening discussion on Healthcare Information Security. As usual, this event is kid-friendly and OWASP-approved with a healthy dose of FREE TO ATTEND sprinkled on top.<br /> <br /> '''Agenda: Thursday, Sep 29th 2016'''&lt;br&gt;<br /> 2PM - 4PM&lt;br&gt;<br /> Fraud Analytics &lt;br&gt;<br /> https://cc.callinfo.com/r/1jtu5l8injwjx&amp;eom&lt;br&gt;&lt;br&gt;<br /> <br /> The next OWASP Hartford chapter meeting will focus on Fraud Analytics. James Ruotolo from SAS will be joining us to discuss fraud analytics methodologies, fraud patterns in insurance. There will also be a walkthrough of Visualization technologies, Risk Scoring, and Cybersecurity. &lt;br /&gt;<br /> <br /> <br /> Agenda: &lt;br /&gt;<br /> Exploring Fraud Analytics &lt;br /&gt;<br /> 1. Introduction &lt;br /&gt;<br /> a. Business analytics &lt;br /&gt;<br /> b. Example fraud analytics use cases &lt;br /&gt;<br /> 2. Fraud analytics methodology&lt;br /&gt;<br /> a. Detection techniques&lt;br /&gt;<br /> b. Data management considerations&lt;br /&gt;<br /> c. Deployment and operationalization &lt;br /&gt;<br /> 3. Case study: Fraud analytics in insurance&lt;br /&gt;<br /> a. Visualization technology &lt;br /&gt;<br /> b. Fraud risk scoring and alert triage &lt;br /&gt;<br /> c. Cybersecurity&lt;br /&gt;<br /> d. Example results&lt;br /&gt;<br /> 4. Q&amp;A&lt;br /&gt;<br /> <br /> About James Ruotolo:&lt;br /&gt;<br /> James Ruotolo is the product line leader for the fraud and security intelligence solution portfolio at SAS®. He is responsible for product management and marketing of fraud detection and compliance solutions for the banking, insurance, healthcare and government industries. Before joining SAS®, James was the Director of Strategic Operations for the special investigation unit of a large multi-line US insurance company where he was responsible for investigative analytics and intelligence operations. He has nearly two decades of investigation and fraud analytics experience. Connect with him on Twitter @jdruotolo &lt;br /&gt;<br /> &lt;br /&gt;<br /> &lt;strong&gt;<br /> Please RSVP by 9/28 on our meet-up site: https://www.meetup.com/Hartford-Cyber-Security-Meetup-OWASP/events/234147585/ OR register remotely via https://cc.callinfo.com/r/1jtu5l8injwjx&amp;eom&lt;/strong&gt;&lt;br /&gt;<br /> GPS Address: 45 Central Row, Hartford, CT, 06103 (entrance is between Dunkin Donuts and CVS Pharmacy) &lt;br /&gt;<br /> <br /> <br /> Directions to Travelers Central Row Meeting rooms: &lt;br /&gt;https://www.travelers.com/about-us/careers/documents/hartfordmapdrivingdirections.pdf &lt;br /&gt;<br /> <br /> Local parking map: http://parking.hartford.gov/map/map2009.htm &lt;br /&gt;<br /> Note: there is limited street parking and the constitution plaza and financial plaza garages are the closest to the central row meeting rooms.&lt;br /&gt;<br /> <br /> <br /> <br /> <br /> '''Agenda: Thursday, May 26th 2016'''&lt;br&gt;<br /> Industry Cyber Security Panel &lt;br&gt;&lt;br&gt;<br /> <br /> Brian Bemis – Travelers - Director of Application Security and Public Key Infrastructure&lt;br&gt;<br /> Brian’s area of focus includes Application security, penetration testing, network security, Secure SDLC, and certificates &lt;br&gt;<br /> &lt;br&gt;<br /> Brian Heemsoth – Aetna – Director of Software and Mobile Security&lt;br&gt; <br /> Brian Heemsoth is responsible for designing and implementing security solutions with a user experience focus, &lt;br&gt;application security, mobile security and incident response. &lt;br&gt;<br /> &lt;br&gt;<br /> Joe Niquette – UnitedHealth Group – Security Solutions Architect&lt;br&gt;<br /> Joe’s involved in security research and development and passionate about rugged DevOps.&lt;br&gt;<br /> &lt;br&gt;<br /> Ankur Singhal – the Hartford – Manager Application Security &lt;br&gt;<br /> Ankur’s focus is web and mobile application security, security vulnerability management and remediation, Secure SDLC, PKI and cert management, Encryption at rest and most recently Security in DevOps&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> 2:00 PM to 4:00 PM&lt;br&gt;<br /> <br /> <br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, February 9th 2016'''&lt;br&gt;<br /> Threat Modeling for Architects, Business Analysts and Quality Assurance Professionals’ Category&lt;br&gt;<br /> Robert Hurlbut&lt;br&gt;<br /> Independent software security consultant, architect and trainer&lt;br&gt;<br /> Hurlbut Consulting Services&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> Future Direction of Chapter&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> 7:00 PM to 7:30 PM&lt;br&gt;&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 27th 2014'''&lt;br&gt;<br /> OWASP Mobile Top Ten Risks 2014 – The New M10: ‘Lack of Binary Protection’ Category&lt;br&gt;<br /> Senior Security Engineer at Arxan Technologies &lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> IDaaS (Cloud) Landscape - Why Companies are Shifting Strategies Toward Cloud-Based Identity Management vs. Traditional Security Methods?&lt;br&gt;<br /> Tarek Khaled, Senior Security Engineer at Okta&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.travelers.com/ Travelers Insurance] 45 Central Row, Hartford CT 06103 (Entrance is between Dunkin Donuts and CVS pharmacy). Free parking is available in their Propspect Street Garage (Next to Hartford Club).<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:United_States]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=208310 2016-02-08T19:47:54Z

<p>Jm04469: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.travelers.com/ Travelers Insurance]for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@owasp.org James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Risk Rating Methodologies<br /> * Breaking CAPTCHA<br /> * Internet of Things (IOT) Security<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, February 9th 2016'''&lt;br&gt;<br /> Threat Modeling for Architects, Business Analysts and Quality Assurance Professionals’ Category&lt;br&gt;<br /> Robert Hurlbut&lt;br&gt;<br /> Independent software security consultant, architect and trainer&lt;br&gt;<br /> Hurlbut Consulting Services&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> Future Direction of Chapter&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> 7:00 PM to 7:30 PM&lt;br&gt;&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 27th 2014'''&lt;br&gt;<br /> OWASP Mobile Top Ten Risks 2014 – The New M10: ‘Lack of Binary Protection’ Category&lt;br&gt;<br /> Senior Security Engineer at Arxan Technologies &lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> IDaaS (Cloud) Landscape - Why Companies are Shifting Strategies Toward Cloud-Based Identity Management vs. Traditional Security Methods?&lt;br&gt;<br /> Tarek Khaled, Senior Security Engineer at Okta&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.travelers.com/ Travelers Insurance] 45 Central Row, Hartford CT 06103 (Entrance is between Dunkin Donuts and CVS pharmacy). Free parking is available in their Propspect Street Garage (Next to Hartford Club).<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:United_States]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=208308 2016-02-08T19:46:45Z

<p>Jm04469: /* Upcoming Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.travelers.com/ Travelers Insurance]for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@owasp.org James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Risk Rating Methodologies<br /> * Breaking CAPTCHA<br /> * Internet of Things (IOT) Security<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, February 9th 2016'''&lt;br&gt;<br /> Threat Modeling for Architects, Business Analysts and Quality Assurance Professionals’ Category&lt;br&gt;<br /> Robert Hurlbut&lt;br&gt;<br /> Independent software security consultant, architect and trainer&lt;br&gt;<br /> Hurlbut Consulting Services&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> Future Direction of Chapter&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> 7:00 PM to 7:30 PM&lt;br&gt;&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.travelers.com/ Travelers Insurance] 45 Central Row, Hartford CT 06103 (Entrance is between Dunkin Donuts and CVS pharmacy). Free parking is available in their Propspect Street Garage (Next to Hartford Club).<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:United_States]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=208015 2016-02-02T19:12:03Z

<p>Jm04469: /* Locations */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.travelers.com/ Travelers Insurance]for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@owasp.org James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Risk Rating Methodologies<br /> * Breaking CAPTCHA<br /> * Internet of Things (IOT) Security<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 27th 2014'''&lt;br&gt;<br /> OWASP Mobile Top Ten Risks 2014 – The New M10: ‘Lack of Binary Protection’ Category&lt;br&gt;<br /> Senior Security Engineer at Arxan Technologies &lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> IDaaS (Cloud) Landscape - Why Companies are Shifting Strategies Toward Cloud-Based Identity Management vs. Traditional Security Methods?&lt;br&gt;<br /> Tarek Khaled, Senior Security Engineer at Okta&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.travelers.com/ Travelers Insurance] 45 Central Row, Hartford CT 06103 (Entrance is between Dunkin Donuts and CVS pharmacy). Free parking is available in their Propspect Street Garage (Next to Hartford Club).<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:United_States]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=208012 2016-02-02T19:08:11Z

<p>Jm04469: /* Call for Sponsors/Speakers */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.travelers.com/ Travelers Insurance]for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@owasp.org James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Risk Rating Methodologies<br /> * Breaking CAPTCHA<br /> * Internet of Things (IOT) Security<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 27th 2014'''&lt;br&gt;<br /> OWASP Mobile Top Ten Risks 2014 – The New M10: ‘Lack of Binary Protection’ Category&lt;br&gt;<br /> Senior Security Engineer at Arxan Technologies &lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> IDaaS (Cloud) Landscape - Why Companies are Shifting Strategies Toward Cloud-Based Identity Management vs. Traditional Security Methods?&lt;br&gt;<br /> Tarek Khaled, Senior Security Engineer at Okta&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:United_States]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=208011 2016-02-02T19:07:06Z

<p>Jm04469: /* Sponsors */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.travelers.com/ Travelers Insurance]for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@owasp.org James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 27th 2014'''&lt;br&gt;<br /> OWASP Mobile Top Ten Risks 2014 – The New M10: ‘Lack of Binary Protection’ Category&lt;br&gt;<br /> Senior Security Engineer at Arxan Technologies &lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> IDaaS (Cloud) Landscape - Why Companies are Shifting Strategies Toward Cloud-Based Identity Management vs. Traditional Security Methods?&lt;br&gt;<br /> Tarek Khaled, Senior Security Engineer at Okta&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:United_States]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=208010 2016-02-02T19:06:44Z

<p>Jm04469: /* Sponsors */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.travelers.com/ Travelers]for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@owasp.org James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 27th 2014'''&lt;br&gt;<br /> OWASP Mobile Top Ten Risks 2014 – The New M10: ‘Lack of Binary Protection’ Category&lt;br&gt;<br /> Senior Security Engineer at Arxan Technologies &lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> IDaaS (Cloud) Landscape - Why Companies are Shifting Strategies Toward Cloud-Based Identity Management vs. Traditional Security Methods?&lt;br&gt;<br /> Tarek Khaled, Senior Security Engineer at Okta&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:United_States]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Forgot_Password_Cheat_Sheet&diff=200084 2015-09-04T23:03:12Z

<p>Jm04469: </p> <hr /> <div> __NOTOC__<br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:Cheatsheets-header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' <br /> = Introduction =<br /> __TOC__{{TOC hidden}}<br /> <br /> This article provides a simple model to follow when implementing a &amp;quot;forgot password&amp;quot; web application feature.&lt;br&gt; <br /> <br /> = The Problem =<br /> <br /> There is no industry standard for implementing a Forgot Password feature. The result is that you see applications forcing users to jump through myriad hoops involving emails, special URLs, temporary passwords, personal security questions, and so on. With some applications you can recover your existing password. In others you have to reset it to a new value.<br /> <br /> = Steps =<br /> <br /> == Step 1) Gather Identity Data or Security Questions ==<br /> <br /> The first page of a secure Forgot Password feature asks the user for multiple pieces of hard data that should have been previously collected (generally when the user first registers). Steps for this are detailed in the identity section the Choosing and Using Security Questions Cheat Sheet [https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet#Step_1.29_Decide_on_Identity_Data_vs_Canned_Questions_vs._User-Created_Questions here].<br /> <br /> At a minimum, you should have collected some data that will allow you to send the password reset information to some out-of-band side-channel, such as a (possibly different) email address or an SMS text number, etc. to be used in Step 3.<br /> <br /> == Step 2) Verify Security Questions ==<br /> <br /> After the form on Step 1 is submitted, the application verifies that each piece of data is correct for the given username. If anything is incorrect, or if the username is not recognized, the second page displays a generic error message such as “Sorry, invalid data”. If all submitted data is correct, Step 2 should display at least two of the user’s pre-established personal security questions, along with input fields for the answers. It’s important that the answer fields are part of a single HTML form.<br /> <br /> Do not provide a drop-down list for the user to select the questions he wants to answer. Avoid sending the username as a parameter (hidden or otherwise) when the form on this page is submitted. The username should be stored in the server-side session where it can be retrieved as needed.<br /> <br /> Because users' security questions / answers generally contains much less entropy than a well-chosen password (how many likely answers are there to the typical &quot;What's your favorite sports team?&quot; or &quot;In what city where you born?&quot; security questions anyway?), make sure you limit the number of guesses attempted and if some threshold is exceeded for that user (say 3 to 5), lock out the user's account for some reasonable duration (say at least 5 minutes) and then challenge the user with some form of challenge token per standard multi-factor workflow; see #3, below) to mitigate attempts by hackers to guess the questions and reset the user's password. (It is not unreasonable to think that a user's email account may have already been compromised, so tokens that do not involve email, such as SMS or a mobile soft-token, are best.)<br /> <br /> == Step 3) Send a Token Over a Side-Channel ==<br /> <br /> After step 2, lock out the user's account immediately. Then SMS or utilize some other multi-factor token challenge with a randomly-generated code having 8 or more characters. This introduces an “out-of-band” communication channel and adds defense-in-depth as it is another barrier for a hacker to overcome. If the bad guy has somehow managed to successfully get past steps 1 and 2, he is unlikely to have compromised the side-channel. It is also a good idea to have the random code which your system generates to only have a limited validity period, say no more than 20 minutes or so. That way if the user doesn't get around to checking their email and their email account is later compromised, the random token used to reset the password would no longer be valid if the user never reset their password and the &quot;reset password&quot; token was discovered by an attacker. Of course, by all means, once a user's password has been reset, the randomly-generated token should no longer be valid.<br /> <br /> == Step 4) Allow user to change password in the existing session ==<br /> <br /> Step 4 requires input of the code sent in step 3 in the existing session where the challenge questions were answered in step 2, and allows the user to reset his password. Display a simple HTML form with one input field for the code, one for the new password, and one to confirm the new password. Verify the correct code is provided and be sure to enforce all password complexity requirements that exist in other areas of the application. As before, avoid sending the username as a parameter when the form is submitted. Finally, it's critical to have a check to prevent a user from accessing this last step without first completing steps 1 and 2 correctly. Otherwise, a [[forced browsing]] attack may be possible.<br /> <br /> <br /> == Step 5) Logging ==<br /> <br /> It is important to keep audit records about when password change requests were submitted, whether or not security questions were answered, when reset messages were sent to users and when users utilize them. It is especially important to log failed attempts to answer security questions and attempted use of expired tokens. This data can be used to detect abuse and malicious behavior. Data such as time, IP address, and browser information can be used to spot trends of suspicious use.<br /> <br /> = Other Considerations =<br /> * Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page<br /> * Strength of questions used for reset should vary based on the nature of the credential. Administrator credentials should have a higher requirement.<br /> * The ideal implementation should rotate the questions asked in order to avoid automation<br /> <br /> = Authors and Primary Editors =<br /> <br /> Dave Ferguson - gmdavef[at]gmail.com&lt;br/&gt;<br /> Jim Manico - jim[at]owasp.org&lt;br/&gt;<br /> Kevin Wall - kevin.w.wall[at]gmail.com&lt;br/&gt;<br /> James McGovern - james.mcgovern[at]hp.com&lt;/br&gt;<br /> Wesley Philip - wphilip[at]ca.ibm.com<br /> <br /> == Other Cheatsheets ==<br /> <br /> {{Cheatsheet_Navigation_Body}}<br /> <br /> |}<br /> <br /> [[Category:Cheatsheets]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=SAML_Security_Cheat_Sheet&diff=200083 2015-09-04T22:57:14Z

