OWASP - User contributions [en]

Sweden

2014-05-08T09:26:40Z

John.wilander:

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:Mattias.Bergling@owasp.org Mattias Bergling] and [mailto:Robert.Malmgren@owasp.org Robert Malmgren].

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, Stockholm, November 20, 2012: OWASP Top 10 for JavaScript + RESTful Security'''

Welcome to an OWASP Sweden seminar November 20, with Erlend Oftedal. Book your seat at [https://oftedal.eventbrite.com/ Eventbrite].

'''OWASP Sweden Meeting, Stockholm, May 14, 2012: Secure Mashups, IT Sec in Cars, Buffer Overflow Prevention, "How We Won the Deutche Post Security Cup", and Multi-Step, Semi-Blind CSRF'''

Welcome to an OWASP Sweden seminar May 14, with Jonas Magazinius, Mattias Jidhage, and John Wilander. Book your seat at [https://14maj2012.eventbrite.com/ Eventbrite].

'''Slides from the OWASP Sweden Meeting, Stockholm, March 20, 2012'''

[https://www.owasp.org/images/6/60/Manico_Developer_Top_Ten_Core_Controls_v4.1.ppt.zip Here are the slides (.ppt.zip)] from Jim Manico's presentation on "Web Application Access Control Design Excellence".

'''OWASP Sweden Meeting, Stockholm, March 20, 2012: "Web Application Access Control Design Excellence"'''

Welcome to an OWASP Sweden seminar March 20, with Jim Manico. Book your seat at [https://owaspsweden200312.eventbrite.com/ Eventbrite].

This event will be in English.

Sponsors for this event are:
* F5 who is sponsoring for Jim's travel and hotel
* .SE sponsoring with the venue
* Cybercom who will supply you with beverage and snacks during the evening

The Speaker
Jim Manico is a profile in the OWASP community working with the OWASP podcasts and ESAPI amongst other things. During march he is doing a nordic tour and will be visiting the chapters in Finland, Sweden, Norway and Denmark and we have the pleasure of welcoming him to Stockholm on March 20.
Read more on the OWASP webpage https://www.owasp.org/index.php/User:Jmanico

Abstract for Jim´s talk:

'''Web Application Access Control Design Excellence'''

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

'''OWASP Sweden SSL Day, Stockholm, November 23 2011'''
OWASP Sweden, Stockholm branch is happy to announce a full-day on the topic of SSL in cooperation with Internetdagarna
http://www.internetdagarna.se/ind11/program/seminarium/92

The speakers are
* Jakob Schlyter, Kirei
* John Wilander, OWASP Sweden and Handelsbanken
* Andreas Jonson, Romab
* Henrich Pöhls, University of Passau
* Robert Malmgren, OWASP Sweden and Romab

'''OWASP Sweden Meeting March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.
[[Category:Sweden]] [[Category:Europe]]

Sweden

2014-05-08T09:26:23Z

John.wilander:

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:Mattias.Bergling@owasp.org Mattias Bergling] and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, Stockholm, November 20, 2012: OWASP Top 10 for JavaScript + RESTful Security'''

Welcome to an OWASP Sweden seminar November 20, with Erlend Oftedal. Book your seat at [https://oftedal.eventbrite.com/ Eventbrite].

'''OWASP Sweden Meeting, Stockholm, May 14, 2012: Secure Mashups, IT Sec in Cars, Buffer Overflow Prevention, "How We Won the Deutche Post Security Cup", and Multi-Step, Semi-Blind CSRF'''

Welcome to an OWASP Sweden seminar May 14, with Jonas Magazinius, Mattias Jidhage, and John Wilander. Book your seat at [https://14maj2012.eventbrite.com/ Eventbrite].

'''Slides from the OWASP Sweden Meeting, Stockholm, March 20, 2012'''

[https://www.owasp.org/images/6/60/Manico_Developer_Top_Ten_Core_Controls_v4.1.ppt.zip Here are the slides (.ppt.zip)] from Jim Manico's presentation on "Web Application Access Control Design Excellence".

'''OWASP Sweden Meeting, Stockholm, March 20, 2012: "Web Application Access Control Design Excellence"'''

Welcome to an OWASP Sweden seminar March 20, with Jim Manico. Book your seat at [https://owaspsweden200312.eventbrite.com/ Eventbrite].

This event will be in English.

Sponsors for this event are:
* F5 who is sponsoring for Jim's travel and hotel
* .SE sponsoring with the venue
* Cybercom who will supply you with beverage and snacks during the evening

The Speaker
Jim Manico is a profile in the OWASP community working with the OWASP podcasts and ESAPI amongst other things. During march he is doing a nordic tour and will be visiting the chapters in Finland, Sweden, Norway and Denmark and we have the pleasure of welcoming him to Stockholm on March 20.
Read more on the OWASP webpage https://www.owasp.org/index.php/User:Jmanico

Abstract for Jim´s talk:

'''Web Application Access Control Design Excellence'''

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

'''OWASP Sweden SSL Day, Stockholm, November 23 2011'''
OWASP Sweden, Stockholm branch is happy to announce a full-day on the topic of SSL in cooperation with Internetdagarna
http://www.internetdagarna.se/ind11/program/seminarium/92

The speakers are
* Jakob Schlyter, Kirei
* John Wilander, OWASP Sweden and Handelsbanken
* Andreas Jonson, Romab
* Henrich Pöhls, University of Passau
* Robert Malmgren, OWASP Sweden and Romab

'''OWASP Sweden Meeting March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.
[[Category:Sweden]] [[Category:Europe]]

Sweden

2014-05-08T09:26:05Z

John.wilander: Remover myself as chapter co-leader. I stepped down May 2013.

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, Stockholm, November 20, 2012: OWASP Top 10 for JavaScript + RESTful Security'''

Welcome to an OWASP Sweden seminar November 20, with Erlend Oftedal. Book your seat at [https://oftedal.eventbrite.com/ Eventbrite].

'''OWASP Sweden Meeting, Stockholm, May 14, 2012: Secure Mashups, IT Sec in Cars, Buffer Overflow Prevention, "How We Won the Deutche Post Security Cup", and Multi-Step, Semi-Blind CSRF'''

Welcome to an OWASP Sweden seminar May 14, with Jonas Magazinius, Mattias Jidhage, and John Wilander. Book your seat at [https://14maj2012.eventbrite.com/ Eventbrite].

'''Slides from the OWASP Sweden Meeting, Stockholm, March 20, 2012'''

[https://www.owasp.org/images/6/60/Manico_Developer_Top_Ten_Core_Controls_v4.1.ppt.zip Here are the slides (.ppt.zip)] from Jim Manico's presentation on "Web Application Access Control Design Excellence".

'''OWASP Sweden Meeting, Stockholm, March 20, 2012: "Web Application Access Control Design Excellence"'''

Welcome to an OWASP Sweden seminar March 20, with Jim Manico. Book your seat at [https://owaspsweden200312.eventbrite.com/ Eventbrite].

This event will be in English.

Sponsors for this event are:
* F5 who is sponsoring for Jim's travel and hotel
* .SE sponsoring with the venue
* Cybercom who will supply you with beverage and snacks during the evening

The Speaker
Jim Manico is a profile in the OWASP community working with the OWASP podcasts and ESAPI amongst other things. During march he is doing a nordic tour and will be visiting the chapters in Finland, Sweden, Norway and Denmark and we have the pleasure of welcoming him to Stockholm on March 20.
Read more on the OWASP webpage https://www.owasp.org/index.php/User:Jmanico

Abstract for Jim´s talk:

'''Web Application Access Control Design Excellence'''

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

'''OWASP Sweden SSL Day, Stockholm, November 23 2011'''
OWASP Sweden, Stockholm branch is happy to announce a full-day on the topic of SSL in cooperation with Internetdagarna
http://www.internetdagarna.se/ind11/program/seminarium/92

The speakers are
* Jakob Schlyter, Kirei
* John Wilander, OWASP Sweden and Handelsbanken
* Andreas Jonson, Romab
* Henrich Pöhls, University of Passau
* Robert Malmgren, OWASP Sweden and Romab

'''OWASP Sweden Meeting March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.
[[Category:Sweden]] [[Category:Europe]]

User:John.wilander

2014-01-05T14:48:41Z

John.wilander:

[[Image:John_Wilander_090626-346_(for_web).jpg‎|John Wilander]]

John Wilander is an application security researcher with passion for building software and proactive measures. He is a Product Security Researcher at an American corporation in California. JavaScript and Java are his languages of choice, with Objective-C as runner-up.

After his Master's degree in Computer Science and Engineering from Linköping University (Sweden) and Nanyang Technological University (Singapore) he pursued a PhD in application security and defended his thesis in April 2013. John's research publications can be found [http://johnwilander.se/#Research here].

John started the Swedish OWASP Chapter in 2007. In 2010 he chaired the first OWASP AppSec Research conference – [http://www.owasp.org/index.php?title=OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010] – and managed to bring together appsec experts from industry and academia. Less than a year later he hosted the [https://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track Browser Security Sessions] at the Global OWASP Summit in Portugal. He also co-founded the [https://www.owasp.org/index.php/Builders OWASP Builders] initiative and served on the Global Conferences Committee for two years. His most recent contribution is the [http://1-liner.org/ OWASP 1-Liner project] which made him one of the few who has lead a chapter, lead a project, and hosted a global AppSec conference.

For more detailed information, please see his public [http://www.linkedin.com/in/johnwilander LinkedIn page].

* To see John's wiki contributions, [[:Special:Contributions/John.wilander|click here]]
* His [mailto:john.wilander@owasp.org email address]
* [https://twitter.com/johnwilander @johnwilander]

User:John.wilander

2013-08-27T19:56:52Z

John.wilander: Updated most of the info

[[Image:John_Wilander_090626-346_(for_web).jpg‎|John Wilander]]

John Wilander is an application security researcher with passion for building software and proactive measures. He is a Product Security Researcher at Apple. JavaScript and Java are his languages of choice, with Objective-C as runner-up.

After his Master's degree in Computer Science and Engineering from Linköping University (Sweden) and Nanyang Technological University (Singapore) he pursued a PhD in application security and defended his thesis in April 2013. John's research publications can be found [http://johnwilander.se/#Research here].

John started the Swedish OWASP Chapter in 2007. In 2010 he chaired the first OWASP AppSec Research conference – [http://www.owasp.org/index.php?title=OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010] – and managed to bring together appsec experts from industry and academia. Less than a year later he hosted the [https://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track Browser Security Sessions] at the Global OWASP Summit in Portugal. He also co-founded the [https://www.owasp.org/index.php/Builders OWASP Builders] initiative and served on the Global Conferences Committee for two years. His most recent contribution is the [http://1-liner.org/ OWASP 1-Liner project] which made him one of the few who has lead a chapter, lead a project, and hosted a global AppSec conference.

For more detailed information, please see his public [http://www.linkedin.com/in/johnwilander LinkedIn page].

* To see John's wiki contributions, [[:Special:Contributions/John.wilander|click here]]
* His [mailto:john.wilander@owasp.org email address]
* [https://twitter.com/johnwilander @johnwilander]

Sweden

2012-10-24T20:03:40Z

John.wilander: Added Nov 20 event

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:John.Wilander@owasp.org John Wilander], [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, Stockholm, November 20, 2012: OWASP Top 10 for JavaScript + RESTful Security'''

Welcome to an OWASP Sweden seminar November 20, with Erlend Oftedal. Book your seat at [https://oftedal.eventbrite.com/ Eventbrite].

'''OWASP Sweden Meeting, Stockholm, May 14, 2012: Secure Mashups, IT Sec in Cars, Buffer Overflow Prevention, "How We Won the Deutche Post Security Cup", and Multi-Step, Semi-Blind CSRF'''

Welcome to an OWASP Sweden seminar May 14, with Jonas Magazinius, Mattias Jidhage, and John Wilander. Book your seat at [https://14maj2012.eventbrite.com/ Eventbrite].

'''Slides from the OWASP Sweden Meeting, Stockholm, March 20, 2012'''

[https://www.owasp.org/images/6/60/Manico_Developer_Top_Ten_Core_Controls_v4.1.ppt.zip Here are the slides (.ppt.zip)] from Jim Manico's presentation on "Web Application Access Control Design Excellence".

'''OWASP Sweden Meeting, Stockholm, March 20, 2012: "Web Application Access Control Design Excellence"'''

Welcome to an OWASP Sweden seminar March 20, with Jim Manico. Book your seat at [https://owaspsweden200312.eventbrite.com/ Eventbrite].

This event will be in English.