<p>Jm04469: /* Last Mile Considerations */</p> <hr /> <div> __NOTOC__<br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:Cheatsheets-header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' <br /> = Introduction =<br /> __TOC__{{TOC hidden}}<br /> <br /> The &lt;i&gt;Security Assertion Markup Language&lt;/i&gt; (SAML) is an open standard for exchanging authorization and authentication information. The &lt;i&gt;Web Browser SAML/SSO Profile with Redirect/POST bindings&lt;/i&gt; is one of the most common SSO implementation. This cheatsheet will focus primarily on that profile.<br /> <br /> <br /> = Validate Message Confidentiality and Integrity =<br /> <br /> * [[Transport Layer Protection Cheat Sheet|TLS 1.2]] is the most common solution to guarantee message confidentiality and integrity. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> ** Eavesdropping 7.1.1.1<br /> ** Theft of User Authentication Information 7.1.1.2<br /> ** Theft of the Bearer Token 7.1.1.3<br /> ** Message Deletion 7.1.1.6<br /> ** Message Modification 7.1.1.7<br /> ** Man-in-the-middle 7.1.1.8<br /> *A digitally signed message with a certified key is the most common solution to guarantee message integrity and authentication. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> **Man-in-the-middle 6.4.2<br /> **Forged Assertion 6.4.3<br /> <br /> <br /> =Validate Protocol Usage=<br /> <br /> This is a common area for security gaps - see [http://www.ai-lab.it/armando/pub/fmse9-armando.pdf Google SSO vulnerability] (AVANTSSAR 2008) for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profile] usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. The AVANTSSAR team suggested the following data elements should be required:<br /> <br /> * '''AuthnRequest(ID, SP);''' An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo=&quot;&lt;requestId&gt;&quot;). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.<br /> * '''Response(ID, SP, IdP, {AA} K -1/IdP);''' A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.<br /> * '''AuthAssert(ID, C, IdP, SP);''' An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.<br /> <br /> Further vulnerabilities in SAML implementations were described in 2012 ([https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91-8-23-12.pdf On Breaking SAML: Be Whoever You Want to Be]). The following recommendations were proposed in response ([http://arxiv.org/pdf/1401.7483v1.pdf Secure SAML validation to prevent XML signature wrapping attacks]):<br /> <br /> * Always perform schema validation on the XML document prior to using it for any security-­related purposes.<br /> ** Always use local, trusted copies of schemas for validation.<br /> ** Never allow automatic download of schemas from third party locations.<br /> ** If possible, inspect schemas and perform schema hardening, to disable possible wildcard ­type or relaxed processing statements.<br /> * Securely validate the digital signature.<br /> ** If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.<br /> ** If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.<br /> ** If you expect a heterogenous signed documents (many certificates from many identity providers, multi­level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.<br /> * Avoid signature-wrapping attacks.<br /> ** Never use getElementsByTagName to select security related elements in an XML document without prior validation.<br /> **Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.<br /> <br /> <br /> =Validate Protocol Processing Rules=<br /> <br /> This is another common area for security gaps simply because of the vast number of steps to assert. Processing a SAML response is an expensive operation but all steps must be validated.<br /> *Validate AuthnRequest processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML Core] (3.4.1.4) for all AuthnRequest processing rules. This step will help counter the following attacks:<br /> ** Man-in-the-middle (6.4.2)<br /> * Validate Response processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profiles] (4.1.4.3) for all Response processing rules. This step will help counter the following attacks:<br /> ** Stolen Assertion (6.4.1)<br /> ** Man-in-the-middle (6.4.2)<br /> ** Forged Assertion (6.4.3)<br /> ** Browser State Exposure (6.4.4)<br /> <br /> <br /> =Validate Binding Implementation=<br /> <br /> *For an HTTP Redirect Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.4). To view an encoding example, you may want to reference RequestUtil.java found within [https://developers.google.com/google-apps/sso/saml_reference_implementation_web Google's reference implementation].<br /> * For an HTTP POST Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.5). The caching considerations are also very important. If a SAML protocol message gets cached, it can subsequently be used as a Stolen Assertion (6.4.1) or Replay (6.4.5) attack.<br /> <br /> <br /> =Validate Security Countermeasures=<br /> <br /> Revisit each security threat that exists within the [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security] document and assert you have applied the appropriate countermeasures for threats that may exist for your particular implementation. Additional countermeasures considererd should include:<br /> *Prefer IP Filtering when appropriate. For example, this countermeasure could have prevented Google's initial security flaw if Google provided each trusted partner with a separate endpoint and setup an IP filter for each endpoint. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Man-in-the-middle (6.4.2)<br /> *Prefer short lifetimes on the SAML Response. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Browser State Exposure (6.4.4)<br /> *Prefer OneTimeUse on the SAML Response. This step will help counter the following attacks:<br /> **Browser State Exposure (6.4.4)<br /> **Replay (6.4.5)<br /> <br /> Need an architectural diagram? The [http://www.oasis-open.org/committees/download.php/11511/sstc-saml-tech-overview-2.0-draft-03.pdf SAML technical overview] contains the most complete diagrams. For the Web Browser SSO Profile with Redirect/POST bindings refer to the section 4.1.3. In fact, of all the SAML documentation, the technical overview is the most valuable from a high-level perspective.<br /> <br /> <br /> = First and Last Mile Considerations = <br /> <br /> The SAML protocol is rarely the vector of choice, though it's important to have cheatsheets to make sure that this is robust. The various endpoints are more targeted, so how the SAML token is generated and how it is consumed are both important in practice. <br /> <br /> == First Mile Considerations ==<br /> * Validate X.509 Certificate for algorithm compatibility, strength of encryption, export restrictions<br /> * Validate Strong Authentication options for generating the SAML token<br /> * IDP validation (which IDP mints the token)<br /> * Use/Trust Root CAs whenever possible<br /> * Synchronize to a common Internet timesource<br /> * Define levels of assurance for identity verification<br /> * Prefer asymmetric identifiers for identity assertions over personally identifiable information (e.g. SSNs, etc)<br /> * Sign assertions whenever possible<br /> <br /> == Last Mile Considerations ==<br /> * Validating session state for user<br /> * Level of granularity in setting authZ context when consuming SAML token (do you use groups, roles, attributes)<br /> * Validate authorized IDP<br /> * Validate IDP certificates for expiry against CRL/OCSP<br /> * Validate NotBefore and NotOnorAfter<br /> * Define criteria for SAML logout<br /> * Exchange assertions only over secure transports<br /> * Define criteria for session management<br /> * Validate signature whenever possible<br /> * Verify user identities obtained from SAML ticket assertions whenever possible.<br /> <br /> = Input Validation =<br /> <br /> Just because SAML is a security protocol does not mean that input validation goes away. <br /> <br /> * Ensure that all SAML providers/consumers do proper [[Input_Validation_Cheat_Sheet | input validation]].<br /> <br /> <br /> = Authors and Primary Editors =<br /> <br /> * [http://bradbroulik.blogspot.dk/2010/01/bulletproof-sso-with-saml-20.html Brad Broulik]<br /> * [https://ipsec.pl/ Paweł Krawczyk]<br /> * Gunnar Peterson<br /> * James McGovern<br /> <br /> == Other Cheatsheets ==<br /> <br /> {{Cheatsheet_Navigation_Body}}<br /> <br /> |}<br /> <br /> [[Category:Cheatsheets]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=SAML_Security_Cheat_Sheet&diff=200082 2015-09-04T22:56:12Z

<p>Jm04469: /* First Mile Considerations */</p> <hr /> <div> __NOTOC__<br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:Cheatsheets-header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' <br /> = Introduction =<br /> __TOC__{{TOC hidden}}<br /> <br /> The &lt;i&gt;Security Assertion Markup Language&lt;/i&gt; (SAML) is an open standard for exchanging authorization and authentication information. The &lt;i&gt;Web Browser SAML/SSO Profile with Redirect/POST bindings&lt;/i&gt; is one of the most common SSO implementation. This cheatsheet will focus primarily on that profile.<br /> <br /> <br /> = Validate Message Confidentiality and Integrity =<br /> <br /> * [[Transport Layer Protection Cheat Sheet|TLS 1.2]] is the most common solution to guarantee message confidentiality and integrity. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> ** Eavesdropping 7.1.1.1<br /> ** Theft of User Authentication Information 7.1.1.2<br /> ** Theft of the Bearer Token 7.1.1.3<br /> ** Message Deletion 7.1.1.6<br /> ** Message Modification 7.1.1.7<br /> ** Man-in-the-middle 7.1.1.8<br /> *A digitally signed message with a certified key is the most common solution to guarantee message integrity and authentication. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> **Man-in-the-middle 6.4.2<br /> **Forged Assertion 6.4.3<br /> <br /> <br /> =Validate Protocol Usage=<br /> <br /> This is a common area for security gaps - see [http://www.ai-lab.it/armando/pub/fmse9-armando.pdf Google SSO vulnerability] (AVANTSSAR 2008) for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profile] usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. The AVANTSSAR team suggested the following data elements should be required:<br /> <br /> * '''AuthnRequest(ID, SP);''' An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo=&quot;&lt;requestId&gt;&quot;). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.<br /> * '''Response(ID, SP, IdP, {AA} K -1/IdP);''' A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.<br /> * '''AuthAssert(ID, C, IdP, SP);''' An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.<br /> <br /> Further vulnerabilities in SAML implementations were described in 2012 ([https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91-8-23-12.pdf On Breaking SAML: Be Whoever You Want to Be]). The following recommendations were proposed in response ([http://arxiv.org/pdf/1401.7483v1.pdf Secure SAML validation to prevent XML signature wrapping attacks]):<br /> <br /> * Always perform schema validation on the XML document prior to using it for any security-­related purposes.<br /> ** Always use local, trusted copies of schemas for validation.<br /> ** Never allow automatic download of schemas from third party locations.<br /> ** If possible, inspect schemas and perform schema hardening, to disable possible wildcard ­type or relaxed processing statements.<br /> * Securely validate the digital signature.<br /> ** If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.<br /> ** If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.<br /> ** If you expect a heterogenous signed documents (many certificates from many identity providers, multi­level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.<br /> * Avoid signature-wrapping attacks.<br /> ** Never use getElementsByTagName to select security related elements in an XML document without prior validation.<br /> **Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.<br /> <br /> <br /> =Validate Protocol Processing Rules=<br /> <br /> This is another common area for security gaps simply because of the vast number of steps to assert. Processing a SAML response is an expensive operation but all steps must be validated.<br /> *Validate AuthnRequest processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML Core] (3.4.1.4) for all AuthnRequest processing rules. This step will help counter the following attacks:<br /> ** Man-in-the-middle (6.4.2)<br /> * Validate Response processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profiles] (4.1.4.3) for all Response processing rules. This step will help counter the following attacks:<br /> ** Stolen Assertion (6.4.1)<br /> ** Man-in-the-middle (6.4.2)<br /> ** Forged Assertion (6.4.3)<br /> ** Browser State Exposure (6.4.4)<br /> <br /> <br /> =Validate Binding Implementation=<br /> <br /> *For an HTTP Redirect Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.4). To view an encoding example, you may want to reference RequestUtil.java found within [https://developers.google.com/google-apps/sso/saml_reference_implementation_web Google's reference implementation].<br /> * For an HTTP POST Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.5). The caching considerations are also very important. If a SAML protocol message gets cached, it can subsequently be used as a Stolen Assertion (6.4.1) or Replay (6.4.5) attack.<br /> <br /> <br /> =Validate Security Countermeasures=<br /> <br /> Revisit each security threat that exists within the [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security] document and assert you have applied the appropriate countermeasures for threats that may exist for your particular implementation. Additional countermeasures considererd should include:<br /> *Prefer IP Filtering when appropriate. For example, this countermeasure could have prevented Google's initial security flaw if Google provided each trusted partner with a separate endpoint and setup an IP filter for each endpoint. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Man-in-the-middle (6.4.2)<br /> *Prefer short lifetimes on the SAML Response. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Browser State Exposure (6.4.4)<br /> *Prefer OneTimeUse on the SAML Response. This step will help counter the following attacks:<br /> **Browser State Exposure (6.4.4)<br /> **Replay (6.4.5)<br /> <br /> Need an architectural diagram? The [http://www.oasis-open.org/committees/download.php/11511/sstc-saml-tech-overview-2.0-draft-03.pdf SAML technical overview] contains the most complete diagrams. For the Web Browser SSO Profile with Redirect/POST bindings refer to the section 4.1.3. In fact, of all the SAML documentation, the technical overview is the most valuable from a high-level perspective.<br /> <br /> <br /> = First and Last Mile Considerations = <br /> <br /> The SAML protocol is rarely the vector of choice, though it's important to have cheatsheets to make sure that this is robust. The various endpoints are more targeted, so how the SAML token is generated and how it is consumed are both important in practice. <br /> <br /> == First Mile Considerations ==<br /> * Validate X.509 Certificate for algorithm compatibility, strength of encryption, export restrictions<br /> * Validate Strong Authentication options for generating the SAML token<br /> * IDP validation (which IDP mints the token)<br /> * Use/Trust Root CAs whenever possible<br /> * Synchronize to a common Internet timesource<br /> * Define levels of assurance for identity verification<br /> * Prefer asymmetric identifiers for identity assertions over personally identifiable information (e.g. SSNs, etc)<br /> * Sign assertions whenever possible<br /> <br /> == Last Mile Considerations ==<br /> * Validating session state for user<br /> * Level of granularity in setting authZ context when consuming SAML token (do you use groups, roles, attributes)<br /> * Validate authorized IDP<br /> * Validate IDP certificates for expiry against CRL/OCSP<br /> * Validate NotBefore and NotOnorAfter<br /> * Define criteria for SAML logout<br /> * Exchange assertions only over secure transports<br /> * Define criteria for session management<br /> * Validate signature whenever possible<br /> <br /> = Input Validation =<br /> <br /> Just because SAML is a security protocol does not mean that input validation goes away. <br /> <br /> * Ensure that all SAML providers/consumers do proper [[Input_Validation_Cheat_Sheet | input validation]].<br /> <br /> <br /> = Authors and Primary Editors =<br /> <br /> * [http://bradbroulik.blogspot.dk/2010/01/bulletproof-sso-with-saml-20.html Brad Broulik]<br /> * [https://ipsec.pl/ Paweł Krawczyk]<br /> * Gunnar Peterson<br /> * James McGovern<br /> <br /> == Other Cheatsheets ==<br /> <br /> {{Cheatsheet_Navigation_Body}}<br /> <br /> |}<br /> <br /> [[Category:Cheatsheets]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=SAML_Security_Cheat_Sheet&diff=200081 2015-09-04T22:55:46Z