Sponsors for this event are:
* F5 who is sponsoring for Jim's travel and hotel
* .SE sponsoring with the venue
* Cybercom who will supply you with beverage and snacks during the evening

The Speaker
Jim Manico is a profile in the OWASP community working with the OWASP podcasts and ESAPI amongst other things. During march he is doing a nordic tour and will be visiting the chapters in Finland, Sweden, Norway and Denmark and we have the pleasure of welcoming him to Stockholm on March 20.
Read more on the OWASP webpage https://www.owasp.org/index.php/User:Jmanico

Abstract for Jim´s talk:

'''Web Application Access Control Design Excellence'''

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

'''OWASP Sweden SSL Day, Stockholm, November 23 2011'''
OWASP Sweden, Stockholm branch is happy to announce a full-day on the topic of SSL in cooperation with Internetdagarna
http://www.internetdagarna.se/ind11/program/seminarium/92

The speakers are
* Jakob Schlyter, Kirei
* John Wilander, OWASP Sweden and Handelsbanken
* Andreas Jonson, Romab
* Henrich Pöhls, University of Passau
* Robert Malmgren, OWASP Sweden and Romab

'''OWASP Sweden Meeting March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.
[[Category:Sweden]]

OWASP 1-Liner

2012-07-12T07:41:46Z

John.wilander: Added link to GitHub and did some description updates.

{{Template:Project About
| project_name = OWASP 1-Liner
| project_home_page = [https://github.com/johnwilander/owasp-1-liner GitHub]
| project_description =OWASP 1-Liner is a deliberately vulnerable Java- and JavaScript-based chat application intended for demos (talks, tutorials, proof-of-concepts) and possibly training in application security. The application has two parts – local.1-liner.org/vulnerable and local.1-liner.org/securish – to allow for demos of both attacks and countermeasures.
| project_license = Creative Commons Attribution ShareAlike 3.0
| leader_name1 = John Wilander
| leader_email[1-10] = john.wilander@owasp.org
| leader_username1 = john.wilander
| contributor_name[1-10] =
| contributor_email[1-10] =
| contributor_username[1-10] =
| pamphlet_link =
| presentation_link =
| mailing_list_name = owasp_1_liner@lists.owasp.org
| project_road_map = The application has been used for two years before public release. Officially released at OWASP AppSec Research 2012. The roadmap is to continue adding demos just like before. Hopefully the community will like it and start adding demos too.
| links_url[1-10] =
| links_name[1-10] =
| release_1 = [https://github.com/johnwilander/owasp-1-liner]
| release_2 =
| release_3 =
| release_4 =
}}

[[Category:OWASP Project]]

Sweden

2012-04-24T08:53:03Z

John.wilander: /* Local News */ Added May 14 event

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:John.Wilander@owasp.org John Wilander], [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, Stockholm, May 14, 2012: Secure Mashups, IT Sec in Cars, Buffer Overflow Prevention, "How We Won the Deutche Post Security Cup", and Multi-Step, Semi-Blind CSRF'''

Welcome to an OWASP Sweden seminar May 14, with Jonas Magazinius, Mattias Jidhage, and John Wilander. Book your seat at [https://14maj2012.eventbrite.com/ Eventbrite].

'''Slides from the OWASP Sweden Meeting, Stockholm, March 20, 2012'''

[https://www.owasp.org/images/6/60/Manico_Developer_Top_Ten_Core_Controls_v4.1.ppt.zip Here are the slides (.ppt.zip)] from Jim Manico's presentation on "Web Application Access Control Design Excellence".

'''OWASP Sweden Meeting, Stockholm, March 20, 2012: "Web Application Access Control Design Excellence"'''

Welcome to an OWASP Sweden seminar March 20, with Jim Manico. Book your seat at [https://owaspsweden200312.eventbrite.com/ Eventbrite].

This event will be in English.

Sponsors for this event are:
* F5 who is sponsoring for Jim's travel and hotel
* .SE sponsoring with the venue
* Cybercom who will supply you with beverage and snacks during the evening

The Speaker
Jim Manico is a profile in the OWASP community working with the OWASP podcasts and ESAPI amongst other things. During march he is doing a nordic tour and will be visiting the chapters in Finland, Sweden, Norway and Denmark and we have the pleasure of welcoming him to Stockholm on March 20.
Read more on the OWASP webpage https://www.owasp.org/index.php/User:Jmanico

Abstract for Jim´s talk:

'''Web Application Access Control Design Excellence'''

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

'''OWASP Sweden SSL Day, Stockholm, November 23 2011'''
OWASP Sweden, Stockholm branch is happy to announce a full-day on the topic of SSL in cooperation with Internetdagarna
http://www.internetdagarna.se/ind11/program/seminarium/92

The speakers are
* Jakob Schlyter, Kirei
* John Wilander, OWASP Sweden and Handelsbanken
* Andreas Jonson, Romab
* Henrich Pöhls, University of Passau
* Robert Malmgren, OWASP Sweden and Romab

'''OWASP Sweden Meeting March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.
[[Category:Sweden]]

Sweden

2012-03-25T02:19:48Z

John.wilander: Added link to Jim's slides

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:John.Wilander@owasp.org John Wilander], [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''Slides from the OWASP Sweden Meeting, Stockholm, March 20, 2012'''

[https://www.owasp.org/images/6/60/Manico_Developer_Top_Ten_Core_Controls_v4.1.ppt.zip Here are the slides (.ppt.zip)] from Jim Manico's presentation on "Web Application Access Control Design Excellence".

'''OWASP Sweden Meeting, Stockholm, March 20, 2012: "Web Application Access Control Design Excellence"'''

Welcome to an OWASP Sweden seminar March 20, with Jim Manico. Book your seat at [https://owaspsweden200312.eventbrite.com/ Eventbrite].

This event will be in English.

Sponsors for this event are:
* F5 who is sponsoring for Jim's travel and hotel
* .SE sponsoring with the venue
* Cybercom who will supply you with beverage and snacks during the evening

The Speaker
Jim Manico is a profile in the OWASP community working with the OWASP podcasts and ESAPI amongst other things. During march he is doing a nordic tour and will be visiting the chapters in Finland, Sweden, Norway and Denmark and we have the pleasure of welcoming him to Stockholm on March 20.
Read more on the OWASP webpage https://www.owasp.org/index.php/User:Jmanico

Abstract for Jim´s talk:

'''Web Application Access Control Design Excellence'''

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

'''OWASP Sweden SSL Day, Stockholm, November 23 2011'''
OWASP Sweden, Stockholm branch is happy to announce a full-day on the topic of SSL in cooperation with Internetdagarna
http://www.internetdagarna.se/ind11/program/seminarium/92

The speakers are
* Jakob Schlyter, Kirei
* John Wilander, OWASP Sweden and Handelsbanken
* Andreas Jonson, Romab
* Henrich Pöhls, University of Passau
* Robert Malmgren, OWASP Sweden and Romab

'''OWASP Sweden Meeting March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.
[[Category:Sweden]]

File:Manico Developer Top Ten Core Controls v4.1.ppt.zip

2012-03-25T02:15:46Z

John.wilander: Jim Manico's presentation slides from his Nordic tour, March 2012.

Jim Manico's presentation slides from his Nordic tour, March 2012.

User:John.wilander

2012-03-10T14:47:24Z

John.wilander: Updated with new employer, recent OWASP activities, and a general brush-up of the text.

[[Image:John_Wilander_090626-346_(for_web).jpg‎|John Wilander]]

John Wilander is an application security researcher and consultant. He is a frontend developer at Handelsbanken in Sweden. John typically describes himself as a security focused software developer. JavaScript and Java are his languages of choice.

After his Master's degree in Computer Science and Engineering from Linköping University (Sweden) and Nanyang Technological University (Singapore) he pursued a PhD in application security. Last paper is published so now it's time for dissertation and defense. John's research publications can be found [http://johnwilander.se/#Research here].

John started the Swedish OWASP Chapter in 2007 and has since been leader and co-leader. In 2010 he chaired the most successful OWASP AppSec EU conference so far – [http://www.owasp.org/index.php?title=OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010]. John is listed along with the Swedish chapter as contributors to [http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project OWASP Top 10 2010]. In 2011 he hosted the [https://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track Browser Security Sessions] at the Global OWASP Summit in Portugal. He also co-founded the [https://www.owasp.org/index.php/Builders OWASP Builders] initiative.

For more detailed information, please see his public [http://www.linkedin.com/in/johnwilander LinkedIn page].

* To see John's wiki contributions, [[:Special:Contributions/John.wilander|click here]]
* His [mailto:john.wilander@owasp.org email address]
* [https://twitter.com/johnwilander @johnwilander]

Builders

2012-03-10T12:09:49Z

John.wilander: Added John Wilander, initiator of the OWASP Builders

==== OWASP Builders ====

{| width="100%"
|- valign="top"
|
'''Builders Community'''

A community of security professionals and stakeholders with the common goal of advancing the state of security in the area of application development.

 '''What Are OWASP Communities?'''

Builders, [http://www.owasp.org/index.php/Breakers Breakers] and [http://www.owasp.org/index.php/Defenders Defenders]; the idea of OWASP Communities is to bring together experts in the area that they are best at with the common goal of advancing the state of application security. This approach allows similar groups of professionals and experts to tackle security problems with the involvement of the most relevant stakeholders. The intent is to drive high quality output that is immediately usable by the target audience. More information about this vision can be found [http://michael-coates.blogspot.com/2011/02/vision-for-owasp.html here].

|
[[Image:OWASP-vision.jpg]]

|}

 

==== The Community ====

      

      

{| cellspacing="1" cellpadding="1" style="width: 404px; height: 413px;"
|-
| [[Image:John_Wilander_090626-346_(for_web).jpg‎|100px]] 
| '''John Wilander''' [https://www.owasp.org/index.php/Global_Conferences_Committee/ Member of the Global Conferences Committee] [https://www.owasp.org/index.php/Sweden OWASP Sweden Chapter Co-Leader] john.wilander@owasp.org http://appsandsecurity.blogspot.com/ [https://twitter.com/johnwilander @johnwilander]
|
|
|-
| [[Image:SimonBennetts-OWASP.jpg]] 
| '''Simon Bennetts''' [[:OWASP Zed Attack Proxy Project|OWASP Zed Attack Proxy Project]] Lead psiinon@owasp.org http://pentest4devs.blogspot.com/ @psiinon
|
|
|-
| Your pic; 
| '''Your name''' ''Your company/project'' ''Your email'' ''Your website'' ''Your twitter''
|
|
|-
| Your pic; 
| '''Your name''' ''Your company/project'' ''Your email'' ''Your website'' ''Your twitter''
|
|}

Want to contribute to the OWASP Builders Community? Add your info and send an email to [mailto:john.wilander@owasp.org john.wilander@owasp.org]
 

==== Developer Outreach ====

Get involved in the Developer Outreach by subscribing to the ...
* [https://lists.owasp.org/mailman/listinfo/developer-outreach Steering List (low traffic)]
* [https://groups.google.com/group/owasp-dev-outreach-discuss Google Group (for discussions)]

The first priority of the Builders Community is to reach out to developers and ask what application security is lacking today. An initial lightweight outreach was performed early March 2011.

=== Developers' Security Itches March 2011 ===
The overall results of the initial outreach can be seen in the diagram below (categorization by John Wilander, full-text available via links below). This is a first glimpse at what developers think are the problems and challenges for application security.

[[Image:Developer_outreach_iteration_1.png]]

Full data searchable via the online database [https://www.grubba.net https://www.grubba.net] (account 'owasp'/'owasp') or available in a .csv file [http://www.owasp.org/images/e/e0/OWASP_Developer_Outreach_Iteration_1.csv.zip here].

=== "Lack of Security in Frameworks" ===
Here's what the developers said in the number one category "Lack of Security in Frameworks":

Question: '''What are your security itches?'''

* ''NMP (not my problem), aka should be handled by the used frameworks'' (spring, struts, etc). [Java and C# developer, 5 years of experience]
* ''The idea that you can tackle all security problems with spring security.'' [Java and C# developer, 5 years of experience]
* ''I want more/most/all implementation-level security issues taken care of at the language and framework level. There are far too many security problems that are left to developers to understand and take care of.'' [Java and JavaScript developer, 15 years experience]
* ''Libraries and frameworks have insecure defaults (example: JSP's c:out). Webapp frameworks doesnt keep up with the security landscape, and there are no quick fixes to add security to these. No central place for developers for different languages and frameworks, making it hard to find the good solutions (making people solve the same problems over and over, with different success rate).'' [Java and JavaScript developer, 6 years of experience]
* ''Things I don't have control over. 3rd party DB drivers, image libraries, all kind of framework.'' [C# and Java developer, 10 years of experience]
* ''Frameworks missing mechanisms for solving common security problems (CSRF, http-only etc.)'' [Java and Ruby developer, 3 years experience]
* ''Lack of security support in frameworks.'' [Java developer, 15 years of experience]
* ''Picking secure components.'' [Java and Scala developer, 8 years of experience]
* ''Missing a lot of functionality in frameworks for handling common security issues.'' [Java and JavaScript developer, 10 years of experience]
* ''Secure by default, i e default settings in frameworks would be nice.'' [Java and JavaScript developer, 10 years of experience]

=== "Security Info Hard to Find" ===
Here's what the developers said in the runner up category "Security Info Hard to Find":

Question: '''What are your security itches?'''