<p>Jm04469: /* Last Mile Considerations */</p> <hr /> <div> __NOTOC__<br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:Cheatsheets-header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' <br /> = Introduction =<br /> __TOC__{{TOC hidden}}<br /> <br /> The &lt;i&gt;Security Assertion Markup Language&lt;/i&gt; (SAML) is an open standard for exchanging authorization and authentication information. The &lt;i&gt;Web Browser SAML/SSO Profile with Redirect/POST bindings&lt;/i&gt; is one of the most common SSO implementation. This cheatsheet will focus primarily on that profile.<br /> <br /> <br /> = Validate Message Confidentiality and Integrity =<br /> <br /> * [[Transport Layer Protection Cheat Sheet|TLS 1.2]] is the most common solution to guarantee message confidentiality and integrity. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> ** Eavesdropping 7.1.1.1<br /> ** Theft of User Authentication Information 7.1.1.2<br /> ** Theft of the Bearer Token 7.1.1.3<br /> ** Message Deletion 7.1.1.6<br /> ** Message Modification 7.1.1.7<br /> ** Man-in-the-middle 7.1.1.8<br /> *A digitally signed message with a certified key is the most common solution to guarantee message integrity and authentication. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> **Man-in-the-middle 6.4.2<br /> **Forged Assertion 6.4.3<br /> <br /> <br /> =Validate Protocol Usage=<br /> <br /> This is a common area for security gaps - see [http://www.ai-lab.it/armando/pub/fmse9-armando.pdf Google SSO vulnerability] (AVANTSSAR 2008) for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profile] usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. The AVANTSSAR team suggested the following data elements should be required:<br /> <br /> * '''AuthnRequest(ID, SP);''' An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo=&quot;&lt;requestId&gt;&quot;). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.<br /> * '''Response(ID, SP, IdP, {AA} K -1/IdP);''' A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.<br /> * '''AuthAssert(ID, C, IdP, SP);''' An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.<br /> <br /> Further vulnerabilities in SAML implementations were described in 2012 ([https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91-8-23-12.pdf On Breaking SAML: Be Whoever You Want to Be]). The following recommendations were proposed in response ([http://arxiv.org/pdf/1401.7483v1.pdf Secure SAML validation to prevent XML signature wrapping attacks]):<br /> <br /> * Always perform schema validation on the XML document prior to using it for any security-­related purposes.<br /> ** Always use local, trusted copies of schemas for validation.<br /> ** Never allow automatic download of schemas from third party locations.<br /> ** If possible, inspect schemas and perform schema hardening, to disable possible wildcard ­type or relaxed processing statements.<br /> * Securely validate the digital signature.<br /> ** If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.<br /> ** If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.<br /> ** If you expect a heterogenous signed documents (many certificates from many identity providers, multi­level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.<br /> * Avoid signature-wrapping attacks.<br /> ** Never use getElementsByTagName to select security related elements in an XML document without prior validation.<br /> **Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.<br /> <br /> <br /> =Validate Protocol Processing Rules=<br /> <br /> This is another common area for security gaps simply because of the vast number of steps to assert. Processing a SAML response is an expensive operation but all steps must be validated.<br /> *Validate AuthnRequest processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML Core] (3.4.1.4) for all AuthnRequest processing rules. This step will help counter the following attacks:<br /> ** Man-in-the-middle (6.4.2)<br /> * Validate Response processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profiles] (4.1.4.3) for all Response processing rules. This step will help counter the following attacks:<br /> ** Stolen Assertion (6.4.1)<br /> ** Man-in-the-middle (6.4.2)<br /> ** Forged Assertion (6.4.3)<br /> ** Browser State Exposure (6.4.4)<br /> <br /> <br /> =Validate Binding Implementation=<br /> <br /> *For an HTTP Redirect Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.4). To view an encoding example, you may want to reference RequestUtil.java found within [https://developers.google.com/google-apps/sso/saml_reference_implementation_web Google's reference implementation].<br /> * For an HTTP POST Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.5). The caching considerations are also very important. If a SAML protocol message gets cached, it can subsequently be used as a Stolen Assertion (6.4.1) or Replay (6.4.5) attack.<br /> <br /> <br /> =Validate Security Countermeasures=<br /> <br /> Revisit each security threat that exists within the [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security] document and assert you have applied the appropriate countermeasures for threats that may exist for your particular implementation. Additional countermeasures considererd should include:<br /> *Prefer IP Filtering when appropriate. For example, this countermeasure could have prevented Google's initial security flaw if Google provided each trusted partner with a separate endpoint and setup an IP filter for each endpoint. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Man-in-the-middle (6.4.2)<br /> *Prefer short lifetimes on the SAML Response. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Browser State Exposure (6.4.4)<br /> *Prefer OneTimeUse on the SAML Response. This step will help counter the following attacks:<br /> **Browser State Exposure (6.4.4)<br /> **Replay (6.4.5)<br /> <br /> Need an architectural diagram? The [http://www.oasis-open.org/committees/download.php/11511/sstc-saml-tech-overview-2.0-draft-03.pdf SAML technical overview] contains the most complete diagrams. For the Web Browser SSO Profile with Redirect/POST bindings refer to the section 4.1.3. In fact, of all the SAML documentation, the technical overview is the most valuable from a high-level perspective.<br /> <br /> <br /> = First and Last Mile Considerations = <br /> <br /> The SAML protocol is rarely the vector of choice, though it's important to have cheatsheets to make sure that this is robust. The various endpoints are more targeted, so how the SAML token is generated and how it is consumed are both important in practice. <br /> <br /> == First Mile Considerations ==<br /> * Validate X.509 Certificate for algorithm compatibility, strength of encryption, export restrictions<br /> * Validate Strong Authentication options for generating the SAML token<br /> * IDP validation (which IDP mints the token)<br /> * Use/Trust Root CAs whenever possible<br /> * Synchronize to a common Internet timesource<br /> * Define levels of assurance for identity verification<br /> * Prefer asymmetric identifiers for identity assertions over personally identifiable information (e.g. SSNs, etc)<br /> <br /> == Last Mile Considerations ==<br /> * Validating session state for user<br /> * Level of granularity in setting authZ context when consuming SAML token (do you use groups, roles, attributes)<br /> * Validate authorized IDP<br /> * Validate IDP certificates for expiry against CRL/OCSP<br /> * Validate NotBefore and NotOnorAfter<br /> * Define criteria for SAML logout<br /> * Exchange assertions only over secure transports<br /> * Define criteria for session management<br /> * Validate signature whenever possible<br /> <br /> = Input Validation =<br /> <br /> Just because SAML is a security protocol does not mean that input validation goes away. <br /> <br /> * Ensure that all SAML providers/consumers do proper [[Input_Validation_Cheat_Sheet | input validation]].<br /> <br /> <br /> = Authors and Primary Editors =<br /> <br /> * [http://bradbroulik.blogspot.dk/2010/01/bulletproof-sso-with-saml-20.html Brad Broulik]<br /> * [https://ipsec.pl/ Paweł Krawczyk]<br /> * Gunnar Peterson<br /> * James McGovern<br /> <br /> == Other Cheatsheets ==<br /> <br /> {{Cheatsheet_Navigation_Body}}<br /> <br /> |}<br /> <br /> [[Category:Cheatsheets]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=SAML_Security_Cheat_Sheet&diff=200080 2015-09-04T22:54:15Z

<p>Jm04469: /* First Mile Considerations */</p> <hr /> <div> __NOTOC__<br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:Cheatsheets-header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' <br /> = Introduction =<br /> __TOC__{{TOC hidden}}<br /> <br /> The &lt;i&gt;Security Assertion Markup Language&lt;/i&gt; (SAML) is an open standard for exchanging authorization and authentication information. The &lt;i&gt;Web Browser SAML/SSO Profile with Redirect/POST bindings&lt;/i&gt; is one of the most common SSO implementation. This cheatsheet will focus primarily on that profile.<br /> <br /> <br /> = Validate Message Confidentiality and Integrity =<br /> <br /> * [[Transport Layer Protection Cheat Sheet|TLS 1.2]] is the most common solution to guarantee message confidentiality and integrity. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> ** Eavesdropping 7.1.1.1<br /> ** Theft of User Authentication Information 7.1.1.2<br /> ** Theft of the Bearer Token 7.1.1.3<br /> ** Message Deletion 7.1.1.6<br /> ** Message Modification 7.1.1.7<br /> ** Man-in-the-middle 7.1.1.8<br /> *A digitally signed message with a certified key is the most common solution to guarantee message integrity and authentication. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> **Man-in-the-middle 6.4.2<br /> **Forged Assertion 6.4.3<br /> <br /> <br /> =Validate Protocol Usage=<br /> <br /> This is a common area for security gaps - see [http://www.ai-lab.it/armando/pub/fmse9-armando.pdf Google SSO vulnerability] (AVANTSSAR 2008) for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profile] usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. The AVANTSSAR team suggested the following data elements should be required:<br /> <br /> * '''AuthnRequest(ID, SP);''' An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo=&quot;&lt;requestId&gt;&quot;). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.<br /> * '''Response(ID, SP, IdP, {AA} K -1/IdP);''' A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.<br /> * '''AuthAssert(ID, C, IdP, SP);''' An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.<br /> <br /> Further vulnerabilities in SAML implementations were described in 2012 ([https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91-8-23-12.pdf On Breaking SAML: Be Whoever You Want to Be]). The following recommendations were proposed in response ([http://arxiv.org/pdf/1401.7483v1.pdf Secure SAML validation to prevent XML signature wrapping attacks]):<br /> <br /> * Always perform schema validation on the XML document prior to using it for any security-­related purposes.<br /> ** Always use local, trusted copies of schemas for validation.<br /> ** Never allow automatic download of schemas from third party locations.<br /> ** If possible, inspect schemas and perform schema hardening, to disable possible wildcard ­type or relaxed processing statements.<br /> * Securely validate the digital signature.<br /> ** If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.<br /> ** If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.<br /> ** If you expect a heterogenous signed documents (many certificates from many identity providers, multi­level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.<br /> * Avoid signature-wrapping attacks.<br /> ** Never use getElementsByTagName to select security related elements in an XML document without prior validation.<br /> **Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.<br /> <br /> <br /> =Validate Protocol Processing Rules=<br /> <br /> This is another common area for security gaps simply because of the vast number of steps to assert. Processing a SAML response is an expensive operation but all steps must be validated.<br /> *Validate AuthnRequest processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML Core] (3.4.1.4) for all AuthnRequest processing rules. This step will help counter the following attacks:<br /> ** Man-in-the-middle (6.4.2)<br /> * Validate Response processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profiles] (4.1.4.3) for all Response processing rules. This step will help counter the following attacks:<br /> ** Stolen Assertion (6.4.1)<br /> ** Man-in-the-middle (6.4.2)<br /> ** Forged Assertion (6.4.3)<br /> ** Browser State Exposure (6.4.4)<br /> <br /> <br /> =Validate Binding Implementation=<br /> <br /> *For an HTTP Redirect Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.4). To view an encoding example, you may want to reference RequestUtil.java found within [https://developers.google.com/google-apps/sso/saml_reference_implementation_web Google's reference implementation].<br /> * For an HTTP POST Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.5). The caching considerations are also very important. If a SAML protocol message gets cached, it can subsequently be used as a Stolen Assertion (6.4.1) or Replay (6.4.5) attack.<br /> <br /> <br /> =Validate Security Countermeasures=<br /> <br /> Revisit each security threat that exists within the [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security] document and assert you have applied the appropriate countermeasures for threats that may exist for your particular implementation. Additional countermeasures considererd should include:<br /> *Prefer IP Filtering when appropriate. For example, this countermeasure could have prevented Google's initial security flaw if Google provided each trusted partner with a separate endpoint and setup an IP filter for each endpoint. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Man-in-the-middle (6.4.2)<br /> *Prefer short lifetimes on the SAML Response. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Browser State Exposure (6.4.4)<br /> *Prefer OneTimeUse on the SAML Response. This step will help counter the following attacks:<br /> **Browser State Exposure (6.4.4)<br /> **Replay (6.4.5)<br /> <br /> Need an architectural diagram? The [http://www.oasis-open.org/committees/download.php/11511/sstc-saml-tech-overview-2.0-draft-03.pdf SAML technical overview] contains the most complete diagrams. For the Web Browser SSO Profile with Redirect/POST bindings refer to the section 4.1.3. In fact, of all the SAML documentation, the technical overview is the most valuable from a high-level perspective.<br /> <br /> <br /> = First and Last Mile Considerations = <br /> <br /> The SAML protocol is rarely the vector of choice, though it's important to have cheatsheets to make sure that this is robust. The various endpoints are more targeted, so how the SAML token is generated and how it is consumed are both important in practice. <br /> <br /> == First Mile Considerations ==<br /> * Validate X.509 Certificate for algorithm compatibility, strength of encryption, export restrictions<br /> * Validate Strong Authentication options for generating the SAML token<br /> * IDP validation (which IDP mints the token)<br /> * Use/Trust Root CAs whenever possible<br /> * Synchronize to a common Internet timesource<br /> * Define levels of assurance for identity verification<br /> * Prefer asymmetric identifiers for identity assertions over personally identifiable information (e.g. SSNs, etc)<br /> <br /> == Last Mile Considerations ==<br /> * Validating session state for user<br /> * Level of granularity in setting authZ context when consuming SAML token (do you use groups, roles, attributes)<br /> * Validate authorized IDP<br /> * Validate IDP certificates for expiry against CRL/OCSP<br /> * Validate NotBefore and NotOnorAfter<br /> * Define criteria for SAML logout<br /> * Exchange assertions only over secure transports<br /> * Define criteria for session management<br /> <br /> = Input Validation =<br /> <br /> Just because SAML is a security protocol does not mean that input validation goes away. <br /> <br /> * Ensure that all SAML providers/consumers do proper [[Input_Validation_Cheat_Sheet | input validation]].<br /> <br /> <br /> = Authors and Primary Editors =<br /> <br /> * [http://bradbroulik.blogspot.dk/2010/01/bulletproof-sso-with-saml-20.html Brad Broulik]<br /> * [https://ipsec.pl/ Paweł Krawczyk]<br /> * Gunnar Peterson<br /> * James McGovern<br /> <br /> == Other Cheatsheets ==<br /> <br /> {{Cheatsheet_Navigation_Body}}<br /> <br /> |}<br /> <br /> [[Category:Cheatsheets]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=SAML_Security_Cheat_Sheet&diff=200079 2015-09-04T22:51:57Z

<p>Jm04469: /* Last Mile Considerations */</p> <hr /> <div> __NOTOC__<br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:Cheatsheets-header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' <br /> = Introduction =<br /> __TOC__{{TOC hidden}}<br /> <br /> The &lt;i&gt;Security Assertion Markup Language&lt;/i&gt; (SAML) is an open standard for exchanging authorization and authentication information. The &lt;i&gt;Web Browser SAML/SSO Profile with Redirect/POST bindings&lt;/i&gt; is one of the most common SSO implementation. This cheatsheet will focus primarily on that profile.<br /> <br /> <br /> = Validate Message Confidentiality and Integrity =<br /> <br /> * [[Transport Layer Protection Cheat Sheet|TLS 1.2]] is the most common solution to guarantee message confidentiality and integrity. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> ** Eavesdropping 7.1.1.1<br /> ** Theft of User Authentication Information 7.1.1.2<br /> ** Theft of the Bearer Token 7.1.1.3<br /> ** Message Deletion 7.1.1.6<br /> ** Message Modification 7.1.1.7<br /> ** Man-in-the-middle 7.1.1.8<br /> *A digitally signed message with a certified key is the most common solution to guarantee message integrity and authentication. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> **Man-in-the-middle 6.4.2<br /> **Forged Assertion 6.4.3<br /> <br /> <br /> =Validate Protocol Usage=<br /> <br /> This is a common area for security gaps - see [http://www.ai-lab.it/armando/pub/fmse9-armando.pdf Google SSO vulnerability] (AVANTSSAR 2008) for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profile] usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. The AVANTSSAR team suggested the following data elements should be required:<br /> <br /> * '''AuthnRequest(ID, SP);''' An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo=&quot;&lt;requestId&gt;&quot;). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.<br /> * '''Response(ID, SP, IdP, {AA} K -1/IdP);''' A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.<br /> * '''AuthAssert(ID, C, IdP, SP);''' An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.<br /> <br /> Further vulnerabilities in SAML implementations were described in 2012 ([https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91-8-23-12.pdf On Breaking SAML: Be Whoever You Want to Be]). The following recommendations were proposed in response ([http://arxiv.org/pdf/1401.7483v1.pdf Secure SAML validation to prevent XML signature wrapping attacks]):<br /> <br /> * Always perform schema validation on the XML document prior to using it for any security-­related purposes.<br /> ** Always use local, trusted copies of schemas for validation.<br /> ** Never allow automatic download of schemas from third party locations.<br /> ** If possible, inspect schemas and perform schema hardening, to disable possible wildcard ­type or relaxed processing statements.<br /> * Securely validate the digital signature.<br /> ** If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.<br /> ** If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.<br /> ** If you expect a heterogenous signed documents (many certificates from many identity providers, multi­level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.<br /> * Avoid signature-wrapping attacks.<br /> ** Never use getElementsByTagName to select security related elements in an XML document without prior validation.<br /> **Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.<br /> <br /> <br /> =Validate Protocol Processing Rules=<br /> <br /> This is another common area for security gaps simply because of the vast number of steps to assert. Processing a SAML response is an expensive operation but all steps must be validated.<br /> *Validate AuthnRequest processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML Core] (3.4.1.4) for all AuthnRequest processing rules. This step will help counter the following attacks:<br /> ** Man-in-the-middle (6.4.2)<br /> * Validate Response processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profiles] (4.1.4.3) for all Response processing rules. This step will help counter the following attacks:<br /> ** Stolen Assertion (6.4.1)<br /> ** Man-in-the-middle (6.4.2)<br /> ** Forged Assertion (6.4.3)<br /> ** Browser State Exposure (6.4.4)<br /> <br /> <br /> =Validate Binding Implementation=<br /> <br /> *For an HTTP Redirect Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.4). To view an encoding example, you may want to reference RequestUtil.java found within [https://developers.google.com/google-apps/sso/saml_reference_implementation_web Google's reference implementation].<br /> * For an HTTP POST Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.5). The caching considerations are also very important. If a SAML protocol message gets cached, it can subsequently be used as a Stolen Assertion (6.4.1) or Replay (6.4.5) attack.<br /> <br /> <br /> =Validate Security Countermeasures=<br /> <br /> Revisit each security threat that exists within the [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security] document and assert you have applied the appropriate countermeasures for threats that may exist for your particular implementation. Additional countermeasures considererd should include:<br /> *Prefer IP Filtering when appropriate. For example, this countermeasure could have prevented Google's initial security flaw if Google provided each trusted partner with a separate endpoint and setup an IP filter for each endpoint. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Man-in-the-middle (6.4.2)<br /> *Prefer short lifetimes on the SAML Response. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Browser State Exposure (6.4.4)<br /> *Prefer OneTimeUse on the SAML Response. This step will help counter the following attacks:<br /> **Browser State Exposure (6.4.4)<br /> **Replay (6.4.5)<br /> <br /> Need an architectural diagram? The [http://www.oasis-open.org/committees/download.php/11511/sstc-saml-tech-overview-2.0-draft-03.pdf SAML technical overview] contains the most complete diagrams. For the Web Browser SSO Profile with Redirect/POST bindings refer to the section 4.1.3. In fact, of all the SAML documentation, the technical overview is the most valuable from a high-level perspective.<br /> <br /> <br /> = First and Last Mile Considerations = <br /> <br /> The SAML protocol is rarely the vector of choice, though it's important to have cheatsheets to make sure that this is robust. The various endpoints are more targeted, so how the SAML token is generated and how it is consumed are both important in practice. <br /> <br /> == First Mile Considerations ==<br /> * Strong Authentication options for generating the SAML token<br /> * IDP validation (which IDP mints the token)<br /> * Use/Trust Root CAs whenever possible<br /> * Synchronize to a common Internet timesource<br /> * Define levels of assurance for identity verification<br /> * Prefer asymmetric identifiers for identity assertions over personally identifiable information (e.g. SSNs, etc)<br /> <br /> == Last Mile Considerations ==<br /> * Validating session state for user<br /> * Level of granularity in setting authZ context when consuming SAML token (do you use groups, roles, attributes)<br /> * Validate authorized IDP<br /> * Validate IDP certificates for expiry against CRL/OCSP<br /> * Validate NotBefore and NotOnorAfter<br /> * Define criteria for SAML logout<br /> * Exchange assertions only over secure transports<br /> * Define criteria for session management<br /> <br /> = Input Validation =<br /> <br /> Just because SAML is a security protocol does not mean that input validation goes away. <br /> <br /> * Ensure that all SAML providers/consumers do proper [[Input_Validation_Cheat_Sheet | input validation]].<br /> <br /> <br /> = Authors and Primary Editors =<br /> <br /> * [http://bradbroulik.blogspot.dk/2010/01/bulletproof-sso-with-saml-20.html Brad Broulik]<br /> * [https://ipsec.pl/ Paweł Krawczyk]<br /> * Gunnar Peterson<br /> * James McGovern<br /> <br /> == Other Cheatsheets ==<br /> <br /> {{Cheatsheet_Navigation_Body}}<br /> <br /> |}<br /> <br /> [[Category:Cheatsheets]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=SAML_Security_Cheat_Sheet&diff=200078 2015-09-04T22:41:57Z

<p>Jm04469: /* First Mile Considerations */</p> <hr /> <div> __NOTOC__<br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:Cheatsheets-header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' <br /> = Introduction =<br /> __TOC__{{TOC hidden}}<br /> <br /> The &lt;i&gt;Security Assertion Markup Language&lt;/i&gt; (SAML) is an open standard for exchanging authorization and authentication information. The &lt;i&gt;Web Browser SAML/SSO Profile with Redirect/POST bindings&lt;/i&gt; is one of the most common SSO implementation. This cheatsheet will focus primarily on that profile.<br /> <br /> <br /> = Validate Message Confidentiality and Integrity =<br /> <br /> * [[Transport Layer Protection Cheat Sheet|TLS 1.2]] is the most common solution to guarantee message confidentiality and integrity. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> ** Eavesdropping 7.1.1.1<br /> ** Theft of User Authentication Information 7.1.1.2<br /> ** Theft of the Bearer Token 7.1.1.3<br /> ** Message Deletion 7.1.1.6<br /> ** Message Modification 7.1.1.7<br /> ** Man-in-the-middle 7.1.1.8<br /> *A digitally signed message with a certified key is the most common solution to guarantee message integrity and authentication. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> **Man-in-the-middle 6.4.2<br /> **Forged Assertion 6.4.3<br /> <br /> <br /> =Validate Protocol Usage=<br /> <br /> This is a common area for security gaps - see [http://www.ai-lab.it/armando/pub/fmse9-armando.pdf Google SSO vulnerability] (AVANTSSAR 2008) for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profile] usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. The AVANTSSAR team suggested the following data elements should be required:<br /> <br /> * '''AuthnRequest(ID, SP);''' An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo=&quot;&lt;requestId&gt;&quot;). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.<br /> * '''Response(ID, SP, IdP, {AA} K -1/IdP);''' A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.<br /> * '''AuthAssert(ID, C, IdP, SP);''' An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.<br /> <br /> Further vulnerabilities in SAML implementations were described in 2012 ([https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91-8-23-12.pdf On Breaking SAML: Be Whoever You Want to Be]). The following recommendations were proposed in response ([http://arxiv.org/pdf/1401.7483v1.pdf Secure SAML validation to prevent XML signature wrapping attacks]):<br /> <br /> * Always perform schema validation on the XML document prior to using it for any security-­related purposes.<br /> ** Always use local, trusted copies of schemas for validation.<br /> ** Never allow automatic download of schemas from third party locations.<br /> ** If possible, inspect schemas and perform schema hardening, to disable possible wildcard ­type or relaxed processing statements.<br /> * Securely validate the digital signature.<br /> ** If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.<br /> ** If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.<br /> ** If you expect a heterogenous signed documents (many certificates from many identity providers, multi­level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.<br /> * Avoid signature-wrapping attacks.<br /> ** Never use getElementsByTagName to select security related elements in an XML document without prior validation.<br /> **Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.<br /> <br /> <br /> =Validate Protocol Processing Rules=<br /> <br /> This is another common area for security gaps simply because of the vast number of steps to assert. Processing a SAML response is an expensive operation but all steps must be validated.<br /> *Validate AuthnRequest processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML Core] (3.4.1.4) for all AuthnRequest processing rules. This step will help counter the following attacks:<br /> ** Man-in-the-middle (6.4.2)<br /> * Validate Response processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profiles] (4.1.4.3) for all Response processing rules. This step will help counter the following attacks:<br /> ** Stolen Assertion (6.4.1)<br /> ** Man-in-the-middle (6.4.2)<br /> ** Forged Assertion (6.4.3)<br /> ** Browser State Exposure (6.4.4)<br /> <br /> <br /> =Validate Binding Implementation=<br /> <br /> *For an HTTP Redirect Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.4). To view an encoding example, you may want to reference RequestUtil.java found within [https://developers.google.com/google-apps/sso/saml_reference_implementation_web Google's reference implementation].<br /> * For an HTTP POST Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.5). The caching considerations are also very important. If a SAML protocol message gets cached, it can subsequently be used as a Stolen Assertion (6.4.1) or Replay (6.4.5) attack.<br /> <br /> <br /> =Validate Security Countermeasures=<br /> <br /> Revisit each security threat that exists within the [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security] document and assert you have applied the appropriate countermeasures for threats that may exist for your particular implementation. Additional countermeasures considererd should include:<br /> *Prefer IP Filtering when appropriate. For example, this countermeasure could have prevented Google's initial security flaw if Google provided each trusted partner with a separate endpoint and setup an IP filter for each endpoint. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Man-in-the-middle (6.4.2)<br /> *Prefer short lifetimes on the SAML Response. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Browser State Exposure (6.4.4)<br /> *Prefer OneTimeUse on the SAML Response. This step will help counter the following attacks:<br /> **Browser State Exposure (6.4.4)<br /> **Replay (6.4.5)<br /> <br /> Need an architectural diagram? The [http://www.oasis-open.org/committees/download.php/11511/sstc-saml-tech-overview-2.0-draft-03.pdf SAML technical overview] contains the most complete diagrams. For the Web Browser SSO Profile with Redirect/POST bindings refer to the section 4.1.3. In fact, of all the SAML documentation, the technical overview is the most valuable from a high-level perspective.<br /> <br /> <br /> = First and Last Mile Considerations = <br /> <br /> The SAML protocol is rarely the vector of choice, though it's important to have cheatsheets to make sure that this is robust. The various endpoints are more targeted, so how the SAML token is generated and how it is consumed are both important in practice. <br /> <br /> == First Mile Considerations ==<br /> * Strong Authentication options for generating the SAML token<br /> * IDP validation (which IDP mints the token)<br /> * Use/Trust Root CAs whenever possible<br /> * Synchronize to a common Internet timesource<br /> * Define levels of assurance for identity verification<br /> * Prefer asymmetric identifiers for identity assertions over personally identifiable information (e.g. SSNs, etc)<br /> <br /> == Last Mile Considerations ==<br /> * Validating session state for user<br /> * Level of granularity in setting authZ context when consuming SAML token (do you use groups, roles, attributes)<br /> * Validate authorized IDP<br /> <br /> <br /> = Input Validation =<br /> <br /> Just because SAML is a security protocol does not mean that input validation goes away. <br /> <br /> * Ensure that all SAML providers/consumers do proper [[Input_Validation_Cheat_Sheet | input validation]].<br /> <br /> <br /> = Authors and Primary Editors =<br /> <br /> * [http://bradbroulik.blogspot.dk/2010/01/bulletproof-sso-with-saml-20.html Brad Broulik]<br /> * [https://ipsec.pl/ Paweł Krawczyk]<br /> * Gunnar Peterson<br /> * James McGovern<br /> <br /> == Other Cheatsheets ==<br /> <br /> {{Cheatsheet_Navigation_Body}}<br /> <br /> |}<br /> <br /> [[Category:Cheatsheets]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=SAML_Security_Cheat_Sheet&diff=200077 2015-09-04T22:38:43Z

<p>Jm04469: /* Authors and Primary Editors */</p> <hr /> <div> __NOTOC__<br /> &lt;div style=&quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&quot;&gt;[[File:Cheatsheets-header.jpg|link=]]&lt;/div&gt;<br /> <br /> {| style=&quot;padding: 0;margin:0;margin-top:10px;text-align:left;&quot; |-<br /> | valign=&quot;top&quot; style=&quot;border-right: 1px dotted gray;padding-right:25px;&quot; |<br /> Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' <br /> = Introduction =<br /> __TOC__{{TOC hidden}}<br /> <br /> The &lt;i&gt;Security Assertion Markup Language&lt;/i&gt; (SAML) is an open standard for exchanging authorization and authentication information. The &lt;i&gt;Web Browser SAML/SSO Profile with Redirect/POST bindings&lt;/i&gt; is one of the most common SSO implementation. This cheatsheet will focus primarily on that profile.<br /> <br /> <br /> = Validate Message Confidentiality and Integrity =<br /> <br /> * [[Transport Layer Protection Cheat Sheet|TLS 1.2]] is the most common solution to guarantee message confidentiality and integrity. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> ** Eavesdropping 7.1.1.1<br /> ** Theft of User Authentication Information 7.1.1.2<br /> ** Theft of the Bearer Token 7.1.1.3<br /> ** Message Deletion 7.1.1.6<br /> ** Message Modification 7.1.1.7<br /> ** Man-in-the-middle 7.1.1.8<br /> *A digitally signed message with a certified key is the most common solution to guarantee message integrity and authentication. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security (section 4)] for additional information. This step will help counter the following attacks:<br /> **Man-in-the-middle 6.4.2<br /> **Forged Assertion 6.4.3<br /> <br /> <br /> =Validate Protocol Usage=<br /> <br /> This is a common area for security gaps - see [http://www.ai-lab.it/armando/pub/fmse9-armando.pdf Google SSO vulnerability] (AVANTSSAR 2008) for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profile] usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. The AVANTSSAR team suggested the following data elements should be required:<br /> <br /> * '''AuthnRequest(ID, SP);''' An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo=&quot;&lt;requestId&gt;&quot;). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.<br /> * '''Response(ID, SP, IdP, {AA} K -1/IdP);''' A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.<br /> * '''AuthAssert(ID, C, IdP, SP);''' An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.<br /> <br /> Further vulnerabilities in SAML implementations were described in 2012 ([https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91-8-23-12.pdf On Breaking SAML: Be Whoever You Want to Be]). The following recommendations were proposed in response ([http://arxiv.org/pdf/1401.7483v1.pdf Secure SAML validation to prevent XML signature wrapping attacks]):<br /> <br /> * Always perform schema validation on the XML document prior to using it for any security-­related purposes.<br /> ** Always use local, trusted copies of schemas for validation.<br /> ** Never allow automatic download of schemas from third party locations.<br /> ** If possible, inspect schemas and perform schema hardening, to disable possible wildcard ­type or relaxed processing statements.<br /> * Securely validate the digital signature.<br /> ** If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.<br /> ** If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.<br /> ** If you expect a heterogenous signed documents (many certificates from many identity providers, multi­level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.<br /> * Avoid signature-wrapping attacks.<br /> ** Never use getElementsByTagName to select security related elements in an XML document without prior validation.<br /> **Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.<br /> <br /> <br /> =Validate Protocol Processing Rules=<br /> <br /> This is another common area for security gaps simply because of the vast number of steps to assert. Processing a SAML response is an expensive operation but all steps must be validated.<br /> *Validate AuthnRequest processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML Core] (3.4.1.4) for all AuthnRequest processing rules. This step will help counter the following attacks:<br /> ** Man-in-the-middle (6.4.2)<br /> * Validate Response processing rules. Refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML Profiles] (4.1.4.3) for all Response processing rules. This step will help counter the following attacks:<br /> ** Stolen Assertion (6.4.1)<br /> ** Man-in-the-middle (6.4.2)<br /> ** Forged Assertion (6.4.3)<br /> ** Browser State Exposure (6.4.4)<br /> <br /> <br /> =Validate Binding Implementation=<br /> <br /> *For an HTTP Redirect Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.4). To view an encoding example, you may want to reference RequestUtil.java found within [https://developers.google.com/google-apps/sso/saml_reference_implementation_web Google's reference implementation].<br /> * For an HTTP POST Binding refer to [http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf SAML Binding] (3.5). The caching considerations are also very important. If a SAML protocol message gets cached, it can subsequently be used as a Stolen Assertion (6.4.1) or Replay (6.4.5) attack.<br /> <br /> <br /> =Validate Security Countermeasures=<br /> <br /> Revisit each security threat that exists within the [http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf SAML Security] document and assert you have applied the appropriate countermeasures for threats that may exist for your particular implementation. Additional countermeasures considererd should include:<br /> *Prefer IP Filtering when appropriate. For example, this countermeasure could have prevented Google's initial security flaw if Google provided each trusted partner with a separate endpoint and setup an IP filter for each endpoint. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Man-in-the-middle (6.4.2)<br /> *Prefer short lifetimes on the SAML Response. This step will help counter the following attacks:<br /> **Stolen Assertion (6.4.1)<br /> **Browser State Exposure (6.4.4)<br /> *Prefer OneTimeUse on the SAML Response. This step will help counter the following attacks:<br /> **Browser State Exposure (6.4.4)<br /> **Replay (6.4.5)<br /> <br /> Need an architectural diagram? The [http://www.oasis-open.org/committees/download.php/11511/sstc-saml-tech-overview-2.0-draft-03.pdf SAML technical overview] contains the most complete diagrams. For the Web Browser SSO Profile with Redirect/POST bindings refer to the section 4.1.3. In fact, of all the SAML documentation, the technical overview is the most valuable from a high-level perspective.<br /> <br /> <br /> = First and Last Mile Considerations = <br /> <br /> The SAML protocol is rarely the vector of choice, though it's important to have cheatsheets to make sure that this is robust. The various endpoints are more targeted, so how the SAML token is generated and how it is consumed are both important in practice. <br /> <br /> == First Mile Considerations ==<br /> * Strong Authentication options for generating the SAML token<br /> * IDP validation (which IDP mints the token)<br /> <br /> == Last Mile Considerations ==<br /> * Validating session state for user<br /> * Level of granularity in setting authZ context when consuming SAML token (do you use groups, roles, attributes)<br /> * Validate authorized IDP<br /> <br /> <br /> = Input Validation =<br /> <br /> Just because SAML is a security protocol does not mean that input validation goes away. <br /> <br /> * Ensure that all SAML providers/consumers do proper [[Input_Validation_Cheat_Sheet | input validation]].<br /> <br /> <br /> = Authors and Primary Editors =<br /> <br /> * [http://bradbroulik.blogspot.dk/2010/01/bulletproof-sso-with-saml-20.html Brad Broulik]<br /> * [https://ipsec.pl/ Paweł Krawczyk]<br /> * Gunnar Peterson<br /> * James McGovern<br /> <br /> == Other Cheatsheets ==<br /> <br /> {{Cheatsheet_Navigation_Body}}<br /> <br /> |}<br /> <br /> [[Category:Cheatsheets]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=175630 2014-05-23T11:55:03Z

<p>Jm04469: /* Upcoming Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 27th 2014'''&lt;br&gt;<br /> OWASP Mobile Top Ten Risks 2014 – The New M10: ‘Lack of Binary Protection’ Category&lt;br&gt;<br /> Senior Security Engineer at Arxan Technologies &lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> IDaaS (Cloud) Landscape - Why Companies are Shifting Strategies Toward Cloud-Based Identity Management vs. Traditional Security Methods?&lt;br&gt;<br /> Tarek Khaled, Senior Security Engineer at Okta&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=175629 2014-05-23T11:54:43Z