* ''Security is very seldom covered in the channels developers listen to, e.g. developer conferences.'' [Java and JavaScript developer, 10 years experience]
* ''Which tools are good enough? Which frameworks are good enough? Can I trust Google when searching for security solutions? How else to ask?'' [Java developer, 12 years experience]
* ''There are resources for that?'' [C# developer, 10 years experience]
* ''The security info channels you listen to are too noisy. Hard to know what's a real problem.'' [Java and JavaScript developer, 10 years experience]
* ''Would like to see a matrix with various frameworks on one axis and security issues such as OWASP Top 10 on the other. Cells contain links to solutions.'' [Java and JavaScript developer, 10 years experience]
* ''Would like a comparison of what is supported and not in the different web frameworks with regard to security (escaping & encoding, sql-injection, etc).'' [C# and Ruby developer, 3 years experience]
* ''Can't find resources.'' [PHP developer, 15 years experience]
* ''Information is hard to find.'' [C# developer, 4 years experience]

==== Official Builder Projects ====

To be determined

==== All Builder Related Projects ====
All projects that are related to the OWASP Builders community can be found at the following link: [[:Category:OWASP Builders]]

__NOTOC__ <headertabs />

Sweden

2012-03-10T12:05:50Z

John.wilander: Added Jim Manico's talk March 2012

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:John.Wilander@owasp.org John Wilander], [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, Stockholm, March 20, 2012: "Web Application Access Control Design Excellence"'''

Welcome to an OWASP Sweden seminar March 20, with Jim Manico. Book your seat at [https://owaspsweden200312.eventbrite.com/ Eventbrite].

This event will be in English.

Sponsors for this event are:
* F5 who is sponsoring for Jim's travel and hotel
* .SE sponsoring with the venue
* Cybercom who will supply you with beverage and snacks during the evening

The Speaker
Jim Manico is a profile in the OWASP community working with the OWASP podcasts and ESAPI amongst other things. During march he is doing a nordic tour and will be visiting the chapters in Finland, Sweden, Norway and Denmark and we have the pleasure of welcoming him to Stockholm on March 20.
Read more on the OWASP webpage https://www.owasp.org/index.php/User:Jmanico

Abstract for Jim´s talk:

'''Web Application Access Control Design Excellence'''

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

'''OWASP Sweden SSL Day, Stockholm, November 23 2011'''
OWASP Sweden, Stockholm branch is happy to announce a full-day on the topic of SSL in cooperation with Internetdagarna
http://www.internetdagarna.se/ind11/program/seminarium/92

The speakers are
* Jakob Schlyter, Kirei
* John Wilander, OWASP Sweden and Handelsbanken
* Andreas Jonson, Romab
* Henrich Pöhls, University of Passau
* Robert Malmgren, OWASP Sweden and Romab

'''OWASP Sweden Meeting March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.
[[Category:Sweden]]

Sweden

2012-03-10T12:00:16Z

John.wilander: Added SSL Day 2011

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:John.Wilander@owasp.org John Wilander], [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden SSL Day, Stockholm, November 23 2011'''
OWASP Sweden, Stockholm branch is happy to announce a full-day on the topic of SSL in cooperation with Internetdagarna
http://www.internetdagarna.se/ind11/program/seminarium/92

The speakers are
* Jakob Schlyter, Kirei
* John Wilander, OWASP Sweden and Handelsbanken
* Andreas Jonson, Romab
* Henrich Pöhls, University of Passau
* Robert Malmgren, OWASP Sweden and Romab

'''OWASP Sweden Meeting March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.
[[Category:Sweden]]

File:John Wilander 090626-346 (for web).jpg

2012-03-10T11:45:55Z

John.wilander: uploaded a new version of "File:John Wilander 090626-346 (for web).jpg": File was gone. Uploaded it again.

Profile picture for John Wilander

Builders

2011-03-27T23:15:59Z

John.wilander: Added category "Security Info Hard to Find", changed from bold to italics on quotes.

==== OWASP Builders ====

{| width="100%"
|- valign="top"
|
'''Builders Community'''

A community of security professionals and stakeholders with the common goal of advancing the state of security in the area of application development.

 '''What Are OWASP Communities?'''

Builders, Breakers and [http://www.owasp.org/index.php/Defenders Defenders]; the idea of OWASP Communities is to bring together experts in the area that they are best at with the common goal of advancing the state of application security. This approach allows similar groups of professionals and experts to tackle security problems with the involvement of the most relevant stakeholders. The intent is to drive high quality output that is immediately usable by the target audience. More information about this vision can be found [http://michael-coates.blogspot.com/2011/02/vision-for-owasp.html here].

|
[[Image:OWASP-vision.jpg]]

|}

Want to contribute to the OWASP Builders Community? Add your info and send an email to [mailto:john.wilander@owasp.org john.wilander@owasp.org]
 

==== Developer Outreach ====

Get involved in the Developer Outreach by subscribing to the ...
* [https://lists.owasp.org/mailman/listinfo/developer-outreach Steering List (low traffic)]
* [https://groups.google.com/group/owasp-dev-outreach-discuss Google Group (for discussions)]

The first priority of the Builders Community is to reach out to developers and ask what application security is lacking today. An initial lightweight outreach was performed early March 2011.

=== Developers' Security Itches March 2011 ===
The overall results of the initial outreach can be seen in the diagram below (categorization by John Wilander, full-text available via links below). This is a first glimpse at what developers think are the problems and challenges for application security.

[[Image:Developer_outreach_iteration_1.png]]

Full data searchable via the online database [https://www.grubba.net https://www.grubba.net] (account 'owasp'/'owasp') or available in a .csv file [http://www.owasp.org/images/e/e0/OWASP_Developer_Outreach_Iteration_1.csv.zip here].

=== "Lack of Security in Frameworks" ===
Here's what the developers said in the number one category "Lack of Security in Frameworks":

Question: '''What are your security itches?'''

* ''NMP (not my problem), aka should be handled by the used frameworks'' (spring, struts, etc). [Java and C# developer, 5 years of experience]
* ''The idea that you can tackle all security problems with spring security.'' [Java and C# developer, 5 years of experience]
* ''I want more/most/all implementation-level security issues taken care of at the language and framework level. There are far too many security problems that are left to developers to understand and take care of.'' [Java and JavaScript developer, 15 years experience]
* ''Libraries and frameworks have insecure defaults (example: JSP's c:out). Webapp frameworks doesnt keep up with the security landscape, and there are no quick fixes to add security to these. No central place for developers for different languages and frameworks, making it hard to find the good solutions (making people solve the same problems over and over, with different success rate).'' [Java and JavaScript developer, 6 years of experience]
* ''Things I don't have control over. 3rd party DB drivers, image libraries, all kind of framework.'' [C# and Java developer, 10 years of experience]
* ''Frameworks missing mechanisms for solving common security problems (CSRF, http-only etc.)'' [Java and Ruby developer, 3 years experience]
* ''Lack of security support in frameworks.'' [Java developer, 15 years of experience]
* ''Picking secure components.'' [Java and Scala developer, 8 years of experience]
* ''Missing a lot of functionality in frameworks for handling common security issues.'' [Java and JavaScript developer, 10 years of experience]
* ''Secure by default, i e default settings in frameworks would be nice.'' [Java and JavaScript developer, 10 years of experience]

=== "Security Info Hard to Find" ===
Here's what the developers said in the runner up category "Security Info Hard to Find":

Question: '''What are your security itches?'''

* ''Security is very seldom covered in the channels developers listen to, e.g. developer conferences.'' [Java and JavaScript developer, 10 years experience]
* ''Which tools are good enough? Which frameworks are good enough? Can I trust Google when searching for security solutions? How else to ask?'' [Java developer, 12 years experience]
* ''There are resources for that?'' [C# developer, 10 years experience]
* ''The security info channels you listen to are too noisy. Hard to know what's a real problem.'' [Java and JavaScript developer, 10 years experience]
* ''Would like to see a matrix with various frameworks on one axis and security issues such as OWASP Top 10 on the other. Cells contain links to solutions.'' [Java and JavaScript developer, 10 years experience]
* ''Would like a comparison of what is supported and not in the different web frameworks with regard to security (escaping & encoding, sql-injection, etc).'' [C# and Ruby developer, 3 years experience]
* ''Can't find resources.'' [PHP developer, 15 years experience]
* ''Information is hard to find.'' [C# developer, 4 years experience]

__NOTOC__ <headertabs />

Builders

2011-03-27T22:43:11Z

John.wilander: Added link to Defenders page

Builders

2011-03-27T22:27:21Z

John.wilander: Initial commit including results and links from Developer Outreach, iteration 1

File:OWASP Developer Outreach Iteration 1.csv.zip

2011-03-27T21:57:25Z

John.wilander: Comma separated data from Developer Outreach, iteration 1.

Comma separated data from Developer Outreach, iteration 1.

File:Developer outreach iteration 1.png

2011-03-27T21:54:25Z

John.wilander: uploaded a new version of "File:Developer outreach iteration 1.png": Smaller size.

Diagram over categorized developer replies to the initial developer outreach.

File:Developer outreach iteration 1.png

2011-03-27T21:53:00Z

John.wilander: Diagram over categorized developer replies to the initial developer outreach.

Diagram over categorized developer replies to the initial developer outreach.

Sweden

2011-03-11T13:31:06Z

John.wilander: Added links to Mario's two slidesets

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:John.Wilander@owasp.org John Wilander], [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

<paypal>Sweden</paypal>

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

Mario's slides: 
[[Media:Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf‎]] "The Image That Called Me" on SVG security 
[[Media:Mario_Heiderich_OWASP_Sweden_Locking_the_throneroom.pdf‎]] "Locking the Throneroom" on locking the DOM to eradicate XSS

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.

File:Mario Heiderich OWASP Sweden Locking the throneroom.pdf

2011-03-11T13:26:11Z

John.wilander: Mario Heiderich's talk on locking the DOM to eradicate XSS at OWASP Sweden, March 7, 2011.

Mario Heiderich's talk on locking the DOM to eradicate XSS at OWASP Sweden, March 7, 2011.

File:Mario Heiderich OWASP Sweden The image that called me.pdf

2011-03-11T13:24:44Z

John.wilander: Mario Heiderich's talk on SVG security at OWASP Sweden March 7, 2011.

Mario Heiderich's talk on SVG security at OWASP Sweden March 7, 2011.

File:OWASPSummit2011EnduserWarningsBrowserSecurityTrack.pdf

2011-02-24T21:49:18Z

John.wilander: uploaded a new version of "File:OWASPSummit2011EnduserWarningsBrowserSecurityTrack.pdf"

File:OWASPSummit2011EnduserWarningsBrowserSecurityTrack.pdf

2011-02-24T18:31:05Z

John.wilander: uploaded a new version of "File:OWASPSummit2011EnduserWarningsBrowserSecurityTrack.pdf"

Category:Summit 2011 Browser Security Track

2011-02-24T18:29:32Z

John.wilander: Added Enduser Warnings notes

[[Image:T._browser_security.jpg]] 
[[Image:Google-groups-logo-1.jpg|link=https://groups.google.com/group/owasp-summit-browsersec]][https://groups.google.com/group/owasp-summit-browsersec Join the Google Group for this track] 
==== About ====
The Browser Security track of the OWASP Summit 2011 was an initial community effort to bring together browser vendors, major web app providers, well-known white hat hackers, and OWASP leaders to discuss what can be done to enhance web security through the browser. The track comprised of two half-day day workshops on chosen subtopics (see tabs). We invited some of the world's top experts to maximize the chances of moving forward this important area or application security.

===Session Notes===
Here are the notes from all the four browser security sessions. Later on we will publish a Browser Security Report building on these sessions.