<p>Jm04469: </p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 27th 2014'''&lt;br&gt;<br /> OWASP Mobile Top Ten Risks 2014 – The New M10: ‘Lack of Binary Protection’ Category&lt;br&gt;<br /> Senior Security Engineer at Arxan Technologies &lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> IDaaS (Cloud) Landscape - Why Companies are Shifting Strategies Toward Cloud-Based Identity Management vs. Traditional Security Methods?&lt;br&gt;<br /> Tarek Khaled, Senior Security Engineer at Okta&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting was held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Governance/ProjectProgramModels&diff=174411 2014-05-06T19:19:36Z

<p>Jm04469: /* Additional Comments */</p> <hr /> <div>= Purpose = <br /> OWASP needs help from our community to define an OWASP Projects Program model that will meet the needs of our leaders. To do so we are engaging the community to discuss and flush out different options. We would like to have a vote on this to ensure that the community has a say in how the foundation moves forward. <br /> <br /> = The Options =<br /> ''Please feel free to add additional bullets to any of the cells. Please do not remove existing items.''<br /> <br /> {| {{table border=1}}<br /> | align=&quot;center&quot; style=&quot;background:#f0f0f0;&quot;|'''Option'''<br /> | align=&quot;center&quot; style=&quot;background:#f0f0f0;&quot;|'''1 - Flagships get majority of resources to increase quality.'''<br /> | align=&quot;center&quot; style=&quot;background:#f0f0f0;&quot;|'''2 - Develop two separate programs: Quality focused and Innovation focused'''<br /> | align=&quot;center&quot; style=&quot;background:#f0f0f0;&quot;|'''3 - Community project review centric model'''<br /> |-<br /> | '''Summary Description'''<br /> ||&lt;!--Option 1--&gt;<br /> Drop the Lab designation, and only have Incubator and Flagship projects. Flagship project status would be determined by community vote, and our resources would go towards developing Flagship projects, based on community input. Incubators would get less attention and support. <br /> *Keeps both Flagships and Incubators under the same program (as official &quot;OWASP Projects&quot;).<br /> *Would remove resources from Incubators and funnel the majority of resources into the Flagship Projects. <br /> ||&lt;!--Option 2--&gt;<br /> Separate focus of OWASP projects into two separate programs. One will focus on increasing the quality of a handful of projects selected by the community, and the other program will focus on developing a platform for new leaders that facilitates innovation, research, and testing. <br /> *Takes two community requests (increase quality, platform for innovation), and separate each request into to programs.<br /> *Allows the foundation to have clearly defined goals for each program. <br /> ||&lt;!--Option 3--&gt;<br /> This is the approach we are currently using. This approach requires that the community conduct project reviews to graduate projects, and it requires a twice yearly project audit to demote projects that are currently inactive.<br /> *Current approach<br /> *Requires a large task force of community reviewers to make sure our project graduation process is functioning efficiently. <br /> |-<br /> | '''How are Flagships Selected?'''<br /> ||Community Vote<br /> ||Community Vote<br /> ||Community Project Health and Quality Reviews<br /> |-<br /> | '''New Project Designations'''<br /> ||<br /> *Official OWASP Project: Projects that OWASP actively maintains and promotes. In reality, these are what flagship projects should be under the current system. The majority of our resources and time should be used to improve the quality and sustain these projects. <br /> *OWASP Supported Projects: These would be similar to what the incubators are under our current system. Encourages innovation and it allows starting members to become engaged and involved. These can be managed in the same way we manage incubators now. <br /> *OWASP Sunset Projects: Projects like ESAPI or WebScarab would fit under this title. These are projects that are still being used by consumers, but that we will not directly support as they are not actively maintained or being worked on. <br /> ||<br /> *OWASP Flagship Project: Projects that OWASP actively maintains and promotes. The majority of our resources and time would be used to improve the quality and sustain these projects. <br /> *OWASP Incubator Projects: These would be all of the rest of our projects. These can be managed in the same way we manage incubators and lab projects now. <br /> *OWASP Sunset Projects: This is the same as Proposal 1. Projects like ESAPI or WebScarab would fit under this title. These are projects that are still being used by consumers, but that we will not directly support as they are not actively maintained or being worked on. <br /> ||<br /> *OWASP Flagship Project: Projects that OWASP actively maintains (but does not manage) and promotes.<br /> *OWASP Lab Projects: Projects with beta or stable release that wish to graduate to Lab. <br /> *OWASP Incubator Projects: All new projects, managed the same way we manage incubators projects now. <br /> *OWASP Sunset Projects: Projects like ESAPI or WebScarab would fit under this title. These are projects that are still being used by consumers, but that we will not directly support as they are not actively maintained or being worked on. <br /> |-<br /> | '''Project Quality'''<br /> ||&lt;!--Option 1--&gt;<br /> Consolidate Foundation resources to help improve quality of Flagship projects only. This will give the majority of our resources to a handful of projects.<br /> ||&lt;!--Option 2--&gt;<br /> *Flagship Project Program: As mentioned above, these projects would be the ones OWASP actively maintains and seeks to increase the quality of. We can re-name this program (if necessary). Recommended that we limit the number of projects in this program for any given year (i.e. no more than 6 projects). Additionally, Flagship projects would be voted on by the community (which projects should be flagship). <br /> *'''Primary Goal of the Program''': To increase the quality of a select few number of OWASP projects selected by our community stakeholders and consumers. <br /> *OWASP Projects Program: This would be similar to what we have now which is a platform for research and innovation. All projects under this platform would have the same designation unless they are sunset or inactive projects. They would get the same benefits they do now and the same opportunities. <br /> *'''Primary Goal of the Program''': To maintain a research and innovation platform for our community to test ideas and theories. <br /> ||&lt;!--Option 3--&gt;<br /> The foundation has no direct influence over the quality of the project. The quality of the project is dependent on the project leader’s individual time, resources, and output. <br /> |-<br /> | '''Project Reviews'''<br /> ||&lt;!--Option 1--&gt;<br /> The Foundation facilitates a technical review of the community selected &quot;Official&quot; projects once a year, and the Incubator projects only get reviewed if they ask for one. The reviews are conducted by the community for supported projects. <br /> ||&lt;!--Option 2--&gt;<br /> *For the OWASP Projects Program, we would only conduct reviews for those projects that ask for them. The reviews will be primarily to give feedback to the leader about their research/ideas and on their project health. <br /> *For the Flagship Program, reviews would be mandatory, and I recommend the new technical person conduct them. I further recommend they be done every quarter for each project. It is far more manageable since we would only have 6 or so projects in this program. <br /> ||&lt;!--Option 3--&gt;<br /> Project reviews are only done for those projects that want reviews, or that would like to graduate to the next level.<br /> |-<br /> | '''Resources and Funding'''<br /> ||&lt;!--Option 1--&gt;<br /> The majority of our resources and funding will go towards the development of higher quality Official OWASP projects. Supported projects will still have access to resources, but they will be minimal. <br /> ||&lt;!--Option 2--&gt;<br /> Each program would need to have their own budget. The Flagship program would only spend their funds on items that increase project quality. It would be required that flagship submit a detailed project plan and budget. The Projects Program would have a budget that would fund items like project dev work, the project summit, OSS, marketing/design costs, etc. <br /> ||&lt;!--Option 3--&gt;<br /> All projects get access to funding; however, Flagships get priority for funding for project development work. Funding items like project dev work, the project summit, OSS, marketing/design costs, etc are still available to all projects. <br /> |-<br /> | '''Positives of this approach'''<br /> || &lt;!--Option 1--&gt;<br /> # Simplifies the process from an operational perspective as we would be primarily focusing on increasing the quality of a very small community selected group of projects. <br /> # Increases community involvement. <br /> # Incentivizes Leaders to make their projects user friendly, high quality, and highly volunteer engaged.<br /> ||&lt;!--Option 2--&gt;<br /> # Separates two different focus areas into two separate programs.<br /> # Increases community involvement. <br /> # Incentivizes Leaders to make their projects user friendly, high quality, and highly volunteer engaged.<br /> ||&lt;!--Option 3--&gt;<br /> # No adaptation needed in the operational and financial plan for 2014<br /> |-<br /> | '''Negatives of this approach'''<br /> ||&lt;!--Option 1--&gt;<br /> # Community vote might turn into a popularity contest. <br /> # OWASP Official projects will take the majority of resources from all other projects. <br /> # We will still have two separate focus areas under one program. <br /> # Project development work will still be dependent on volunteer resources. <br /> ||&lt;!--Option 2--&gt;<br /> # Will require an additional foundation hire to manage Flagship Project Program. <br /> # Project development work will still be dependent on volunteer resources. <br /> ||&lt;!--Option 3--&gt;<br /> # The model requires too many resources to manage efficiently.<br /> # Foundation has no direct influence over project quality. Foundation can only suggest improvements. <br /> |-<br /> | '''Any other considerations'''<br /> ||&lt;!--Option 1--&gt;<br /> # ...<br /> ||&lt;!--Option 2--&gt;<br /> # ...<br /> <br /> ||&lt;!--Option 3--&gt;<br /> # <br /> <br /> |}<br /> <br /> = Additional Comments =<br /> Use this space to provide additional comments on any of the existing text. For example, perhaps you disagree with something that is above. Please note your thoughts in this section.<br /> <br /> # James McGovern - I can't quite tell if this model will provide service equally to builders vs breakers vs defenders. Has OWASP looked at models that are role-aligned? For example stuff that CISOs care about vs developers vs project managers, etc</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=159838 2013-10-07T14:54:06Z

<p>Jm04469: /* Upcoming Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 6:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=159837 2013-10-07T14:53:39Z

<p>Jm04469: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 7:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, June 6th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> This meeting will be held at the Travelers in Hartford<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting was held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=159836 2013-10-07T14:52:14Z

<p>Jm04469: /* Upcoming Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 7:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting will be held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=159835 2013-10-07T14:51:53Z

<p>Jm04469: /* Upcoming Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, October 22nd 2013'''&lt;br&gt;<br /> Mobile Security: Attacks and Defenses&lt;br&gt;<br /> Gene Meltser, Technical Director, Neohapsis Labs&lt;br&gt;<br /> 5:00 PM to 6:00 PM&lt;br&gt;<br /> &lt;br&gt;&lt;br&gt;<br /> An Application Pen Tester's introduction to Android Internals&lt;br&gt;<br /> Tom Palarz, Senior Security Consultant, Neohapsis Labs&lt;br&gt;<br /> 7:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting will be held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=159834 2013-10-07T14:49:06Z

<p>Jm04469: /* Call for Sponsors/Speakers */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Hacking Amazon Cloud<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Hacking Medical Devices<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, June 25th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> 5:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting will be held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=153668 2013-06-14T13:23:41Z

<p>Jm04469: </p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Cloud Security with a focus on PAAS<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Mobile Security<br /> * Entitlements Management<br /> * Advanced Persistent Threats<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, June 25th 2013'''&lt;br&gt;<br /> Building a Better Botnet&lt;br&gt;<br /> Michael Smith, Akamai&lt;br&gt;<br /> 5:00 PM to 7:00 PM&lt;br&gt;<br /> This meeting will be held at Travelers, Hartford CT (Central Row Conference Room)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting will be held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting was be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting was held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=149990 2013-04-17T15:42:06Z

<p>Jm04469: /* Upcoming Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Cloud Security with a focus on PAAS<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Mobile Security<br /> * Entitlements Management<br /> * Advanced Persistent Threats<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting will be held at the ACORD LOMA Forum in Las Vegas<br /> &lt;br&gt;&lt;br&gt;<br /> '''Agenda: Wednesday, April 24th 2013'''&lt;br&gt;<br /> Cloud and Identity&lt;br&gt;<br /> George Dobbs, Enterprise Architect - MassMutual&lt;br&gt;<br /> 8:30 AM to Noon&lt;br&gt;<br /> This meeting will be held at IBM, 755 Main Street, Hartford CT (The Gold Building)<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting will be held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]<br /> [[Category:Inactive Chapter]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=149988 2013-04-17T15:38:29Z

<p>Jm04469: /* Upcoming Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Cloud Security with a focus on PAAS<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Mobile Security<br /> * Entitlements Management<br /> * Advanced Persistent Threats<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting will be held at the ACORD LOMA Forum in Las Vegas<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting will be held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]<br /> [[Category:Inactive Chapter]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=149502 2013-04-09T20:16:38Z

<p>Jm04469: </p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leaders are [mailto:james.mcgovern@hp.com James McGovern] and [mailto:npatloll@travelers.com Narendra Patlolla]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.travelers.com/ Travelers], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:james.mcgovern@hp.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Cloud Security with a focus on PAAS<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Mobile Security<br /> * Entitlements Management<br /> * Advanced Persistent Threats<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting will be held at the ACORD LOMA Forum in Las Vegas&lt;/br&gt;<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting will be held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]<br /> [[Category:Inactive Chapter]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=149501 2013-04-09T20:13:45Z

<p>Jm04469: </p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is [mailto:owasp@jamesmcgovern.com James McGovern]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Cloud Security with a focus on PAAS<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Mobile Security<br /> * Entitlements Management<br /> * Advanced Persistent Threats<br /> * Misuse/abuse cases for business analysts<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Upcoming Events ==<br /> <br /> '''Agenda: Tuesday, May 6th 2013'''&lt;br&gt;<br /> Web Services Security&lt;br&gt;<br /> James McGovern, HP Enterprise Services&lt;br&gt;<br /> This meeting will be held at the ACORD LOMA Forum in Las Vegas&lt;/br&gt;<br /> <br /> == Postponed Events ==<br /> <br /> '''Agenda: Tuesday, April 16th 2013'''&lt;br&gt;<br /> Why We Need DevOps Now: A Fourteen Year Study Of High Performing IT Organizations &lt;br&gt;<br /> Gene Kim - CTO of Tripwire&lt;br&gt;<br /> This meeting will be held at Travelers in Downtown Hartford&lt;/br&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting will be held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]<br /> [[Category:Inactive Chapter]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=140328 2012-11-27T21:38:33Z

<p>Jm04469: </p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is &lt;!-- [mailto:owasp@jamesmcgovern.com James McGovern]--&gt;|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Cloud Security with a focus on PAAS<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Mobile Security<br /> * Entitlements Management<br /> * Advanced Persistent Threats<br /> * Misuse/abuse cases for business analysts<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Wednesday, October 24th 2012'''&lt;br&gt;<br /> International Institute of Business Analysts (IIBA) Joint Meeting&lt;br&gt;<br /> James McGovern - Introduction to Security for Business Analysts&lt;br&gt;<br /> This meeting will be held at Chubb in Simsbury&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, September 26th 2012'''&lt;br&gt;<br /> Joint Meeting with OWASP Student Chapter&lt;br&gt;<br /> Introduction to Network Security&lt;br&gt;<br /> Anthony DAmato&lt;/br&gt;<br /> <br /> '''Agenda: Wednesday, May 23rd 2012'''&lt;br&gt;<br /> Introduction to SOA Security&lt;br&gt;<br /> James McGovern&lt;br&gt;<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> [[Category:OWASP Chapter]]<br /> [[Category:Connecticut]]<br /> [[Category:Inactive Chapter]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=111685 2011-06-03T13:08:08Z

<p>Jm04469: /* Call for Sponsors/Speakers */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is [mailto:owasp@jamesmcgovern.com James McGovern]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Cloud Security with a focus on PAAS<br /> * Breaking CAPTCHA<br /> * Threat modeling<br /> * Mobile Security<br /> * Entitlements Management<br /> * Advanced Persistent Threats<br /> * Misuse/abuse cases for business analysts<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=111684 2011-06-03T13:06:29Z

<p>Jm04469: /* Sponsors */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is [mailto:owasp@jamesmcgovern.com James McGovern]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.hp.com/ HP], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> &lt;br&gt;&lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Agile Software Development and Security<br /> * Breaking CAPTCHA<br /> * Hacking Identity 2.0<br /> * Breaking Commercial Software for Fun and Profit<br /> * Tactics for breaking software licensing schemes<br /> * Threat modeling<br /> * Advanced Persistent Threats<br /> * Hacking Mainframes/RACF<br /> * PCI/DSS Compliance<br /> * Misuse/abuse cases for business analysts<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Summit_2011/Open_letter_to_WebAppSec_Tool_and_Services_vendors:_Release_your_schemas_and_allow_automation&diff=104051 2011-02-07T13:50:29Z