[http://www.owasp.org/images/6/6d/OWASPSummit2011SiteSecurityPolicyBrowserSecurityTrack.pdf Site Security Policy notes (pdf)] 
[http://www.owasp.org/images/0/06/OWASPSummit2011DOMSandboxingBrowserSecurityTrack.pdf DOM Sandboxing notes (pdf)] 
[http://www.owasp.org/images/c/cd/OWASPSummit2011HTML5SecurityBrowserSecurityTrack.pdf HTML5 Security notes (pdf)] 
[http://www.owasp.org/images/f/f7/OWASPSummit2011EcmaScript5SecurityBrowserSecurityTrack.pdf EcmaScript 5 Security notes (pdf)] 
[http://www.owasp.org/images/f/f7/OWASPSummit2011EnduserWarningsBrowserSecurityTrack.pdf Enduser Warnings notes (pdf)]

===Who Participated?===
The following browser, major web app, and plugin vendors participated in the browser security sessions: 
[http://www.google.com/chrome http://www.owasp.org/images/f/f6/Chrome_small.jpg]
[http://www.mozilla.com/en-US/firefox/ http://www.owasp.org/images/4/47/Firefox_small.jpg]
[http://ie.microsoft.com/testdrive/info/downloads/Default.html http://www.owasp.org/images/6/62/Internet_explorer_small.jpg]
[http://www.paypal.com https://www.owasp.org/images/c/c9/Paypal_logo.gif]
[http://www.adobe.com http://www.owasp.org/images/8/87/Adobe_logo_standard_for_Tasha.jpg]

/John Wilander, Session Chair
==== DOM Sandboxing ====
===Virtualization and Sandboxing for Secure Multi-Domain Web Apps===

[[Image:JS_DOM_Box_Jasvir_Gaz.jpg]]

===Co-chair Dr Jasvir Nagra===
Jasvir Nagra is a researcher and software engineer at Google. He is the designer of [http://code.google.com/p/google-caja/ Caja] - a secure subset of HTML, CSS and JavaScript; co-author of [http://www.amazon.com/Surreptitious-Software-Obfuscation-Watermarking-Tamperproofing/dp/0321549252 Surreptitious Software] - a book on obfuscation, software watermarking and tamper-proofing, contributer to [http://shindig.apache.org/ Shindig] - the reference implementation of OpenSocial.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
Goals and issues that need browser vendor cooperation:
* '''Attenuated versions of existing apis to sandboxed code'''. How should browsers introduce new apis into the sandbox or allow the sandbox to provide attenuated versions of existing apis to sandboxed code? For example, lets say the sandbox wants to provide an attenuated "alert" function to sandboxed code which does something slightly different than the real "alert". What kind of apis could the browser provide to safely allow such extensions/apis? Do these need to be standardized such that different sandbox vendors can interoperate.
* '''Client side sandboxed apps maintaining state and authentication'''. For example if a user is created in a sandboxed app how is it determined what that user can do?
* '''Create a standard for modifying a sandboxed environment'''
* '''Deprecate and discourage standards''' which ambiently or undeniably pass credentials.
* '''Adopt a simpler rights amplification api''' like [http://web-send.org/introducer Web Introducer]
* '''Create a standard for authentication within a sandboxed environment''' (maybe interfacing with existing auth without passing creds like 0Auth works)

===Working Form===
The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

==== HTML5 ====
===HTML5 Security===
[[Image:Html5_mario_hackvertor.jpg‎‎]]

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
* '''Handle autofocus in a unified and secure way'''. Make sure SOP applies for autofocus usage in frame/iframe'd websites. Re-discuss necessity for (future) attributes like this.
* '''Discuss necessity and capability for the HTML5 form controls'''. Do we need a non-SOP formaction attribute and why?
* '''Goal I''': Initiate and create documentation and references for developers that address security issues. Html5sec.org is a start but impossible to continue or extend large scale without vendor help
* '''Goal II''': Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags. Mainly Opera and Mozilla are addressed here.
* '''Long Term Goal(s)''': Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier. Browser vendors should participate in creating security software and filters - not undermine them as we could experience in the last decade

==== EcmaScript 5====
=== EcmaScript 5 Security ===

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair 2===
To be confirmed.

===Subjects and Goals (draft)===
* '''Fix the problems with Object.defineProperty() and property unsealing / [https://bugzilla.mozilla.org/show_bug.cgi?id=588138 double-freezing]'''. Implement it if not yet done.
* '''Goal I''': Raise awareness for the power or object freezing in a security context. ES5 can really make a change here.
* '''Goal II''': Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented. CSP is a great yet still immature start - but worth discussing and extending. Discuss specification drafts for a secure DOM and easy to configure capability profiles with reasonable and quantitative proofs of concept.
* '''Long Term Goal''': Discuss the possibility of vendor supported client side security mechanisms. Client side IDS/IPS based on ES5 can be possible - yet have to be designed and specified.

==== Site Security Policy ====
There are several initiatives for expressing and enforcing website security policies. [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] for enforced TLS. [https://developer.mozilla.org/en/Introducing_Content_Security_Policy Content Security Policy] for whitelisting resource domains and enforcing file-only JavaScript. [http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx X-Frame-Options] for enforce framing restrictions. Harmonizing these features among browsers is a huge task. Getting developers to adopt and implement is even more challenging. This session will try to address all of these questions as well as the technical alternatives – headers, meta tags, nonces, signatures, html zones, css-like policies, violation events etc.

* Should we have independent, coherent and simple policy mechanisms or a generalized, extensible policy mechanism?
* Should developers have multiple choices for expressing policies such as headers ''and'' meta tags?
* Should policies restrict domains, URLs, or elements? What are the consequences?
* Should one or two browser vendors deploy a policy mechanism in the field, collect experience, and then we set a standard?
* How do we help developers understand the need for policies and how do we help them write/generate/maintain policies?
* How important is performance and web 1.0/web 2.0 compliance? How much of the web can we afford to break? 0 %?

===Co-chair Jeff Hodges===
Jeff Hodges is Distinguished Security Engineer at PayPal, Inc and one of the three original authors of the [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] spec. Check out [http://identitymeme.org/ IdentityMeme.org Jeff's blog].

===Co-chair David Ross===
David Ross is a Principal Security Software Engineer on the MSRC Engineering team at Microsoft. Prior to joining MSRC Engineering in 2002, David spent his formative years on the Internet Explorer Security Team and wears the battle scars with pride. Check out [http://blogs.msdn.com/dross David’s blog].

===Co-chair Lucas Adamski===
Lucas Adamski is the Director of Security Engineering at Mozilla Corporation. He specializes in penetration testing, incident response, spec and code reviews, fuzzing, training, security processes and software PLC. Check out [http://blog.mozilla.com/ladamski/ Lucas' blog].

==== Enduser Warnings ====
===Enduser Warnings===
[[Image:Three_browsers_user_info.jpg]]

===Subjects and Goals (draft)===
Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.

* How should browsers signal invalid SSL certs to the enduser? Are we helping security right now? What to do about 50 % of users clicking through warnings? Mozilla replaces the padlock with a [https://support.mozilla.com/en-US/kb/Site%20Identity%20Button site identity button] i Firefox 4. "Larry" will inform the user of the site's status. Google recently tried out a skull & bones icon for bad certs but moved back to [http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95617 padlocks] again.
* How should browsers communicate other kinds of information such as privacy, malware warnings, "not visited before" etc? Forbes had an interesting example of [http://blogs.forbes.com/kashmirhill/2011/01/05/visualizing-better-privacy-policies/?boxes=Homepagechannels how to visualize privacy].

Some additional information, thoughts and discussions on these subjects elsewhere:

* [http://www.freedom-to-tinker.com/blog/sjs/web-browser-security-user-interfaces-hard-get-right-and-increasingly-inconsistent Web Browser Security User Interfaces: Hard to Get Right and Increasingly Inconsistent], Freedom to Tinker, 18 Jan 2011
* [http://intrepidusgroup.com/insight/2010/04/security-dialogs-and-graphics/ Security Dialogs and Graphics], Insight, 27 Apr 2010
* [http://www.w3.org/TR/wsc-ui/ Web Security Context: User Interface Guidelines], W3C, 12 Aug 2010
* [http://www.clerkendweller.com/2009/7/28/Colour-Overload-with-IE8-Tab-Grouping Colour Overload with IE8 Tab Grouping], Clerkendweller, 28 Jul 2009
* [http://www.usablesecurity.org/emperor/ The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies], IEEE Symposium on Security and Privacy, May 2007

==== Securing Plugins ====
===Securing Plugins===
Should browsers ship with default plugins? Should plugins be auto-updated? Can plugins or versions of plugins be blacklisted centrally?

==== Blacklisting ====
===Blacklisting===
Can we cooperate better on blacklisting? Does it work between cultures, i e can we have the same process for reporting throughout the world?

==== OS Integration ====
===OS Integration===
More and more features in browsers get integrated with the underlying operating system. Processes, fonts, filesystem, 3D graphics. How do we secure this?

==== Sandboxed Browser ====
=== Sandboxed Tabs/Domains/Browser ===
Microsoft Research has been doing some groundbreaking work on the [http://research.microsoft.com/apps/pubs/default.aspx?id=79655 Gazelle browser], Chrome uses a sandboxing model, and the [http://www.romab.com/ironsuite/ IronSuite] provides sandboxed versions of Firefox ([http://www.romab.com/ironfox/ IronFox]) and Safari on Mac OS X.

__NOTOC__
<headertabs />

Questions? Contact [mailto:john.wilander@owasp.org John Wilander, Session Chair] 
[[Summit_2011|'''Return Global Summit 2011 Home Page''']] 
[[:Category:Summit_2011_Tracks|'''Return to Global Summit 2011 Working Sessions''']]

[[Category:Summit_2011]]
[[Category: Summit 2011 Tracks]]

File:OWASPSummit2011EnduserWarningsBrowserSecurityTrack.pdf

2011-02-24T18:28:14Z

John.wilander:

File:OWASPSummit2011DOMSandboxingBrowserSecurityTrack.pdf

2011-02-24T18:01:47Z

John.wilander: uploaded a new version of "File:OWASPSummit2011DOMSandboxingBrowserSecurityTrack.pdf"

File:OWASPSummit2011HTML5SecurityBrowserSecurityTrack.pdf

2011-02-24T18:00:50Z

John.wilander: uploaded a new version of "File:OWASPSummit2011HTML5SecurityBrowserSecurityTrack.pdf"

File:OWASPSummit2011SiteSecurityPolicyBrowserSecurityTrack.pdf

2011-02-24T18:00:14Z

John.wilander: uploaded a new version of "File:OWASPSummit2011SiteSecurityPolicyBrowserSecurityTrack.pdf"

File:OWASPSummit2011EcmaScript5SecurityBrowserSecurityTrack.pdf

2011-02-24T17:59:40Z

John.wilander: uploaded a new version of "File:OWASPSummit2011EcmaScript5SecurityBrowserSecurityTrack.pdf"

Category:Summit 2011 Browser Security Track

2011-02-24T17:53:57Z

John.wilander: Added raw notes from all four browser security sessions

[[Image:T._browser_security.jpg]] 
[[Image:Google-groups-logo-1.jpg|link=https://groups.google.com/group/owasp-summit-browsersec]][https://groups.google.com/group/owasp-summit-browsersec Join the Google Group for this track] 
==== About ====
The Browser Security track of the OWASP Summit 2011 was an initial community effort to bring together browser vendors, major web app providers, well-known white hat hackers, and OWASP leaders to discuss what can be done to enhance web security through the browser. The track comprised of two half-day day workshops on chosen subtopics (see tabs). We invited some of the world's top experts to maximize the chances of moving forward this important area or application security.

===Session Notes===
Here are the notes from all the four browser security sessions. Later on we will publish a Browser Security Report building on these sessions.