<p>Jm04469: </p> <hr /> <div>&lt;BR&gt;__TOC__&lt;BR&gt;<br /> '''IMPORTANT DISCLAIMER: THIS LETTER IS NOT AN OFFICIAL OWASP POSITION. THE OWNERSHIP OF ITS REQUEST BELONGS TO THE NAMES UNDER THE 'SIGNED BY' SECTION'''<br /> &lt;br/&gt;&lt;br/&gt;<br /> {{:Summit_2011/Open_letter_to_WebAppSec_Tool_and_Services_vendors:_Release_your_schemas_and_allow_automation/Letter_Content}}<br /> &lt;br/&gt;&lt;br/&gt;<br /> ==Signed by==<br /> * Dinis Cruz - Application Security Consultant - Independent<br /> * Sebastien Deleersnyder - Managing Technical Consultant - SAIT Zenitel<br /> * Jim Manico - CEO - Infrared Security<br /> * Alexander Meisel - CTO - art of defence<br /> * Sven Vetsch - Senior Security Tester - Dreamlab Technologies<br /> * Daniel Cuthbert - Assessment Manager - SensePost<br /> * Eoin Keary - EMEIA Attack &amp; Penetration Senior Manager - Ernst &amp; Young<br /> * Anurag Agarwal - Founder - MyAppSecurity<br /> * Zaki Akhmad - Security Analyst - indocisc<br /> * Sebastien Gioria - Head of Security and IT Audit - Groupe Y<br /> * Paolo Perego - Application Security Specialist - armoredcode.com<br /> * Steven van der Baan - Software Architect - Sogeti Nederland<br /> * Andres Andreu - CTO &amp; Founder - neuroFuzz<br /> * Marinus Kuivenhoven - Sr. Security Specialist - Sogeti Nederland<br /> * James McGovern - Chief Security Architect - The Hartford<br /> <br /> <br /> Please use the format: {Name - Role - Company}<br /> <br /> ==Vendors that commit to deliver the requested materials==<br /> * art of defence</div>

Jm04469 https://wiki.owasp.org/index.php?title=Category:OWASP_Speakers_Project&diff=97389 2010-12-21T16:02:29Z

<p>Jm04469: /* available speakers */</p> <hr /> <div>This program lead by [[:user:Knoblochmartin|Martin Knobloch]] helps local chapters or application security conferences to find OWASP related speakers to have OWASP presenters on site.<br /> <br /> This program allows two parties to find each other:<br /> <br /> * Local chapters or application security events that want to attract an OWASP speaker<br /> * OWASP speakers to entertain OWASP presentations and that want to see the world<br /> <br /> For sponsorship, see the [[:Category:OWASP_on_the_Move_Project|OWASP on the Move Project]] page<br /> <br /> == available presentations ==<br /> <br /> == available speakers ==<br /> <br /> If you want to (re)do an OWASP related presentation, propose them here with your availability boundaries (timing/geographical) <br /> <br /> *Add your name, contact and bio information to become available as OWASP Speaker!<br /> <br /> {| class=&quot;prettytable&quot;<br /> |-<br /> ! Name <br /> ! Introduction <br /> ! Available Area <br /> ! Bios<br /> |-<br /> | [mailto:Robert(at)ZakonGroup.com Robert H'obbes' Zakon] <br /> | Presenter on Web Application Security, OWASP Top 10, PHP Security, and assorted other topics. Training sessions taught at events such as [http://www.zakongroup.com/technology/services-training.shtml OWASP, ACSAC, and CCS]. Based in New Hampshire, and available for travel worldwide. Fluent in English, and able to converse in Portuguese. A developer and consultant for the past decade, formerly a Principal Engineer with MITRE's InfoSec Group. <br /> | Global (USA/NH-based) <br /> | [http://www.zakon.org/robert/vitae.html BIO]<br /> |-<br /> | [mailto:jmcgovern@virtusa.com James McGovern] <br /> | Presenter on Enterprise Architecture and Web Application Security, SOA Web Services Security and Federated Identity. <br /> | Global (USA/CT-based) <br /> | [http://www.linkedin.com/in/jamesmcgovern BIO]<br /> |-<br /> | [mailto:chuck(at)McCulloughAssociates.com Chuck McCullough] <br /> | Chuck provides training sessions to developers on the Top 10. Chuck welcomes speaking opportunities to any group. Chuck is available in the Texas area and at various other locations in the USA. <br /> | USA/Texas <br /> | [http://www.linkedin.com/in/chuckmccullough BIO]<br /> |-<br /> | Marc Curphey <br /> | Marc will happily speak about the WebAppSec industry, SDLC etc. around Europe. You can see him in action at [http://video.hitb.org/2006.html HITB with John Viega] (big download) <br /> | Europe <br /> | [http://www.linkedin.com/in/curphey BIO]<br /> |-<br /> | [mailto:tomb(at)owasp.org Tom Brennan] <br /> | based in NYC Metro Tom is a long time volunteer and OWASP contributor and [http://www.owasp.org/index.php/About_OWASP Global Board Member]. As a security evangelist for [http://www.whitehatsec.com WhiteHat Security] top frequently talks about application security including the [http://www.owasp.org/images/0/06/WPstats_fall09_8th.pdf &quot;Stats Report&quot;]. He is available for global speaking venues to educate audiences about the OWASP Foundation core mission, how it works and various projects. In addition he also provides regular talks on honeypot research and case-studies about tactical experiences when conducting [http://en.wikipedia.org/wiki/Red_Team Red Team]/Tiger Team assessments involving the application, network, wireless and physical security. <br /> | Global <br /> | [http://www.linkedin.com/in/tombrennan BIO]<br /> |-<br /> | [mailto:thesp0nge@owasp.org Paolo Perego] <br /> | Paolo is available to talk about [http://www.owasp.org/index.php/Category:OWASP_Orizon_Project Orizon project], safe coding and code review issues around Europe in the near October-December. <br /> | Europe <br /> | [http://www.linkedin.com/in/thesp0nge BIO]<br /> |-<br /> | [mailto:marc.m.morana@gmail.org Marco Morana] <br /> | Marco is available to talk about [http://iac.dtic.mil/iatac/download/security.pdf Software Security Frameworks]and Secure Code Reviews [https://www.cmpevents.com/CSI33/a.asp?option=G&amp;V=3&amp;id=443342 see 07 CSI conference as reference] in USA around November-December and in Europe around January-February <br /> | Europe <br /> | [http://www.linkedin.com/pub/2/a7a/59b BIO]<br /> |-<br /> | [mailto:sebastien.gioria@owasp.fr Sébastien Gioria] <br /> | Sebastien is available to talk about WebAppSec, educational purpose on AppSec in French or at least in english around France/Europe/Canada from middle of March 08. You can find some Talk on the [http://www.owasp.fr Owasp France Chapter] <br /> | France/Europe/Canada <br /> | [http://www.linkedin.com/in/gioria BIO]<br /> |-<br /> | [mailto:mkraushar@gmail.com Mordecai Kraushar] <br /> | Mordecai is available to talk about different topics within the Web application security space. One discussion involves the OWASP project [http://www.owasp.org/index.php/Category:OWASP_Vicnum_Project Vicnum], a flexible vulnerable web application that can be used in 'capture the flag' exercises. <br /> | Northeastern United States <br /> | [http://www.linkedin.com/in/mkraushar BIO]<br /> |-<br /> | [mailto:michael.coates@owasp.org Michael Coates] <br /> | Michael is available to talk on a variety of web application security topics. Talks are interactive and include live demos and code examples. Michael has spoken at multiple OWASP conferences and University security courses on topics such as Introduction to Application Security, Automated Defense Systems in Applications, Real Time Detection and Prevention of Application Worms, and security risks in SSL/TLS. Michael is based in &lt;strike&gt;Chicago&lt;/strike&gt; San Francisco and able to travel where needed. <br /> | USA/San Francisco <br /> | [http://www.linkedin.com/in/mcoates BIO]<br /> |-<br /> | [mailto:dan.cornell@owasp.org Dan Cornell] <br /> | Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. He speaks on a variety of software development and software security topics such as Vulnerability Management, Software Security Remediation, and Code Review/Static Analysis. Dan is based in San Antonio, TX and available to fly/drive as needed to the site. <br /> | USA/San Antonio <br /> | [http://www.denimgroup.com/about_team_dan.html BIO]<br /> |-<br /> | [mailto:John.Steven@owasp.org John Steven] <br /> | John speaks on a variety of topics including &quot;How to build your own application security group&quot;, &quot;Threat Modeling&quot;, &quot;Code Review and Static analysis&quot;, as well as other topics. John has spoken at and given tutorials for multiple OWASP conferences. John frequents New York, Boston, Washington DC, and Charlotte, but is available for travel elsewhere. <br /> | Washington, DC/USA <br /> | [http://www.cigital.com/about/team/management.php#jsteven BIO]<br /> |-<br /> | [mailto:blake@owasp.org Blake Cornell] <br /> | Blake is available to speak regarding topics including Security v. HIPPA, Penetration Testing Methodologies, Fuzzing and Blended Threats such as attacking VoIP with the OWASP Top 10. Blake lives in the NY Metro area and is available for speaking at regional, national and world wide events. <br /> | New York, NY/USA <br /> | [http://www.linkedin.com/in/blakecornell BIO]<br /> |-<br /> | [mailto:Nick.Coblentz@gmail.com Nick Coblentz] <br /> | Nick regularly performs research related to secure software development. He is available to present on topics such as the [http://www.owasp.org/index.php/Category:Software_Assurance_Maturity_Model Software Assurance Maturity Model (SAMM)], the [http://nickcoblentz.blogspot.com/2009/06/samm-inteview-template-version-10.html SAMM Interview Template], [http://nickcoblentz.blogspot.com/2009/05/issa-journal-web-application-security.html Building Web Application Security Portfolios], and [http://nickcoblentz.blogspot.com/2009/11/owasp-presentation-on-dec-10-microsoft.html The Microsoft SDL for Agile Development]. Please email Nick if you see articles on his [http://nickcoblentz.blogspot.com/ blog] that you would like him to present. <br /> | USA/Kansas, Oklahoma, Missouri <br /> | [http://www.linkedin.com/in/ncoblentz BIO]<br /> |-<br /> | [mailto:johnccr@yahoo.com Juan Carlos Calderon] <br /> | Juan has being part of the Appliction Security industry for 9 years, currently performs research on application and information security arena. He is available to present &quot;Preparing an strategy for application vulnerability detection&quot;, &quot;Owasp Spanish and Internationalization&quot; and &quot;Análisis y efectos del cibercrimen en Mexico&quot;(Analysis and effects of cibercrime in México). He is also open to talk about other topics related to OWASP materials and tools, send him a note to verify the coverage. <br /> | Aguascalientes/México <br /> | [http://www.linkedin.com/in/juancarloscalderon BIO]<br /> |}<br /> <br /> *Add your name, contact and bio information to become available as OWASP Speaker!</div>

Jm04469 https://wiki.owasp.org/index.php?title=Category:OWASP_XML_Security_Gateway_Evaluation_Criteria_Project&diff=97388 2010-12-21T15:56:56Z

<p>Jm04469: </p> <hr /> <div>{{:Template:Orphaned Projects}}<br /> <br /> <br /> ==== Main ====<br /> <br /> == Welcome to the XML Security Gateway Evaluation Criteria Project ==<br /> <br /> This OWASP Project defines an open standard for evaluating XML Security Gateways. This criteria will provide the OWASP community a set of standard evaluation criteria to assess the functionality and quality of XML Security Gateways. The main driver for this project is to reduce the confusion and complexity in assessing the strengths and weaknesses of solutions in this the XML Security space, and enlightening the community as to the utility of XML Security Gateways to deliver a number of valuable security services.<br /> <br /> == Project Guiding Principles: ==<br /> <br /> The XML Security Gateway Evaluation Criteria (XSGEC) Project’s Guiding Principles were created in order to express the intentions of its contributors when designing the criteria.<br /> <br /> * Create evaluation criteria supporting a transparent, level playing field for XML Security Gateway solutions to define their solution's key value proposition<br /> <br /> * Where practical, attempt to standardize nomenclature and metrics<br /> <br /> * Educate the community on the design considerations for XML security<br /> <br /> == Project Scope: ==<br /> <br /> This project will focus on evaluation criteria for XML Security Gateways, that are commonly used in SOAP, Web services, SOA, and Rest applications.<br /> <br /> == Versions: ==<br /> <br /> The latest version of the XSGEC is here<br /> https://www.owasp.org/index.php/Category:OWASP_XML_Security_Gateway_Evaluation_Criteria_Project_Latest<br /> <br /> == Feedback and Participation: ==<br /> <br /> We hope you find the OWASP XML Security Gateway Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to owasp@owasp.org. To join the OWASP XML Security Gateway Project mailing list or view the archives, please visit http://lists.owasp.org/mailman/listinfo/owasp-xsgec<br /> <br /> == Project Contributors: ==<br /> <br /> If you contribute to this Project, please add your name here<br /> Project Lead:<br /> <br /> * Gunnar Peterson. He can be reached at gunnar@arctecgroup.net <br /> <br /> Contributors:<br /> <br /> * James McGovern, Virtusa<br /> * Sebastien Deleersnyder, Telindus<br /> * Muthu Meyyappan, United Healthcare<br /> * Mark O'Neill, Vordel<br /> * Ivan Ristic, Breach Security<br /> * Brian Roddy, Cisco<br /> * Philippe Bogaerts, NetAppSec<br /> * Paul Lesov, Wells Fargo<br /> * Lori MacVittie, F5 Networks<br /> <br /> == More Information: ==<br /> <br /> Security Concepts, Challenges, and Design Considerations for Web Services Integration, By Howard Lipson and Gunnar Peterson<br /> https://buildsecurityin.us-cert.gov/daisy/bsi/articles/best-practices/assembly/639.html?branch=1&amp;language=1<br /> <br /> Web Application Firewall Evaluation Criteria - WASC project with similar approach, focused on the Web App FW space<br /> http://www.webappsec.org/projects/wafec/<br /> <br /> ==== Project Details ====<br /> &lt;!--{{:OWASP XML Security Gateway Evaluation Criteria Project - Project Identification}}--&gt;<br /> <br /> {{:GPC Project Details/OWASP XML Security Gateway Evaluation Criteria Project | OWASP Project Identification Tab}}<br /> <br /> __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP Project|XML Security Gateway Evaluation Criteria Project]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Project_Information:template_Application_Security_Requirements_Project&diff=97387 2010-12-21T15:54:28Z