[http://www.owasp.org/images/6/6d/OWASPSummit2011SiteSecurityPolicyBrowserSecurityTrack.pdf Site Security Policy notes (pdf)] 
[http://www.owasp.org/images/0/06/OWASPSummit2011DOMSandboxingBrowserSecurityTrack.pdf DOM Sandboxing notes (pdf)] 
[http://www.owasp.org/images/c/cd/OWASPSummit2011HTML5SecurityBrowserSecurityTrack.pdf HTML5 Security notes (pdf)] 
[http://www.owasp.org/images/f/f7/OWASPSummit2011EcmaScript5SecurityBrowserSecurityTrack.pdf EcmaScript 5 Security notes (pdf)]

===Who Participated?===
The following browser, major web app, and plugin vendors participated in the browser security sessions: 
[http://www.google.com/chrome http://www.owasp.org/images/f/f6/Chrome_small.jpg]
[http://www.mozilla.com/en-US/firefox/ http://www.owasp.org/images/4/47/Firefox_small.jpg]
[http://ie.microsoft.com/testdrive/info/downloads/Default.html http://www.owasp.org/images/6/62/Internet_explorer_small.jpg]
[http://www.paypal.com https://www.owasp.org/images/c/c9/Paypal_logo.gif]
[http://www.adobe.com http://www.owasp.org/images/8/87/Adobe_logo_standard_for_Tasha.jpg]

/John Wilander, Session Chair
==== DOM Sandboxing ====
===Virtualization and Sandboxing for Secure Multi-Domain Web Apps===

[[Image:JS_DOM_Box_Jasvir_Gaz.jpg]]

===Co-chair Dr Jasvir Nagra===
Jasvir Nagra is a researcher and software engineer at Google. He is the designer of [http://code.google.com/p/google-caja/ Caja] - a secure subset of HTML, CSS and JavaScript; co-author of [http://www.amazon.com/Surreptitious-Software-Obfuscation-Watermarking-Tamperproofing/dp/0321549252 Surreptitious Software] - a book on obfuscation, software watermarking and tamper-proofing, contributer to [http://shindig.apache.org/ Shindig] - the reference implementation of OpenSocial.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
Goals and issues that need browser vendor cooperation:
* '''Attenuated versions of existing apis to sandboxed code'''. How should browsers introduce new apis into the sandbox or allow the sandbox to provide attenuated versions of existing apis to sandboxed code? For example, lets say the sandbox wants to provide an attenuated "alert" function to sandboxed code which does something slightly different than the real "alert". What kind of apis could the browser provide to safely allow such extensions/apis? Do these need to be standardized such that different sandbox vendors can interoperate.
* '''Client side sandboxed apps maintaining state and authentication'''. For example if a user is created in a sandboxed app how is it determined what that user can do?
* '''Create a standard for modifying a sandboxed environment'''
* '''Deprecate and discourage standards''' which ambiently or undeniably pass credentials.
* '''Adopt a simpler rights amplification api''' like [http://web-send.org/introducer Web Introducer]
* '''Create a standard for authentication within a sandboxed environment''' (maybe interfacing with existing auth without passing creds like 0Auth works)

===Working Form===
The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

==== HTML5 ====
===HTML5 Security===
[[Image:Html5_mario_hackvertor.jpg‎‎]]

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
* '''Handle autofocus in a unified and secure way'''. Make sure SOP applies for autofocus usage in frame/iframe'd websites. Re-discuss necessity for (future) attributes like this.
* '''Discuss necessity and capability for the HTML5 form controls'''. Do we need a non-SOP formaction attribute and why?
* '''Goal I''': Initiate and create documentation and references for developers that address security issues. Html5sec.org is a start but impossible to continue or extend large scale without vendor help
* '''Goal II''': Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags. Mainly Opera and Mozilla are addressed here.
* '''Long Term Goal(s)''': Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier. Browser vendors should participate in creating security software and filters - not undermine them as we could experience in the last decade

==== EcmaScript 5====
=== EcmaScript 5 Security ===

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair 2===
To be confirmed.

===Subjects and Goals (draft)===
* '''Fix the problems with Object.defineProperty() and property unsealing / [https://bugzilla.mozilla.org/show_bug.cgi?id=588138 double-freezing]'''. Implement it if not yet done.
* '''Goal I''': Raise awareness for the power or object freezing in a security context. ES5 can really make a change here.
* '''Goal II''': Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented. CSP is a great yet still immature start - but worth discussing and extending. Discuss specification drafts for a secure DOM and easy to configure capability profiles with reasonable and quantitative proofs of concept.
* '''Long Term Goal''': Discuss the possibility of vendor supported client side security mechanisms. Client side IDS/IPS based on ES5 can be possible - yet have to be designed and specified.

==== Site Security Policy ====
There are several initiatives for expressing and enforcing website security policies. [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] for enforced TLS. [https://developer.mozilla.org/en/Introducing_Content_Security_Policy Content Security Policy] for whitelisting resource domains and enforcing file-only JavaScript. [http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx X-Frame-Options] for enforce framing restrictions. Harmonizing these features among browsers is a huge task. Getting developers to adopt and implement is even more challenging. This session will try to address all of these questions as well as the technical alternatives – headers, meta tags, nonces, signatures, html zones, css-like policies, violation events etc.

* Should we have independent, coherent and simple policy mechanisms or a generalized, extensible policy mechanism?
* Should developers have multiple choices for expressing policies such as headers ''and'' meta tags?
* Should policies restrict domains, URLs, or elements? What are the consequences?
* Should one or two browser vendors deploy a policy mechanism in the field, collect experience, and then we set a standard?
* How do we help developers understand the need for policies and how do we help them write/generate/maintain policies?
* How important is performance and web 1.0/web 2.0 compliance? How much of the web can we afford to break? 0 %?

===Co-chair Jeff Hodges===
Jeff Hodges is Distinguished Security Engineer at PayPal, Inc and one of the three original authors of the [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] spec. Check out [http://identitymeme.org/ IdentityMeme.org Jeff's blog].

===Co-chair David Ross===
David Ross is a Principal Security Software Engineer on the MSRC Engineering team at Microsoft. Prior to joining MSRC Engineering in 2002, David spent his formative years on the Internet Explorer Security Team and wears the battle scars with pride. Check out [http://blogs.msdn.com/dross David’s blog].

===Co-chair Lucas Adamski===
Lucas Adamski is the Director of Security Engineering at Mozilla Corporation. He specializes in penetration testing, incident response, spec and code reviews, fuzzing, training, security processes and software PLC. Check out [http://blog.mozilla.com/ladamski/ Lucas' blog].

==== Enduser Warnings ====
===Enduser Warnings===
[[Image:Three_browsers_user_info.jpg]]

===Subjects and Goals (draft)===
Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.

* How should browsers signal invalid SSL certs to the enduser? Are we helping security right now? What to do about 50 % of users clicking through warnings? Mozilla replaces the padlock with a [https://support.mozilla.com/en-US/kb/Site%20Identity%20Button site identity button] i Firefox 4. "Larry" will inform the user of the site's status. Google recently tried out a skull & bones icon for bad certs but moved back to [http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95617 padlocks] again.
* How should browsers communicate other kinds of information such as privacy, malware warnings, "not visited before" etc? Forbes had an interesting example of [http://blogs.forbes.com/kashmirhill/2011/01/05/visualizing-better-privacy-policies/?boxes=Homepagechannels how to visualize privacy].

Some additional information, thoughts and discussions on these subjects elsewhere:

* [http://www.freedom-to-tinker.com/blog/sjs/web-browser-security-user-interfaces-hard-get-right-and-increasingly-inconsistent Web Browser Security User Interfaces: Hard to Get Right and Increasingly Inconsistent], Freedom to Tinker, 18 Jan 2011
* [http://intrepidusgroup.com/insight/2010/04/security-dialogs-and-graphics/ Security Dialogs and Graphics], Insight, 27 Apr 2010
* [http://www.w3.org/TR/wsc-ui/ Web Security Context: User Interface Guidelines], W3C, 12 Aug 2010
* [http://www.clerkendweller.com/2009/7/28/Colour-Overload-with-IE8-Tab-Grouping Colour Overload with IE8 Tab Grouping], Clerkendweller, 28 Jul 2009
* [http://www.usablesecurity.org/emperor/ The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies], IEEE Symposium on Security and Privacy, May 2007

==== Securing Plugins ====
===Securing Plugins===
Should browsers ship with default plugins? Should plugins be auto-updated? Can plugins or versions of plugins be blacklisted centrally?

==== Blacklisting ====
===Blacklisting===
Can we cooperate better on blacklisting? Does it work between cultures, i e can we have the same process for reporting throughout the world?

==== OS Integration ====
===OS Integration===
More and more features in browsers get integrated with the underlying operating system. Processes, fonts, filesystem, 3D graphics. How do we secure this?

==== Sandboxed Browser ====
=== Sandboxed Tabs/Domains/Browser ===
Microsoft Research has been doing some groundbreaking work on the [http://research.microsoft.com/apps/pubs/default.aspx?id=79655 Gazelle browser], Chrome uses a sandboxing model, and the [http://www.romab.com/ironsuite/ IronSuite] provides sandboxed versions of Firefox ([http://www.romab.com/ironfox/ IronFox]) and Safari on Mac OS X.

__NOTOC__
<headertabs />

Questions? Contact [mailto:john.wilander@owasp.org John Wilander, Session Chair] 
[[Summit_2011|'''Return Global Summit 2011 Home Page''']] 
[[:Category:Summit_2011_Tracks|'''Return to Global Summit 2011 Working Sessions''']]

[[Category:Summit_2011]]
[[Category: Summit 2011 Tracks]]

File:OWASPSummit2011SiteSecurityPolicyBrowserSecurityTrack.pdf

2011-02-24T17:14:02Z

John.wilander:

File:OWASPSummit2011HTML5SecurityBrowserSecurityTrack.pdf

2011-02-24T17:13:14Z

John.wilander:

File:OWASPSummit2011EcmaScript5SecurityBrowserSecurityTrack.pdf

2011-02-24T17:12:41Z

John.wilander:

File:OWASPSummit2011DOMSandboxingBrowserSecurityTrack.pdf

2011-02-24T17:12:18Z

John.wilander:

Category:Summit 2011 Browser Security Track

2011-02-06T17:48:23Z

John.wilander: Added David and Lucas as co-chairs for Site Content Security

[[Image:T._browser_security.jpg]] 
[[Image:Google-groups-logo-1.jpg|link=https://groups.google.com/group/owasp-summit-browsersec]][https://groups.google.com/group/owasp-summit-browsersec Join the Google Group for this track] 
==== About ====
The Browser Security track of the OWASP Summit 2011 is a community effort to bring together browser vendors, major web app providers, and OWASP leaders to discuss what can be done to enhance web security through the browser. The track comprises '''a full day of workshops on chosen subtopics''' (see below). We have invited some of the world's top experts to maximize the chances of moving forward this important area or application security.

Browser vendors attending so far: [http://www.google.com/chrome http://www.owasp.org/images/f/f6/Chrome_small.jpg] [http://www.mozilla.com/en-US/firefox/ http://www.owasp.org/images/4/47/Firefox_small.jpg] [http://ie.microsoft.com/testdrive/info/downloads/Default.html http://www.owasp.org/images/6/62/Internet_explorer_small.jpg]

Major web app providers attending so far: [http://www.paypal.com https://www.owasp.org/images/c/c9/Paypal_logo.gif] [http://www.facebook.com http://www.owasp.org/images/8/8f/Facebook_logo_small.jpg]

[https://groups.google.com/group/owasp-summit-browsersec Join the Google Group for this track] today and get involved in planning, working forms etc.

Welcome! 
/John Wilander, Session Chair
==== DOM Sandboxing ====
===Virtualization and Sandboxing for Secure Multi-Domain Web Apps===

[[Image:JS_DOM_Box_Jasvir_Gaz.jpg]]

===Co-chair Dr Jasvir Nagra===
Jasvir Nagra is a researcher and software engineer at Google. He is the designer of [http://code.google.com/p/google-caja/ Caja] - a secure subset of HTML, CSS and JavaScript; co-author of [http://www.amazon.com/Surreptitious-Software-Obfuscation-Watermarking-Tamperproofing/dp/0321549252 Surreptitious Software] - a book on obfuscation, software watermarking and tamper-proofing, contributer to [http://shindig.apache.org/ Shindig] - the reference implementation of OpenSocial.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
Goals and issues that need browser vendor cooperation:
* '''Attenuated versions of existing apis to sandboxed code'''. How should browsers introduce new apis into the sandbox or allow the sandbox to provide attenuated versions of existing apis to sandboxed code? For example, lets say the sandbox wants to provide an attenuated "alert" function to sandboxed code which does something slightly different than the real "alert". What kind of apis could the browser provide to safely allow such extensions/apis? Do these need to be standardized such that different sandbox vendors can interoperate.
* '''Client side sandboxed apps maintaining state and authentication'''. For example if a user is created in a sandboxed app how is it determined what that user can do?
* '''Create a standard for modifying a sandboxed environment'''
* '''Deprecate and discourage standards''' which ambiently or undeniably pass credentials.
* '''Adopt a simpler rights amplification api''' like [http://web-send.org/introducer Web Introducer]
* '''Create a standard for authentication within a sandboxed environment''' (maybe interfacing with existing auth without passing creds like 0Auth works)

===Working Form===
The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

==== HTML5 ====
===HTML5 Security===
[[Image:Html5_mario_hackvertor.jpg‎‎]]

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
* '''Handle autofocus in a unified and secure way'''. Make sure SOP applies for autofocus usage in frame/iframe'd websites. Re-discuss necessity for (future) attributes like this.
* '''Discuss necessity and capability for the HTML5 form controls'''. Do we need a non-SOP formaction attribute and why?
* '''Goal I''': Initiate and create documentation and references for developers that address security issues. Html5sec.org is a start but impossible to continue or extend large scale without vendor help
* '''Goal II''': Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags. Mainly Opera and Mozilla are addressed here.
* '''Long Term Goal(s)''': Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier. Browser vendors should participate in creating security software and filters - not undermine them as we could experience in the last decade

==== EcmaScript 5====
=== EcmaScript 5 Security ===

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair 2===
To be confirmed.

===Subjects and Goals (draft)===
* '''Fix the problems with Object.defineProperty() and property unsealing / [https://bugzilla.mozilla.org/show_bug.cgi?id=588138 double-freezing]'''. Implement it if not yet done.
* '''Goal I''': Raise awareness for the power or object freezing in a security context. ES5 can really make a change here.
* '''Goal II''': Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented. CSP is a great yet still immature start - but worth discussing and extending. Discuss specification drafts for a secure DOM and easy to configure capability profiles with reasonable and quantitative proofs of concept.
* '''Long Term Goal''': Discuss the possibility of vendor supported client side security mechanisms. Client side IDS/IPS based on ES5 can be possible - yet have to be designed and specified.

==== Site Security Policy ====
There are several initiatives for expressing and enforcing website security policies. [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] for enforced TLS. [https://developer.mozilla.org/en/Introducing_Content_Security_Policy Content Security Policy] for whitelisting resource domains and enforcing file-only JavaScript. [http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx X-Frame-Options] for enforce framing restrictions. Harmonizing these features among browsers is a huge task. Getting developers to adopt and implement is even more challenging. This session will try to address all of these questions as well as the technical alternatives – headers, meta tags, nonces, signatures, html zones, css-like policies, violation events etc.

* Should we have independent, coherent and simple policy mechanisms or a generalized, extensible policy mechanism?
* Should developers have multiple choices for expressing policies such as headers ''and'' meta tags?
* Should policies restrict domains, URLs, or elements? What are the consequences?
* Should one or two browser vendors deploy a policy mechanism in the field, collect experience, and then we set a standard?
* How do we help developers understand the need for policies and how do we help them write/generate/maintain policies?
* How important is performance and web 1.0/web 2.0 compliance? How much of the web can we afford to break? 0 %?

===Co-chair Jeff Hodges===
Jeff Hodges is Distinguished Security Engineer at PayPal, Inc and one of the three original authors of the [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] spec. Check out [http://identitymeme.org/ IdentityMeme.org Jeff's blog].

===Co-chair David Ross===
David Ross is a Principal Security Software Engineer on the MSRC Engineering team at Microsoft. Prior to joining MSRC Engineering in 2002, David spent his formative years on the Internet Explorer Security Team and wears the battle scars with pride. Check out [http://blogs.msdn.com/dross David’s blog].

===Co-chair Lucas Adamski===
Lucas Adamski is the Director of Security Engineering at Mozilla Corporation. He specializes in penetration testing, incident response, spec and code reviews, fuzzing, training, security processes and software PLC. Check out [http://blog.mozilla.com/ladamski/ Lucas' blog].

==== Enduser Warnings ====
===Enduser Warnings===
[[Image:Three_browsers_user_info.jpg]]

===Subjects and Goals (draft)===
Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.

* How should browsers signal invalid SSL certs to the enduser? Are we helping security right now? What to do about 50 % of users clicking through warnings? Mozilla replaces the padlock with a [https://support.mozilla.com/en-US/kb/Site%20Identity%20Button site identity button] i Firefox 4. "Larry" will inform the user of the site's status. Google recently tried out a skull & bones icon for bad certs but moved back to [http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95617 padlocks] again.
* How should browsers communicate other kinds of information such as privacy, malware warnings, "not visited before" etc? Forbes had an interesting example of [http://blogs.forbes.com/kashmirhill/2011/01/05/visualizing-better-privacy-policies/?boxes=Homepagechannels how to visualize privacy].

Some additional information, thoughts and discussions on these subjects elsewhere:

* [http://www.freedom-to-tinker.com/blog/sjs/web-browser-security-user-interfaces-hard-get-right-and-increasingly-inconsistent Web Browser Security User Interfaces: Hard to Get Right and Increasingly Inconsistent], Freedom to Tinker, 18 Jan 2011
* [http://intrepidusgroup.com/insight/2010/04/security-dialogs-and-graphics/ Security Dialogs and Graphics], Insight, 27 Apr 2010
* [http://www.w3.org/TR/wsc-ui/ Web Security Context: User Interface Guidelines], W3C, 12 Aug 2010
* [http://www.clerkendweller.com/2009/7/28/Colour-Overload-with-IE8-Tab-Grouping Colour Overload with IE8 Tab Grouping], Clerkendweller, 28 Jul 2009
* [http://www.usablesecurity.org/emperor/ The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies], IEEE Symposium on Security and Privacy, May 2007

==== Securing Plugins ====
===Securing Plugins===
Should browsers ship with default plugins? Should plugins be auto-updated? Can plugins or versions of plugins be blacklisted centrally?

==== Blacklisting ====
===Blacklisting===
Can we cooperate better on blacklisting? Does it work between cultures, i e can we have the same process for reporting throughout the world?

==== OS Integration ====
===OS Integration===
More and more features in browsers get integrated with the underlying operating system. Processes, fonts, filesystem, 3D graphics. How do we secure this?

==== Sandboxed Browser ====
=== Sandboxed Tabs/Domains/Browser ===
Microsoft Research has been doing some groundbreaking work on the [http://research.microsoft.com/apps/pubs/default.aspx?id=79655 Gazelle browser], Chrome uses a sandboxing model, and the [http://www.romab.com/ironsuite/ IronSuite] provides sandboxed versions of Firefox ([http://www.romab.com/ironfox/ IronFox]) and Safari on Mac OS X.

__NOTOC__
<headertabs />

Questions? Contact [mailto:john.wilander@owasp.org John Wilander, Session Chair] 
[[Summit_2011|'''Return Global Summit 2011 Home Page''']] 
[[:Category:Summit_2011_Tracks|'''Return to Global Summit 2011 Working Sessions''']]

[[Category:Summit_2011]]
[[Category: Summit 2011 Tracks]]

User:John.wilander

2011-02-03T17:25:14Z

John.wilander: Added Twitter link

[[Image:John_Wilander_090626-346_(for_web).jpg‎|John Wilander]]

John Wilander is an application security researcher and consultant. He is a partner and evangelist at Omegapoint, a consultancy firm based in Sweden. John typically works as a security focused software developer. Java and JavaScript are his languages of choice.

After his Master's degree in Computer Science and Engineering from Linköping University (Sweden) and Nanyang Technological University (Singapore) he pursued a PhD in application security. Last paper still pending but John's research publications can be found [http://www.ida.liu.se/~johwi/research_publications/ here].

John started the Swedish OWASP Chapter in 2007 and has since been leader and co-leader. In 2010 he chaired the most successful OWASP AppSec EU conference so far – [http://www.owasp.org/index.php?title=OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010]. John along with the Swedish chapter are listed as contributors to [http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project OWASP Top 10 2010].

For more detailed information, please see my public LinkedIn [http://www.linkedin.com/in/johnwilander page].

* To see my wiki contributions, [[:Special:Contributions/John.wilander|click here]]
* [mailto:john.wilander@owasp.org Email address]
* [https://twitter.com/johnwilander Twitter]

User:John.wilander

2011-02-03T17:23:34Z

John.wilander: Added portrait

[[Image:John_Wilander_090626-346_(for_web).jpg‎|John Wilander]]

John Wilander is an application security researcher and consultant. He is a partner and evangelist at Omegapoint, a consultancy firm based in Sweden. John typically works as a security focused software developer. Java and JavaScript are his languages of choice.

After his Master's degree in Computer Science and Engineering from Linköping University (Sweden) and Nanyang Technological University (Singapore) he pursued a PhD in application security. Last paper still pending but John's research publications can be found [http://www.ida.liu.se/~johwi/research_publications/ here].

John started the Swedish OWASP Chapter in 2007 and has since been leader and co-leader. In 2010 he chaired the most successful OWASP AppSec EU conference so far – [http://www.owasp.org/index.php?title=OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010]. John along with the Swedish chapter are listed as contributors to [http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project OWASP Top 10 2010].

For more detailed information, please see my public LinkedIn [http://www.linkedin.com/in/johnwilander page].

* To see my wiki contributions, [[:Special:Contributions/John.wilander|click here]].
* [mailto:john.wilander@owasp.org Email address].

File:John Wilander 090626-346 (for web).jpg

2011-02-03T17:22:54Z

John.wilander: uploaded a new version of "File:John Wilander 090626-346 (for web).jpg"

Profile picture for John Wilander

File:John Wilander 090626-346 (for web).jpg

2011-02-03T17:18:37Z

John.wilander: Profile picture for John Wilander

Profile picture for John Wilander

Sweden

2011-02-01T14:38:31Z

John.wilander: Added OWASP AppSec Research 2010 for archive purposes

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:John.Wilander@owasp.org John Wilander], [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

<paypal>Sweden</paypal>

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP AppSec Research 2010 in Stockholm, June 21-24 2010'''
June 21-24, 2010 appsec people will meet in beautiful Stockholm, Sweden. The OWASP chapters in Sweden, Norway, and Denmark together with Stockholm University host the [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP AppSec Research 2010].

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.

Sweden

2011-02-01T14:35:25Z

John.wilander: Added Mario event March 7

{{Chapter Template|chaptername=Sweden|extra=The chapter co-leaders are [mailto:John.Wilander@owasp.org John Wilander], [mailto:Mattias.Bergling@owasp.org Mattias Bergling], and [mailto:Robert.Malmgren@owasp.org Robert Malmgren]

<paypal>Sweden</paypal>

|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sweden|emailarchives=http://lists.owasp.org/pipermail/owasp-sweden}}

== The OWASP Sweden blog ==

For lengthy news and event reports please visit the [http://owaspsweden.blogspot.com/ OWASP Sweden blog] (in Swedish).

== Local News ==

'''OWASP Sweden Meeting, March 7 2011, "Security impact of SVG" + ""ECMA Script 5, a frozen DOM and the eradication of XSS'''
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft while finishing his PhD thesis.

We're very happy to invite Mario to OWASP Sweden in March. His two talks will be given in English at Royal Institute of Technology (KTH).

Get your ticket now at [http://marioheiderich.eventbrite.com/ Eventbrite].

'''OWASP Sweden Meeting, Jan 31 2011, "HTTP-säkerhet"'''
Daniel Stenberg, Martin Holst Swende, and John Wilander will give talks for OWASP Sweden on Jan 31, 5:30 pm - 21 pm. The topics are Websockets, the new Cookie RFC, Content Security Policy, HTTP Strict Transport Security, and X-Frame-Options. We will be in lecture hall "New York", World Trade Center, Stockholm ([http://www.hitta.se/SearchMixed.aspx?vad=world%20trade%20center&var=stockholm map]).

[http://www.omegapoint.se Omegapoint] are sponsors and there will be lighter food and beers.

'''OWASP Sweden reaches 500 members ... and gets three leaders'''
OWASP Sweden now has a stunning 500 members on the mailing list. From now the chapter will be lead by three co-leaders: John Wilander, Mattias Bergling, and Robert Malmgren.

'''OWASP Sweden invites Samy Kamkar, October 4, 2010'''
Samy Kamkar, famous for the [http://en.wikipedia.org/wiki/Samy_(XSS) Samy XSS attack on MySpace] in 2005 will be giving a talk for OWASP Sweden on October 4, 5:30 pm - 22 pm. We will be in Ljusgården, Årstaängsvägen 19, Marievik/Liljeholmen, Stockholm ([http://www.hitta.se/LargeMap.aspx?var=%c5rsta%e4ngsv%e4gen+19%2c+Liljeholmen%2fMarievik%2c+Stockholm map]).

Nexus Safe and Data@UrService are sponsors and there will be lighter food and beers.

[[Media:OWASP_Sweden_Samy_Kamkar_oktober_2010.pdf]]

Go to [http://samykamkar.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden + FOSS Sthlm "Community Hack" September 4-5 2010'''
The first weekend of September OWASP Sweden together with FOSS Sthlm invite our members to Community Hack II in Stockholm. A full weekend of hacking on open projects, testing new security hacks, trying out tools (for instance the favorite OWASP tool you've always wanted to learn), or writing new, open guidelines.

Go to [http://communityhack2.eventbrite.com/ EventBrite] and register for free now!