<p>Jm04469: </p> <hr /> <div>{| style=&quot;width:100%&quot; border=&quot;0&quot; align=&quot;center&quot;<br /> ! colspan=&quot;7&quot; align=&quot;center&quot; style=&quot;background:#4058A0; color:white&quot;|&lt;font color=&quot;white&quot;&gt;'''PROJECT IDENTIFICATION''' <br /> |-<br /> | style=&quot;width:15%; background:#7B8ABD&quot; align=&quot;center&quot;|'''Project Name'''<br /> | colspan=&quot;6&quot; style=&quot;width:85%; background:#cccccc&quot; align=&quot;left&quot;|&lt;font color=&quot;black&quot;&gt;'''OWASP Application Security Requirements Project''' <br /> |-<br /> | style=&quot;width:15%; background:#7B8ABD&quot; align=&quot;center&quot;| '''Short Project Description''' <br /> | colspan=&quot;6&quot; style=&quot;width:85%; background:#cccccc&quot; align=&quot;left&quot;| <br /> * The intent of this project is to assemble a useful base of generic/common web application security requirements that could be used in most projects.<br /> * The product of this project is intended to help all involved in web application security, whether it is project management, risk assessment, software development, testing, etc.<br /> * The ''reason d'etre'' of this project is that, whilst security requirements are sometimes well captured and clearly defined, there are other times when they are not, for any number of reasons.<br /> |-<br /> | style=&quot;width:15%; background:#7B8ABD&quot; align=&quot;center&quot;|'''Email Contacts'''<br /> | style=&quot;width:14%; background:#cccccc&quot; align=&quot;center&quot;|Project Leader&lt;br&gt;[mailto:matthew.chalmers(at)owasp.org '''Matthew Chalmers''']<br /> | style=&quot;width:14%; background:#cccccc&quot; align=&quot;center&quot;|Project Contributors&lt;br&gt;(if applicable)&lt;br&gt;[mailto:to(at)change '''Name&amp;Email''']<br /> | style=&quot;width:14%; background:#cccccc&quot; align=&quot;center&quot;|[https://lists.owasp.org/mailman/listinfo/owasp-appsec-requirements '''Mailing List/Subscribe''']&lt;br&gt;[mailto:owasp-appsec-requirements(at)lists.owasp.org '''Mailing List/Use''']<br /> | style=&quot;width:14%; background:#cccccc&quot; align=&quot;center&quot;|First Reviewer&lt;br&gt;[mailto:jmcgovern(at)virtusa.com '''James McGovern''']&lt;br&gt;<br /> | style=&quot;width:14%; background:#cccccc&quot; align=&quot;center&quot;|Second Reviewer&lt;br&gt;[mailto:name(at)name '''Name''']<br /> | style=&quot;width:15%; background:#cccccc&quot; align=&quot;center&quot;|OWASP Board Member&lt;br&gt;(if applicable)&lt;br&gt;[mailto:name(at)name '''Name&amp;Email''']<br /> |}<br /> {| style=&quot;width:100%&quot; border=&quot;0&quot; align=&quot;center&quot;<br /> ! colspan=&quot;6&quot; align=&quot;center&quot; style=&quot;background:#4058A0; color:white&quot;|&lt;font color=&quot;white&quot;&gt;'''PROJECT MAIN LINKS''' <br /> |-<br /> | style=&quot;width:100%; background:#cccccc&quot; align=&quot;center&quot;|<br /> Repository on &quot;Google Code&quot; [http://code.google.com/] <br /> |}<br /> {| style=&quot;width:100%&quot; border=&quot;0&quot; align=&quot;center&quot;<br /> ! colspan=&quot;6&quot; align=&quot;center&quot; style=&quot;background:#4058A0; color:white&quot;|&lt;font color=&quot;white&quot;&gt;'''RELATED PROJECTS''' <br /> |-<br /> | style=&quot;width:100%; background:#cccccc&quot; align=&quot;center&quot;|[[OWASP Secure Software Contract Annex]]<br /> * <br /> |}<br /> {| style=&quot;width:100%&quot; border=&quot;0&quot; align=&quot;center&quot;<br /> ! colspan=&quot;6&quot; align=&quot;center&quot; style=&quot;background:#4058A0; color:white&quot;|&lt;font color=&quot;white&quot;&gt;'''SPONSORS &amp; GUIDELINES''' <br /> |-<br /> | style=&quot;width:50%; background:#cccccc&quot; align=&quot;center&quot;|Sponsor name, if applicable <br /> | style=&quot;width:50%; background:#cccccc&quot; align=&quot;center&quot;|[[:Category:OWASP Application Security Requirements Project RoadMap|'''Project Guidelines/Roadmap''']]<br /> |}<br /> {| style=&quot;width:100%&quot; border=&quot;0&quot; align=&quot;center&quot;<br /> ! colspan=&quot;5&quot; align=&quot;center&quot; style=&quot;background:#4058A0; color:white&quot;|ASSESSMENT AND REVIEW PROCESS<br /> |-<br /> | style=&quot;width:15%; background:#6C82B5&quot; align=&quot;center&quot;|'''Review/Reviewer''' <br /> | style=&quot;width:21%; background:#b3b3b3&quot; align=&quot;center&quot;|'''Author's Self Evaluation'''&lt;br&gt;(applicable for Alpha Quality &amp; further) <br /> | style=&quot;width:21%; background:#b3b3b3&quot; align=&quot;center&quot;|'''First Reviewer'''&lt;br&gt;(applicable for Alpha Quality &amp; further)<br /> | style=&quot;width:21%; background:#b3b3b3&quot; align=&quot;center&quot;|'''Second Reviewer'''&lt;br&gt;(applicable for Beta Quality &amp; further)<br /> | style=&quot;width:22%; background:#b3b3b3&quot; align=&quot;center&quot;|'''OWASP Board Member'''&lt;br&gt;(applicable just for Release Quality) <br /> |-<br /> | style=&quot;width:15%; background:#7B8ABD&quot; align=&quot;center&quot;|'''First Review''' <br /> | style=&quot;width:21%; background:#C2C2C2&quot; align=&quot;center&quot;|Objectives &amp; Deliveries reached?&lt;br&gt;'''Not yet''' (To update)&lt;br&gt;---------&lt;br&gt;Which status has been reached?&lt;br&gt;'''Alpha Status''' - (To update)&lt;br&gt;---------&lt;br&gt;[[Project Information:template Application Security Requirements Project - First Review - Self Evaluation - A|See&amp;Edit: First Review/SelfEvaluation (A)]]<br /> | style=&quot;width:21%; background:#C2C2C2&quot; align=&quot;center&quot;|Objectives &amp; Deliveries reached?&lt;br&gt;'''Not yet''' (To update)&lt;br&gt;---------&lt;br&gt;Which status has been reached?&lt;br&gt;'''Alpha Status''' - (To update)&lt;br&gt;---------&lt;br&gt;[[Project Information:template Application Security Requirements Project - First Review - First Reviewer - B|See&amp;Edit: First Review/1st Reviewer (B)]]<br /> | style=&quot;width:21%; background:#C2C2C2&quot; align=&quot;center&quot;|Objectives &amp; Deliveries reached?&lt;br&gt;'''Yes/No''' (To update)&lt;br&gt;---------&lt;br&gt;Which status has been reached?&lt;br&gt;'''Alpha Status''' - (To update)&lt;br&gt;---------&lt;br&gt;[[Project Information:template Application Security Requirements Project - First Review - Second Reviewer - C|See&amp;Edit: First Review/2nd Reviewer (C)]]<br /> | style=&quot;width:22%; background:#C2C2C2&quot; align=&quot;center&quot;|Objectives &amp; Deliveries reached?&lt;br&gt;'''Yes/No''' (To update)&lt;br&gt;---------&lt;br&gt;Which status has been reached?&lt;br&gt;'''Alpha Status''' - (To update)&lt;br&gt;---------&lt;br&gt;[[Project Information:template Application Security Requirements Project - First Review - OWASP Board Member - D|See/Edit: First Review/Board Member (D)]]<br /> |-<br /> |}</div>

Jm04469 https://wiki.owasp.org/index.php?title=OWASP_Trainers/Volunteer_10&diff=94329 2010-11-29T18:48:36Z

<p>Jm04469: </p> <hr /> <div>{{Template:&lt;includeonly&gt;{{{1}}}&lt;/includeonly&gt;&lt;noinclude&gt;OWASP Trainers Volunteers Tab&lt;/noinclude&gt;<br /> |-<br /> | trainer_name1 = James McGovern &lt;!--Please replace 'Volunteer 10' by your name --&gt;<br /> | trainer_email1 = jmcgovern@virtusa.com &lt;!--Please replace all this text by your email address --&gt;<br /> | trainer_wiki_username1 = jm04469 &lt;!--Please replace this text by your wiki username --&gt;<br /> |-<br /> | project_interested_in_presenting = &lt;!--Please replace this text by the projects' NAME you are interested in presenting --&gt;<br /> |-<br /> | project_interested_in_presenting = Enterprise Architecture Perspectives on Web Application Security&lt;!--Please replace this text by the projects' NAME you are interested in presenting --&gt;<br /> |-<br /> | project_already_presented_name1 = OWASP Top Ten <br /> | project_already_presented_url_1 = http://www.owasp.org/index.php/Top_10_2010<br /> | project_already_presented_name2 = Software Assurance Maturity Model (SAMM)<br /> | project_already_presented_url_2 = http://www.opensamm.org/<br /> | project_already_presented_name3 = ESAPI<br /> | project_already_presented_url_3 = http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API<br /> | project_already_presented_name4 = <br /> | project_already_presented_url_4 = <br /> | project_already_presented_name5 = <br /> | project_already_presented_url_5 = <br /> |-<br /> | current_location = Hartford Connecticut, U.S.A. &lt;!--Please replace this text by the name of the city where you are based --&gt; <br /> |-<br /> | trainer_name_mask = &lt;!--Please replace DO NOT EDIT this string --&gt; Volunteer_10 <br /> | trainer_home_page = &lt;!--Please replace DO NOT EDIT this string --&gt; OWASP_Trainers/Volunteer_10 <br /> }}</div>

Jm04469 https://wiki.owasp.org/index.php?title=OWASP_Trainers/Volunteer_10&diff=94328 2010-11-29T18:47:06Z

<p>Jm04469: </p> <hr /> <div>{{Template:&lt;includeonly&gt;{{{1}}}&lt;/includeonly&gt;&lt;noinclude&gt;OWASP Trainers Volunteers Tab&lt;/noinclude&gt;<br /> |-<br /> | trainer_name1 = James McGovern &lt;!--Please replace 'Volunteer 10' by your name --&gt;<br /> | trainer_email1 = jmcgovern@virtusa.com &lt;!--Please replace all this text by your email address --&gt;<br /> | trainer_wiki_username1 = jm04469 &lt;!--Please replace this text by your wiki username --&gt;<br /> |-<br /> | project_interested_in_presenting = &lt;!--Please replace this text by the projects' NAME you are interested in presenting --&gt;<br /> |-<br /> | project_interested_in_presenting = Enterprise Architecture Perspectives on Web Application Security&lt;!--Please replace this text by the projects' NAME you are interested in presenting --&gt;<br /> |-<br /> | project_already_presented_name1 = OWASP Top Ten <br /> | project_already_presented_url_1 = http://www.owasp.org/index.php/Top_10_2010<br /> | project_already_presented_name2 = Software Assurance Maturity Model (SAMM)<br /> | project_already_presented_url_2 = http://www.opensamm.org/<br /> | project_already_presented_name3 = ESAPI<br /> | project_already_presented_url_3 = http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API<br /> | project_already_presented_name4 = <br /> | project_already_presented_url_4 = <br /> | project_already_presented_name5 = <br /> | project_already_presented_url_5 = <br /> |-<br /> | Hartford Connecticut = &lt;!--Please replace this text by the name of the city where you are based --&gt; <br /> |-<br /> | trainer_name_mask = &lt;!--Please replace DO NOT EDIT this string --&gt; Volunteer_10 <br /> | trainer_home_page = &lt;!--Please replace DO NOT EDIT this string --&gt; OWASP_Trainers/Volunteer_10 <br /> }}</div>

Jm04469 https://wiki.owasp.org/index.php?title=OWASP_Trainers/Volunteer_10&diff=94327 2010-11-29T18:46:42Z

<p>Jm04469: </p> <hr /> <div>{{Template:&lt;includeonly&gt;{{{1}}}&lt;/includeonly&gt;&lt;noinclude&gt;OWASP Trainers Volunteers Tab&lt;/noinclude&gt;<br /> |-<br /> | trainer_name1 = James McGovern &lt;!--Please replace 'Volunteer 10' by your name --&gt;<br /> | trainer_email1 = jmcgovern@virtusa.com &lt;!--Please replace all this text by your email address --&gt;<br /> | trainer_wiki_username1 = jm04469 &lt;!--Please replace this text by your wiki username --&gt;<br /> |-<br /> | project_interested_in_presenting = &lt;!--Please replace this text by the projects' NAME you are interested in presenting --&gt;<br /> |-<br /> | project_interested_in_presenting = Enterprise Architecture Perspectives on Web Application Security&lt;!--Please replace this text by the projects' NAME you are interested in presenting --&gt;<br /> |-<br /> | project_already_presented_name1 = OWASP Top Ten <br /> | project_already_presented_url_1 = http://www.owasp.org/index.php/Top_10_2010<br /> | project_already_presented_name2 = Software Assurance Maturity Model (SAMM)<br /> | project_already_presented_url_2 = http://www.opensamm.org/<br /> | project_already_presented_name3 = ESAPI<br /> | project_already_presented_url_3 = http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API<br /> | project_already_presented_name4 = <br /> | project_already_presented_url_4 = <br /> | project_already_presented_name5 = <br /> | project_already_presented_url_5 = <br /> |-<br /> | Hartford, CT = &lt;!--Please replace this text by the name of the city where you are based --&gt; <br /> |-<br /> | trainer_name_mask = &lt;!--Please replace DO NOT EDIT this string --&gt; Volunteer_10 <br /> | trainer_home_page = &lt;!--Please replace DO NOT EDIT this string --&gt; OWASP_Trainers/Volunteer_10 <br /> }}</div>

Jm04469 https://wiki.owasp.org/index.php?title=OWASP_Trainers/Volunteer_10&diff=94325 2010-11-29T18:46:04Z

<p>Jm04469: </p> <hr /> <div>{{Template:&lt;includeonly&gt;{{{1}}}&lt;/includeonly&gt;&lt;noinclude&gt;OWASP Trainers Volunteers Tab&lt;/noinclude&gt;<br /> |-<br /> | trainer_name1 = James McGovern &lt;!--Please replace 'Volunteer 10' by your name --&gt;<br /> | trainer_email1 = jmcgovern@virtusa.com &lt;!--Please replace all this text by your email address --&gt;<br /> | trainer_wiki_username1 = jm04469 &lt;!--Please replace this text by your wiki username --&gt;<br /> |-<br /> | project_interested_in_presenting = &lt;!--Please replace this text by the projects' NAME you are interested in presenting --&gt;<br /> |-<br /> | project_interested_in_presenting = Enterprise Architecture Perspectives on Web Application Security&lt;!--Please replace this text by the projects' NAME you are interested in presenting --&gt;<br /> |-<br /> | project_already_presented_name1 = OWASP Top Ten <br /> | project_already_presented_url_1 = http://www.owasp.org/index.php/Top_10_2010<br /> | project_already_presented_name2 = Software Assurance Maturity Model (SAMM)<br /> | project_already_presented_url_2 = http://www.opensamm.org/<br /> | project_already_presented_name3 = ESAPI<br /> | project_already_presented_url_3 = http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API<br /> | project_already_presented_name4 = <br /> | project_already_presented_url_4 = <br /> | project_already_presented_name5 = <br /> | project_already_presented_url_5 = <br /> |-<br /> | current_location = &lt;!--Please replace this text by the name of the city where you are based --&gt; <br /> |-<br /> | trainer_name_mask = &lt;!--Please replace DO NOT EDIT this string --&gt; Volunteer_10 <br /> | trainer_home_page = &lt;!--Please replace DO NOT EDIT this string --&gt; OWASP_Trainers/Volunteer_10 <br /> }}</div>

Jm04469 https://wiki.owasp.org/index.php?title=User:Jm04469&diff=88577 2010-09-02T18:30:28Z

<p>Jm04469: Created page with 'James McGovern is a Director with Virtusa in their Insurance SBU. Virtusa is an IT consulting outsourcing company with agile software development and application rationalization …'</p> <hr /> <div>James McGovern is a Director with Virtusa in their Insurance SBU. Virtusa is an IT consulting outsourcing company with agile software development and application rationalization services. Previously, James was an Enterprise Architect for The Hartford (Fortune 97) and served in the role of Chief Security Architect.<br /> <br /> James has been involved in the Information Technology industry for over twenty years. He is passionate about Enterprise Architecture, SOA, Open Source, Identity &amp; Privacy and Social Media. James is the OWASP Chapter Leader for Hartford Connecticut. James is a frequent [http://duckdown.blogspot.com/ blogger] and [http://twitter.com/mcgoverntheory twitterholic]. He has written dozens of articles for publications such as IEEE Security &amp; Privacy, CIO Magazine and Java Developers Journal. He frequently speaks at major industry conferences on the human aspects of technology. He holds certifications from Microsoft, Cisco and Sun.<br /> <br /> For more detailed information, please see my public LinkedIn [http://www.linkedin.com/in/JamesMcGovern profile]</div>

Jm04469 https://wiki.owasp.org/index.php?title=GPC_Project_Reviewers/Volunteer_3&diff=88551 2010-09-02T16:09:33Z

<p>Jm04469: </p> <hr /> <div>{{Template:&lt;includeonly&gt;{{{1}}}&lt;/includeonly&gt;&lt;noinclude&gt;OWASP Reviewers Volunteers Tab&lt;/noinclude&gt;<br /> |-<br /> | project_reviewer_name1 = James McGovern<br /> | project_reviewer_email1 = JMcGovern@virtusa.com<br /> | project_reviewer_wiki_username1 = jm04469<br /> |-<br /> | type_of_project_interested_in_reviewing = Anything of interest to CIO, CISO and Chief Architect audience<br /> |-<br /> | project_currently_reviewing_name1 = &lt;!--Please replace this text by the project's NAME you are interested in reviewing --&gt;<br /> | project_currently_reviewing_url_1 = &lt;!--Please replace this text by the project's LINK you are interested in reviewing --&gt;<br /> | project_currently_reviewing_name2 = <br /> | project_currently_reviewing_url_2 = <br /> | project_currently_reviewing_name3 = <br /> | project_currently_reviewing_url_3 = <br /> | project_currently_reviewing_name4 = <br /> | project_currently_reviewing_url_4 = <br /> | project_currently_reviewing_name5 = <br /> | project_currently_reviewing_url_5 = <br /> |-<br /> |project_reviewed_name1 = &lt;!--Please replace this text by the project's NAME you did review --&gt;<br /> |project_reviewed_url_1 = &lt;!--Please replace this text by the project's LINK you did review --&gt;<br /> |project_reviewed_name2 = <br /> |project_reviewed_url_2 = <br /> |project_reviewed_name3 = <br /> |project_reviewed_url_3 = <br /> |project_reviewed_name4 = <br /> |project_reviewed_url_4 = <br /> |project_reviewed_name5 = <br /> |project_reviewed_url_5 = <br /> |-<br /> | reviewer_name_mask = &lt;!--Please replace DO NOT EDIT this string --&gt; Volunteer_3<br /> | reviewer_home_page = &lt;!--Please replace DO NOT EDIT this string --&gt; GPC_Project_Reviewers/Volunteer_3<br /> }}</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=85233 2010-06-22T17:23:44Z