'''OWASP-Sweden Meeting January 21st 2010 -- The Big Protocols'''
Stiftelsen för Internetinfrastruktur (.SE) and Swedish Network Users' Society (SNUS) invite us to three seminars on the big protocols: BGP, DNSSEC, and SSL/TLS.

Program and invitation (in Swedish): [[File:OWASP_Sweden_-_De_stora_protokollen_2010-01-21.pdf]]

'''OWASP-Sweden Meeting December 2nd 2009 -- OWASP Top 10 2010 (rc1)'''
Omegapoint invites us to discuss the release candidate of OWASP Top 10 2010 that was presented at OWASP AppSec DC November 13th. The invitation in Swedish is found [[File:OWASP_Sweden_Top_10_december_2009.pdf | here]].
'''Don't forget to send an email to John Wilander (john.wilander@owasp.org) no later than November 23rd to say you're coming.''' Seats usually fill up fast.

'''OWASP AppSec Research 2010, June 21-24 in Stockholm, Sweden'''
OWASP Sweden, Norway, and Denmark invite you to OWASP AppSec Research 2010, June 21-24 in Stockholm. Read more on the [https://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm%2C_Sweden conference wiki page].

'''OWASP-Sweden Meeting April 28th 2009 -- Code Analysis and Review'''

The second chapter meeting of 2009 will be held on Tuesday April 28th at Clarion Hotel Stockholm. The focus is code analysis and code review. Fortify sponsors the event and welcome the chapter members to refreshments, starting at 17.30.

The program:

* Fredrik Möller (Fortify) will biefly present Fortify and their support of OWASP
* David Anumudu (Fortify) will present and do a live demo of Fortify Solution
* James Dickson (Simovits Consulting) will give a talk on code review

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than April 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting March 26th 2009 -- XSS & CSRF'''

The first meeting of 2009 will be held Thursday March 26th at LabCenter, Oxtorgsgränd 2, Stockholm. The focus is cross-site scripting and cross-site request forgery, attacks and countermeasures. Inspect it and LabCenter sponsor the event and welcome the chapter members to refreshments, starting at 17.00.

The program:

* Hasain Alshakarti, TrueSec: "XSS & CSRF -- A Deadly Cocktail"
* Sergio Molero, Concrete IT: "Skydd mot XSS och CSRF"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than March 23rd to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting November 19th 2008 -- PCI DSS'''

The next chapter meeting is Wednesday November 19th. The focus of the seminars is on PCI-DSS, i.e. security in payment card handling on the Internet.
The program:
* Mats Henriksson, Pan Nordic Card Assoc: "PCI DSS - Tre goda anledningar"
* Pål Göran Stensson, Defensor Sverige AB: "PCI DSS - Externa krav och konsulten"
* Bengt Berg, Cybercom Sweden East AB: "Olika angreppssätt på PCI DSS"

'''The meeting is fully booked. But do send an email to John Wilander (john.wilander@omegapoint.se) to say you're interested and we'll let you know if seats become available.'''

'''OWASP Sweden Hosts the OWASP AppSec Europe Conference 2010'''

We're hosting the European OWASP AppSec conference in 2010! Please read the [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2010_-_Sweden announcement].

'''OWASP-Sweden Meeting October 6th 2008 -- Security in the Open Source Process'''

The next chapter meeting is Monday October 6th at Clarion Hotel Stockholm (Skanstull). The focus of the seminars will be on "Security in the Open Source Process". Refreshments will be served from 16:30 and the seminars will commence at 17:30. Except for a closing panel discussion the program contains the following:

* Simon Josefsson, SJD: ”Anekdoter och lärdomar från granskning av säkerhetsprogram”
* Daniel Stenberg, daniel.haxx.se: ”Säker kod och utveckling i cURL-projektet”
* Anders Karlsson, MySQL och Sun Microsystems: ”MySQL: Säkerhet i ett kommersiellt open source-projekt”

'''Don't forget to send an email to Robert Malmgren (anmalan@romab.com) no later than September 29th to say you're coming.''' We need to know how many will turn up.

'''OWASP-Sweden Meeting May 27th 2008 - SQL Injection, Web Scarab'''

OWASP-Sweden welcomes its members to the next chapter meeting - Tuesday May 27th at Clarion Hotel Stockholm. Refreshments will be served from 17:00, demos will be shown from 17:30, and the seminars will commence at 18:00. The main attractions are:

* Patrik Karlson, Inspect it: "SQL injection, identifiering och utnyttjande"
* Johannes Gumbel, TrueSec: "WebScarab—funktioner, fördelar och nackdelar"

'''Don't forget to send an email to Mattias Bergling (mattias.bergling@inspectit.se) no later than May 21st to say you're coming.''' We need to know how many will turn up.

'''Kick-Off Meeting for OWASP-Sweden April 1st 2008'''

The OWASP-Sweden kick-off will be held at WTC in Stockholm on April 1st. Yeah, it's April Fool's Day but we go under the tagline "Application Security is Not a Joke". The presentation program includes:

* Andrei Sabelfeld, well-known security researcher from Chalmers
* Michael Anderberg, Chief Security Advisor at Microsoft Sweden
* Per Mellstrand, software analyst at Sony Ericsson and researcher at Blekinge Institute of Technology

'''Don't forget to send an email to John Wilander (john.wilander@omegapoint.se) no later than March 27 to say you're coming.''' We need to know how many will turn up.

We're kicking off!

'''OWASP-Sweden in Computer Sweden - 08:44, 19 Dec 2007 (EDT)'''

Today the Swedish national IT newspaper 'Computer Sweden' published an article on the new OWASP-Sweden chapter - [http://computersweden.idg.se/2.2683/1.137387 ''Mecka för säker programmering till Sverige''], or ''A Mecka for Secure Programming Reaches Sweden'' in English. While OWASP is more than a programmer's guide, Mattias Bergling and I are very happy to get the news out to a large part of Sweden's IT industry.

'''To become a member of Owasp-Sweden just join the [http://lists.owasp.org/mailman/listinfo/owasp-sweden mailing list].'''

'''OWASP-Sweden opens! - 22:25, 01 Oct 2007 (EDT)'''

Finally, Sweden has joined the OWASP movement and John Wilander, the local chapter leader, welcomes members to the Stockholm-based OWASP-Sweden. Please, join our mailing list. Plans for meetings and seminars will be made.

Are you interested in helping out? Do you have ideas for great invited speakers or workshop meetings? Feel free to contact the chapter.

Sweden

2011-02-01T14:29:03Z

John.wilander: Added HTTP Sec event Jan 31 (archive purpose, invite via email and Eventbrite)

Category:Summit 2011 Browser Security Track

2011-01-27T14:45:13Z

John.wilander:

[[Image:T._browser_security.jpg]] 
[[Image:Google-groups-logo-1.jpg|link=https://groups.google.com/group/owasp-summit-browsersec]][https://groups.google.com/group/owasp-summit-browsersec Join the Google Group for this track] 
==== About ====
The Browser Security track of the OWASP Summit 2011 is a community effort to bring together browser vendors, major web app providers, and OWASP leaders to discuss what can be done to enhance web security through the browser. The track comprises '''a full day of workshops on chosen subtopics''' (see below). We have invited some of the world's top experts to maximize the chances of moving forward this important area or application security.

Browser vendors attending so far: [http://www.google.com/chrome http://www.owasp.org/images/f/f6/Chrome_small.jpg] [http://www.mozilla.com/en-US/firefox/ http://www.owasp.org/images/4/47/Firefox_small.jpg] [http://ie.microsoft.com/testdrive/info/downloads/Default.html http://www.owasp.org/images/6/62/Internet_explorer_small.jpg]

Major web app providers attending so far: [http://www.paypal.com https://www.owasp.org/images/c/c9/Paypal_logo.gif] [http://www.facebook.com http://www.owasp.org/images/8/8f/Facebook_logo_small.jpg]

[https://groups.google.com/group/owasp-summit-browsersec Join the Google Group for this track] today and get involved in planning, working forms etc.

Welcome! 
/John Wilander, Session Chair
==== DOM Sandboxing ====
===Virtualization and Sandboxing for Secure Multi-Domain Web Apps===

[[Image:JS_DOM_Box_Jasvir_Gaz.jpg]]

===Co-chair Dr Jasvir Nagra===
Jasvir Nagra is a researcher and software engineer at Google. He is the designer of [http://code.google.com/p/google-caja/ Caja] - a secure subset of HTML, CSS and JavaScript; co-author of [http://www.amazon.com/Surreptitious-Software-Obfuscation-Watermarking-Tamperproofing/dp/0321549252 Surreptitious Software] - a book on obfuscation, software watermarking and tamper-proofing, contributer to [http://shindig.apache.org/ Shindig] - the reference implementation of OpenSocial.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
Goals and issues that need browser vendor cooperation:
* '''Attenuated versions of existing apis to sandboxed code'''. How should browsers introduce new apis into the sandbox or allow the sandbox to provide attenuated versions of existing apis to sandboxed code? For example, lets say the sandbox wants to provide an attenuated "alert" function to sandboxed code which does something slightly different than the real "alert". What kind of apis could the browser provide to safely allow such extensions/apis? Do these need to be standardized such that different sandbox vendors can interoperate.
* '''Client side sandboxed apps maintaining state and authentication'''. For example if a user is created in a sandboxed app how is it determined what that user can do?
* '''Create a standard for modifying a sandboxed environment'''
* '''Deprecate and discourage standards''' which ambiently or undeniably pass credentials.
* '''Adopt a simpler rights amplification api''' like [http://web-send.org/introducer Web Introducer]
* '''Create a standard for authentication within a sandboxed environment''' (maybe interfacing with existing auth without passing creds like 0Auth works)

===Working Form===
The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

==== HTML5 ====
===HTML5 Security===
[[Image:Html5_mario_hackvertor.jpg‎‎]]

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
* '''Handle autofocus in a unified and secure way'''. Make sure SOP applies for autofocus usage in frame/iframe'd websites. Re-discuss necessity for (future) attributes like this.
* '''Discuss necessity and capability for the HTML5 form controls'''. Do we need a non-SOP formaction attribute and why?
* '''Goal I''': Initiate and create documentation and references for developers that address security issues. Html5sec.org is a start but impossible to continue or extend large scale without vendor help
* '''Goal II''': Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags. Mainly Opera and Mozilla are addressed here.
* '''Long Term Goal(s)''': Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier. Browser vendors should participate in creating security software and filters - not undermine them as we could experience in the last decade

==== EcmaScript 5====
=== EcmaScript 5 Security ===

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair 2===
To be confirmed.

===Subjects and Goals (draft)===
* '''Fix the problems with Object.defineProperty() and property unsealing / [https://bugzilla.mozilla.org/show_bug.cgi?id=588138 double-freezing]'''. Implement it if not yet done.
* '''Goal I''': Raise awareness for the power or object freezing in a security context. ES5 can really make a change here.
* '''Goal II''': Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented. CSP is a great yet still immature start - but worth discussing and extending. Discuss specification drafts for a secure DOM and easy to configure capability profiles with reasonable and quantitative proofs of concept.
* '''Long Term Goal''': Discuss the possibility of vendor supported client side security mechanisms. Client side IDS/IPS based on ES5 can be possible - yet have to be designed and specified.

==== Site Security Policy ====
There are several initiatives for expressing and enforcing website security policies. [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] for enforced TLS. [https://developer.mozilla.org/en/Introducing_Content_Security_Policy Content Security Policy] for whitelisting resource domains and enforcing file-only JavaScript. [http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx X-Frame-Options] for enforce framing restrictions. Harmonizing these features among browsers is a huge task. Getting developers to adopt and implement is even more challenging. This session will try to address all of these questions as well as the technical alternatives – headers, meta tags, nonces, signatures, html zones, css-like policies, violation events etc.

* Should we have independent, coherent and simple policy mechanisms or a generalized, extensible policy mechanism?
* Should developers have multiple choices for expressing policies such as headers ''and'' meta tags?
* Should policies restrict domains, URLs, or elements? What are the consequences?
* Should one or two browser vendors deploy a policy mechanism in the field, collect experience, and then we set a standard?
* How do we help developers understand the need for policies and how do we help them write/generate/maintain policies?
* How important is performance and web 1.0/web 2.0 compliance? How much of the web can we afford to break? 0 %?

===Co-chair Jeff Hodges===
Jeff Hodges is Distinguished Security Engineer at PayPal, Inc and one of the three original authors of the [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] spec. Check out his blog [http://identitymeme.org/ IdentityMeme.org].

===Co-chair Michael Coates===
[http://www.owasp.org/index.php/User:MichaelCoates Michael Coates] is a long-time OWASP contributor and leader, as well as a Mozilla employee. He leads the [http://www.owasp.org/index.php/Category:OWASP_AppSensor_Project AppSensor] and the [http://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet TLS Cheat Sheet] project.