<p>Jm04469: /* Sponsors */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is [mailto:owasp@jamesmcgovern.com James McGovern]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.teksystems.com/ Tek Systems], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> '''Agenda: Tuesday, June 22nd 2010'''&lt;br&gt;<br /> &lt;br&gt;Meeting is canceled. Will be rescheduled for August.&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Agile Software Development and Security<br /> * Breaking CAPTCHA<br /> * Hacking Identity 2.0<br /> * Breaking Commercial Software for Fun and Profit<br /> * Tactics for breaking software licensing schemes<br /> * Threat modeling<br /> * Advanced Persistent Threats<br /> * Hacking Mainframes/RACF<br /> * PCI/DSS Compliance<br /> * Misuse/abuse cases for business analysts<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=83784 2010-05-20T20:23:11Z

<p>Jm04469: </p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is [mailto:owasp@jamesmcgovern.com James McGovern]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.teksystems.com/ Tek Systems], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], [http://www.thehartford.com/ The Hartford] and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> '''Agenda: Thursday, June 22nd 2010'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW OUTSOURCING FIRMS CAN EMBED BACKDOORS INTO APPLICATIONS WITHOUT GETTING CAUGHT&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Agile Software Development and Security<br /> * Breaking CAPTCHA<br /> * Hacking Identity 2.0<br /> * Breaking Commercial Software for Fun and Profit<br /> * Tactics for breaking software licensing schemes<br /> * Threat modeling<br /> * Advanced Persistent Threats<br /> * Hacking Mainframes/RACF<br /> * PCI/DSS Compliance<br /> * Misuse/abuse cases for business analysts<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Tuesday, May 18th 2010'''&lt;br&gt;<br /> Joint Meeting with ISACA on the topic of auditing web applications&lt;br&gt;<br /> <br /> Dmitry Zhdanov presentation is located [http://www.owasp.org/images/1/16/OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx here]&lt;br&gt;<br /> Mark Wireman presentation is located [http://www.owasp.org/images/d/d4/OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx here]&lt;br&gt;<br /> James Ritche presentation is located [http://www.owasp.org/images/7/7c/IT_Application_Audit_Principles-James_Ritche.ppt here]&lt;br&gt;<br /> Mark Coderre presentation is located [http://www.owasp.org/images/d/d3/Secure_Web_Applications_Mark_Coderre.ppt here]&lt;br&gt;<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=File:Secure_Web_Applications_Mark_Coderre.ppt&diff=83783 2010-05-20T20:17:02Z

<p>Jm04469: </p> <hr /> <div></div>

Jm04469 https://wiki.owasp.org/index.php?title=File:IT_Application_Audit_Principles-James_Ritche.ppt&diff=83782 2010-05-20T20:16:08Z

<p>Jm04469: </p> <hr /> <div></div>

Jm04469 https://wiki.owasp.org/index.php?title=File:OWASP_ISACA_Hartford_Secure_Coding-Mark_Wireman.pptx&diff=83781 2010-05-20T20:14:47Z

<p>Jm04469: </p> <hr /> <div></div>

Jm04469 https://wiki.owasp.org/index.php?title=File:OWASP_ISACA_Hartford_Secure_Coding_v2-Dmitry_Zhdanov.pptx&diff=83780 2010-05-20T20:12:39Z

<p>Jm04469: Secure coding: Dmitry_Zhdanov</p> <hr /> <div>Secure coding: Dmitry_Zhdanov</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=80864 2010-04-01T16:19:11Z

<p>Jm04469: </p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is [mailto:owasp@jamesmcgovern.com James McGovern]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.teksystems.com/ Tek Systems], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], [http://www.thehartford.com/ The Hartford] and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> == Tuesday, February 16th 2010 ==<br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;&lt;br&gt;<br /> We are seeking sponsorship for food and beverages for this event&lt;br&gt;<br /> <br /> OPENING REMARKS: 5:00 - 5:15 PM&lt;br&gt;<br /> James McGovern, [http://twitter.com/mcgoverntheory OWASP Hartford Chapter Leader]&lt;br&gt;<br /> &lt;br&gt;<br /> Data Environmentalism: Rethinking our Approach to Data : 5:15 - 6:00 PM&lt;br&gt;<br /> Trevor Hughes, CTO [http://www.artecgroup.net/ Artec]&lt;br&gt;<br /> &lt;br&gt;<br /> FOOD BREAK: 6:00 - 6:15 PM&lt;br&gt;<br /> J. Trevor Hughes is the Executive Director of the International Association of Privacy Professionals (IAPP). In this role, Hughes leads the world’s largest association of privacy professionals. <br /> <br /> == Tuesday, May 18th 2010 ==<br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;&lt;br&gt;<br /> <br /> Joint Meeting with ISACA on the topic of auditing web applications<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Agile Software Development and Security<br /> * Breaking CAPTCHA<br /> * Hacking Identity 2.0<br /> * Breaking Commercial Software for Fun and Profit<br /> * Tactics for breaking software licensing schemes<br /> * Threat modeling<br /> * Advanced Persistent Threats<br /> * Hacking Mainframes/RACF<br /> * PCI/DSS Compliance<br /> * Misuse/abuse cases for business analysts<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=78218 2010-02-10T17:15:58Z

<p>Jm04469: /* Call for Sponsors/Speakers */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is [mailto:owasp@jamesmcgovern.com James McGovern]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.teksystems.com/ Tek Systems], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], [http://www.thehartford.com/ The Hartford] and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> == Tuesday, February 16th 2010 ==<br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;&lt;br&gt;<br /> We are seeking sponsorship for food and beverages for this event&lt;br&gt;<br /> <br /> OPENING REMARKS: 5:00 - 5:15 PM&lt;br&gt;<br /> James McGovern, [http://twitter.com/mcgoverntheory OWASP Hartford Chapter Leader]&lt;br&gt;<br /> &lt;br&gt;<br /> Data Environmentalism: Rethinking our Approach to Data : 5:15 - 6:00 PM&lt;br&gt;<br /> Trevor Hughes, CTO [http://www.artecgroup.net/ Artec]&lt;br&gt;<br /> &lt;br&gt;<br /> FOOD BREAK: 6:00 - 6:15 PM&lt;br&gt;<br /> J. Trevor Hughes is the Executive Director of the International Association of Privacy Professionals (IAPP). In this role, Hughes leads the world’s largest association of privacy professionals. <br /> <br /> == Tuesday, April 20th 2010 ==<br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;&lt;br&gt;<br /> <br /> Mary Ann Davidson, CSO of Oracle<br /> <br /> == Thursday, July 22nd 2010 ==<br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;&lt;br&gt;<br /> <br /> TBD<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Agile Software Development and Security<br /> * Breaking CAPTCHA<br /> * Hacking Identity 2.0<br /> * Breaking Commercial Software for Fun and Profit<br /> * Tactics for breaking software licensing schemes<br /> * Threat modeling<br /> * Advanced Persistent Threats<br /> * Hacking Mainframes/RACF<br /> * PCI/DSS Compliance<br /> * Misuse/abuse cases for business analysts<br /> <br /> Speaking at a upcoming meeting on a OWASP project or vendor agnostic research topic. [http://www.easychair.org/conferences/?conf=owaspnyc2010 SUBMIT HERE]<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> [[Category:Connecticut]]</div>

Jm04469 https://wiki.owasp.org/index.php?title=Hartford&diff=74828 2009-12-06T23:12:49Z

<p>Jm04469: /* Past Events */</p> <hr /> <div>{{Chapter Template|chaptername=Hartford|extra=The chapter leader is [mailto:owasp@jamesmcgovern.com James McGovern]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-hartford|emailarchives=http://lists.owasp.org/pipermail/owasp-hartford}}<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> == Sponsors ==<br /> <br /> We would like to thank [http://www.teksystems.com/ Tek Systems], [http://www.oracle.com/ Oracle], [http://www.ca.com/ CA], [http://www.thehartford.com/ The Hartford] and [http://www.microsoft.com/ Microsoft] for their generous sponsorship and helping make application security visible...<br /> <br /> If you would like to sponsor either the food and/or door prizes for an upcoming meeting, please email [mailto:owasp@jamesmcgovern.com James McGovern] with your proposal. Independent of any financial considerations, sponsorship priority is driven by those who drive participation in OWASP to their employees and customers.<br /> <br /> == Tuesday, February 16th 2010 ==<br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;&lt;br&gt;<br /> We are seeking sponsorship for food and beverages for this event&lt;br&gt;<br /> <br /> OPENING REMARKS: 5:00 - 5:15 PM&lt;br&gt;<br /> James McGovern, [http://twitter.com/mcgoverntheory OWASP Hartford Chapter Leader]&lt;br&gt;<br /> &lt;br&gt;<br /> Data Environmentalism: Rethinking our Approach to Data : 5:15 - 6:00 PM&lt;br&gt;<br /> Trevor Hughes, CTO [http://www.artecgroup.net/ Artec]&lt;br&gt;<br /> &lt;br&gt;<br /> FOOD BREAK: 6:00 - 6:15 PM&lt;br&gt;<br /> J. Trevor Hughes is the Executive Director of the International Association of Privacy Professionals (IAPP). In this role, Hughes leads the world’s largest association of privacy professionals. <br /> <br /> == Tuesday, April 20th 2010 ==<br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;&lt;br&gt;<br /> <br /> Mary Ann Davidson, CSO of Oracle<br /> <br /> == Thursday, July 22nd 2010 ==<br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;&lt;br&gt;<br /> <br /> TBD<br /> <br /> == Call for Sponsors/Speakers ==<br /> <br /> This is a call for speakers/papers. If we haven't approached you, but you believe you have a significant discovery or new research that the security community would value, or enjoy hearing about, we invite you to submit your presentation topic for serious consideration. Preference will be given to speakers who can present new and innovative technical content to a broad audience. Of course, all presentations are expected to challenge the brightest and quickest of attendees - we wouldn't have it any other way. <br /> <br /> OWASP is not a vendor fair. Consequently, there will be very little tolerance for commercial content within presentations. Attendees will be encouraged to quell any shameless marketing that is not immediately backed up with rationale for its inclusion. <br /> <br /> Some topics of interest for upcoming meetings include (but are not limited to):<br /> * Agile Software Development and Security<br /> * Breaking CAPTCHA<br /> * Hacking Cardspace and Identity 2.0<br /> * Breaking Commercial Software for Fun and Profit<br /> * Tactics for breaking software licensing schemes<br /> * Gaming, the next overlooked security hole<br /> * Hacking Mainframes/RACF<br /> * Database rootkits<br /> * PCI/DSS Compliance<br /> * Privacy considerations in software development<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> == Past Events ==<br /> <br /> '''Agenda: Thursday, December 3rd 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> SOCIAL MEDIA, PRIVACY AND BREACHES&lt;br&gt;<br /> Ian Glazer, Distinguished Industry Analyst [http://www.burtongroup.com/ Burton Group]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/e/e2/BG_PartneringPrivacy_Glazer%282%29.pptx here]&lt;br&gt;<br /> &lt;br&gt;<br /> VANISH: MAKING DATA DISAPPEAR&lt;br&gt;<br /> George Dobbs, Chief Architect [http://www.kofc.org/ Knights of Columbus]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/c/c7/Vanishing_Data_and_impacts_to_privacy.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, November 17th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> ATTACK YOUR DATABASE BEFORE OTHERS DO&lt;br&gt;<br /> Todd Desantis, Lead Sales Engineer [http://www.sentrigo.com/ Sentrigo]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, October 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE CONVERGENCE OF SECURITY AND PRIVACY: CLOUD COMPUTING&lt;br&gt;<br /> Michael Waidner, Distinguished IBM Engineer and Security CTO [http://www.ibm.com/ IBM]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, September 14th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OWASP: WHERE WE ARE AND WHERE WE ARE GOING&lt;br&gt;<br /> Tom Brennan, OWASP Board Member [http://www.owasp.org/ OWASP]&lt;br&gt;<br /> &lt;br&gt;<br /> WEB APPLICATION SECURITY ASSURANCE&lt;br&gt;<br /> Gregory Gotta, SVP Security [http://www.ca.com/ CA]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE ANATOMY OF SECURITY DISASTERS&lt;br&gt;<br /> Marcus Ranum, CSO of [http://www.tenablesecurity.com/ Tenable Security]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/3/32/Anatomy_of_security_disasters.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, April 30th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> RECRUITING ELITE IT TALENT&lt;br&gt;<br /> Jordan Haberfield (Agile Elephant), SVP of [http://www.systemoneservices.com/ System One]&lt;br&gt;<br /> &lt;br&gt;<br /> DETECTING BACKDOORS IN WEB APPLICATIONS&lt;br&gt;<br /> Chris Wysopal CTO, [http://www.veracode.com/ Veracode]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Monday, April 13th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> AGILE SOFTWARE DEVELOPMENT AND SECURITY: 4:00 - 6:45 PM&lt;br&gt;<br /> Scott Ambler, Agile Practice Leader, [http://www.ibm.com/ IBM]&lt;br&gt;<br /> Powerpoint presentation is located [http://www.owasp.org/images/f/f1/Ambler_Agile_Security_2009_04_14.pdf here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Tuesday, February 10th 2009'''&lt;br&gt;<br /> &lt;br&gt;<br /> OPEN SOURCE IDENTITY SERVICES (The Higgins Project)&lt;br&gt;<br /> Mary Ruddy, [http://www.meristic.com/index.php Meristic]&lt;br&gt;<br /> &lt;br&gt;<br /> ENABLING STRONGER/MULTI-FACTOR AUTHENTICATION FOR ENTERPRISE APPLICATIONS &lt;br&gt;<br /> Ramesh Nagappan, Security Architect at [http://www.sun.com/ Sun Microsystems]&lt;br&gt;<br /> &lt;br&gt;<br /> STATE OF WEB APPLICATION SECURITY&lt;br&gt;<br /> Gunnar Peterson, CTO of [http://www.artecgroup.net/ Artec Group] and Twin Cities OWASP &lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, November 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> LIGHTWEIGHT SECURITY USING IDENTITY-BASED ENCRYPTION: 6:00 - 7:00 PM&lt;br&gt;<br /> Richard Eisenberg, Architect at [http://www.voltage.com/ Voltage Security]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, September 24th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> TOP TEN BOGUS TECH QUOTES OF THE YEAR: 6:00 - 6:45 PM&lt;br&gt;<br /> Paul Roberts, Industry Analyst, [http://www.the451group.com/ The 451 Group]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/c/c6/OWASP-Hartford-Oct08-451Group.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> MAKING APPLICATIONS SECURE BY REMOVING SECURITY: 6:45 - 7:30 PM&lt;br&gt;<br /> Andrew Stone, Senior Manager, [http://www.accenture.com/ Accenture]&lt;br&gt;<br /> Powerpoint presentation is located [https://www.owasp.org/images/0/01/OWASP-Hartford-Oct08-Accenture.ppt here]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, June 11th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> CARDSPACE AND USER CENTRIC IDENTITY&lt;br&gt;<br /> Chris Winn, Security Evangelist, [http://www.microsoft.com/ Microsoft]&lt;br&gt;<br /> &lt;br&gt;<br /> IDENTITY GOVERNANCE FRAMEWORK&lt;br&gt;<br /> Prateek Mishra, Product Manager, [http://www.oracle.com/ Oracle]&lt;br&gt;<br /> Powerpoint Presentation is [https://www.owasp.org/images/2/2c/IGF-Overview-Hartford-May-00.ppt here ]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Wednesday, April 30th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> THE IDIOTS GUIDE TO DEVELOPING BAD ENTERPRISE APPLICATIONS AND WORST LOGGING PRACTICES&lt;br&gt;<br /> Anton Chuvakin, Chief Logging Evangelist, [http://www.loglogic.com/ LogLogic]&lt;br&gt;<br /> &lt;br&gt;<br /> KEEPING SECRETS: APPLICATION SECURITY IS A BUSINESS IMPERATIVE&lt;br&gt;<br /> Jack Danahy, CTO and Founder, [http://www.ouncelabs.com/ Ounce Labs]&lt;br&gt;<br /> &lt;br&gt;<br /> '''Agenda: Thursday, February 28th 2008'''&lt;br&gt;<br /> &lt;br&gt;<br /> HOW WEB 2.0 HAS CHANGED THE LANDSCAPE OF APPLICATION SECURITY&lt;br&gt;<br /> Chenxi Wang, Principal Analyst, [http://www.forrester.com/ Forrester Research]&lt;br&gt;<br /> &lt;br&gt;<br /> EXPLOITING ONLINE GAMES&lt;br&gt;<br /> Gary McGraw, CTO, [http://www.cigital.com/ Cigital]&lt;br&gt;<br /> &lt;br&gt;<br /> <br /> == Locations ==<br /> <br /> All meetings are held at the headquarters of [http://www.thehartford.com/ The Hartford Financial Services Group] (The Hartford), One Hartford Plaza, Hartford CT 06115 in the Tower Building, Atrium Conference Room. Free parking is available in our Tower Ramp Garage.<br /> <br /> &lt;paypal&gt;Hartford&lt;/paypal&gt;<br /> <br /> [[Category:Connecticut]]</div>

Jm04469