==== Enduser Warnings ====
===Enduser Warnings===
[[Image:Three_browsers_user_info.jpg]]

===Subjects and Goals (draft)===
Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.

* How should browsers signal invalid SSL certs to the enduser? Are we helping security right now? What to do about 50 % of users clicking through warnings? Mozilla replaces the padlock with a [https://support.mozilla.com/en-US/kb/Site%20Identity%20Button site identity button] i Firefox 4. "Larry" will inform the user of the site's status. Google recently tried out a skull & bones icon for bad certs but moved back to [http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95617 padlocks] again.
* How should browsers communicate other kinds of information such as privacy, malware warnings, "not visited before" etc? Forbes had an interesting example of [http://blogs.forbes.com/kashmirhill/2011/01/05/visualizing-better-privacy-policies/?boxes=Homepagechannels how to visualize privacy].

Some additional information, thoughts and discussions on these subjects elsewhere:

* [http://www.freedom-to-tinker.com/blog/sjs/web-browser-security-user-interfaces-hard-get-right-and-increasingly-inconsistent Web Browser Security User Interfaces: Hard to Get Right and Increasingly Inconsistent], Freedom to Tinker, 18 Jan 2011
* [http://intrepidusgroup.com/insight/2010/04/security-dialogs-and-graphics/ Security Dialogs and Graphics], Insight, 27 Apr 2010
* [http://www.w3.org/TR/wsc-ui/ Web Security Context: User Interface Guidelines], W3C, 12 Aug 2010
* [http://www.clerkendweller.com/2009/7/28/Colour-Overload-with-IE8-Tab-Grouping Colour Overload with IE8 Tab Grouping], Clerkendweller, 28 Jul 2009
* [http://www.usablesecurity.org/emperor/ The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies], IEEE Symposium on Security and Privacy, May 2007

==== Securing Plugins ====
===Securing Plugins===
Should browsers ship with default plugins? Should plugins be auto-updated? Can plugins or versions of plugins be blacklisted centrally?

==== Blacklisting ====
===Blacklisting===
Can we cooperate better on blacklisting? Does it work between cultures, i e can we have the same process for reporting throughout the world?

==== OS Integration ====
===OS Integration===
More and more features in browsers get integrated with the underlying operating system. Processes, fonts, filesystem, 3D graphics. How do we secure this?

==== Sandboxed Browser ====
=== Sandboxed Tabs/Domains/Browser ===
Microsoft Research has been doing some groundbreaking work on the [http://research.microsoft.com/apps/pubs/default.aspx?id=79655 Gazelle browser], Chrome uses a sandboxing model, and the [http://www.romab.com/ironsuite/ IronSuite] provides sandboxed versions of Firefox ([http://www.romab.com/ironfox/ IronFox]) and Safari on Mac OS X.

__NOTOC__
<headertabs />

Questions? Contact [mailto:john.wilander@owasp.org John Wilander, Session Chair] 
[[Summit_2011|'''Return Global Summit 2011 Home Page''']] 
[[:Category:Summit_2011_Tracks|'''Return to Global Summit 2011 Working Sessions''']]

[[Category:Summit_2011]]
[[Category: Summit 2011 Tracks]]

Category:Summit 2011 Browser Security Track

2011-01-27T14:44:15Z

John.wilander: Rework of "New HTTP Headers" -> "Site Security Policy". New agenda, new chair. Switched ordering of "Site Security Policy" and "Enduser Warnings".

[[Image:T._browser_security.jpg]] 
[[Image:Google-groups-logo-1.jpg|link=https://groups.google.com/group/owasp-summit-browsersec]][https://groups.google.com/group/owasp-summit-browsersec Join the Google Group for this track] 
==== About ====
The Browser Security track of the OWASP Summit 2011 is a community effort to bring together browser vendors, major web app providers, and OWASP leaders to discuss what can be done to enhance web security through the browser. The track comprises '''a full day of workshops on chosen subtopics''' (see below). We have invited some of the world's top experts to maximize the chances of moving forward this important area or application security.

Browser vendors attending so far: [http://www.google.com/chrome http://www.owasp.org/images/f/f6/Chrome_small.jpg] [http://www.mozilla.com/en-US/firefox/ http://www.owasp.org/images/4/47/Firefox_small.jpg] [http://ie.microsoft.com/testdrive/info/downloads/Default.html http://www.owasp.org/images/6/62/Internet_explorer_small.jpg]

Major web app providers attending so far: [http://www.paypal.com https://www.owasp.org/images/c/c9/Paypal_logo.gif] [http://www.facebook.com http://www.owasp.org/images/8/8f/Facebook_logo_small.jpg]

[https://groups.google.com/group/owasp-summit-browsersec Join the Google Group for this track] today and get involved in planning, working forms etc.

Welcome! 
/John Wilander, Session Chair
==== DOM Sandboxing ====
===Virtualization and Sandboxing for Secure Multi-Domain Web Apps===

[[Image:JS_DOM_Box_Jasvir_Gaz.jpg]]

===Co-chair Dr Jasvir Nagra===
Jasvir Nagra is a researcher and software engineer at Google. He is the designer of [http://code.google.com/p/google-caja/ Caja] - a secure subset of HTML, CSS and JavaScript; co-author of [http://www.amazon.com/Surreptitious-Software-Obfuscation-Watermarking-Tamperproofing/dp/0321549252 Surreptitious Software] - a book on obfuscation, software watermarking and tamper-proofing, contributer to [http://shindig.apache.org/ Shindig] - the reference implementation of OpenSocial.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
Goals and issues that need browser vendor cooperation:
* '''Attenuated versions of existing apis to sandboxed code'''. How should browsers introduce new apis into the sandbox or allow the sandbox to provide attenuated versions of existing apis to sandboxed code? For example, lets say the sandbox wants to provide an attenuated "alert" function to sandboxed code which does something slightly different than the real "alert". What kind of apis could the browser provide to safely allow such extensions/apis? Do these need to be standardized such that different sandbox vendors can interoperate.
* '''Client side sandboxed apps maintaining state and authentication'''. For example if a user is created in a sandboxed app how is it determined what that user can do?
* '''Create a standard for modifying a sandboxed environment'''
* '''Deprecate and discourage standards''' which ambiently or undeniably pass credentials.
* '''Adopt a simpler rights amplification api''' like [http://web-send.org/introducer Web Introducer]
* '''Create a standard for authentication within a sandboxed environment''' (maybe interfacing with existing auth without passing creds like 0Auth works)

===Working Form===
The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

==== HTML5 ====
===HTML5 Security===
[[Image:Html5_mario_hackvertor.jpg‎‎]]

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Subjects and Goals (draft)===
* '''Handle autofocus in a unified and secure way'''. Make sure SOP applies for autofocus usage in frame/iframe'd websites. Re-discuss necessity for (future) attributes like this.
* '''Discuss necessity and capability for the HTML5 form controls'''. Do we need a non-SOP formaction attribute and why?
* '''Goal I''': Initiate and create documentation and references for developers that address security issues. Html5sec.org is a start but impossible to continue or extend large scale without vendor help
* '''Goal II''': Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags. Mainly Opera and Mozilla are addressed here.
* '''Long Term Goal(s)''': Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier. Browser vendors should participate in creating security software and filters - not undermine them as we could experience in the last decade

==== EcmaScript 5====
=== EcmaScript 5 Security ===

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair 2===
To be confirmed.

===Subjects and Goals (draft)===
* '''Fix the problems with Object.defineProperty() and property unsealing / [https://bugzilla.mozilla.org/show_bug.cgi?id=588138 double-freezing]'''. Implement it if not yet done.
* '''Goal I''': Raise awareness for the power or object freezing in a security context. ES5 can really make a change here.
* '''Goal II''': Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented. CSP is a great yet still immature start - but worth discussing and extending. Discuss specification drafts for a secure DOM and easy to configure capability profiles with reasonable and quantitative proofs of concept.
* '''Long Term Goal''': Discuss the possibility of vendor supported client side security mechanisms. Client side IDS/IPS based on ES5 can be possible - yet have to be designed and specified.

==== Site Security Policy ====
There are several initiatives for expressing and enforcing website security policies. [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] for enforced TLS. [https://developer.mozilla.org/en/Introducing_Content_Security_Policy Content Security Policy] for whitelisting resource domains and enforcing file-only JavaScript. [http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx X-Frame-Options] for enforce framing restrictions. Harmonizing these features among browsers is a huge task. Getting developers to adopt and implement is even more challenging. This session will try to address all of these questions as well as the technical alternatives – headers, meta tags, nonces, signatures, html zones, css-like policies, violation events etc.

* Should we have independent, coherent and simple policy mechanisms or a generalized, extensible policy mechanism for scripting?
* Should developers have multiple choices for expressing policies such as headers ''and'' meta tags?
* Should policies restrict domains, URLs, or elements? What are the consequences?
* Should one or two browser vendors deploy a policy mechanism in the field, collect experience, and then we set a standard?
* How do we help developers understand the need for policies and how do we help them write/generate/maintain policies?
* How important is performance and web 1.0/web 2.0 compliance? How much of the web can we afford to break? 0 %?

===Co-chair Jeff Hodges===
Jeff Hodges is Distinguished Security Engineer at PayPal, Inc and one of the three original authors of the [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] spec. Check out his blog [http://identitymeme.org/ IdentityMeme.org].

===Co-chair Michael Coates===
[http://www.owasp.org/index.php/User:MichaelCoates Michael Coates] is a long-time OWASP contributor and leader, as well as a Mozilla employee. He leads the [http://www.owasp.org/index.php/Category:OWASP_AppSensor_Project AppSensor] and the [http://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet TLS Cheat Sheet] project.

==== Enduser Warnings ====
===Enduser Warnings===
[[Image:Three_browsers_user_info.jpg]]

===Subjects and Goals (draft)===
Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.

* How should browsers signal invalid SSL certs to the enduser? Are we helping security right now? What to do about 50 % of users clicking through warnings? Mozilla replaces the padlock with a [https://support.mozilla.com/en-US/kb/Site%20Identity%20Button site identity button] i Firefox 4. "Larry" will inform the user of the site's status. Google recently tried out a skull & bones icon for bad certs but moved back to [http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95617 padlocks] again.
* How should browsers communicate other kinds of information such as privacy, malware warnings, "not visited before" etc? Forbes had an interesting example of [http://blogs.forbes.com/kashmirhill/2011/01/05/visualizing-better-privacy-policies/?boxes=Homepagechannels how to visualize privacy].

Some additional information, thoughts and discussions on these subjects elsewhere:

* [http://www.freedom-to-tinker.com/blog/sjs/web-browser-security-user-interfaces-hard-get-right-and-increasingly-inconsistent Web Browser Security User Interfaces: Hard to Get Right and Increasingly Inconsistent], Freedom to Tinker, 18 Jan 2011
* [http://intrepidusgroup.com/insight/2010/04/security-dialogs-and-graphics/ Security Dialogs and Graphics], Insight, 27 Apr 2010
* [http://www.w3.org/TR/wsc-ui/ Web Security Context: User Interface Guidelines], W3C, 12 Aug 2010
* [http://www.clerkendweller.com/2009/7/28/Colour-Overload-with-IE8-Tab-Grouping Colour Overload with IE8 Tab Grouping], Clerkendweller, 28 Jul 2009
* [http://www.usablesecurity.org/emperor/ The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies], IEEE Symposium on Security and Privacy, May 2007

==== Securing Plugins ====
===Securing Plugins===
Should browsers ship with default plugins? Should plugins be auto-updated? Can plugins or versions of plugins be blacklisted centrally?

==== Blacklisting ====
===Blacklisting===
Can we cooperate better on blacklisting? Does it work between cultures, i e can we have the same process for reporting throughout the world?

==== OS Integration ====
===OS Integration===
More and more features in browsers get integrated with the underlying operating system. Processes, fonts, filesystem, 3D graphics. How do we secure this?

==== Sandboxed Browser ====
=== Sandboxed Tabs/Domains/Browser ===
Microsoft Research has been doing some groundbreaking work on the [http://research.microsoft.com/apps/pubs/default.aspx?id=79655 Gazelle browser], Chrome uses a sandboxing model, and the [http://www.romab.com/ironsuite/ IronSuite] provides sandboxed versions of Firefox ([http://www.romab.com/ironfox/ IronFox]) and Safari on Mac OS X.

__NOTOC__
<headertabs />

Questions? Contact [mailto:john.wilander@owasp.org John Wilander, Session Chair] 
[[Summit_2011|'''Return Global Summit 2011 Home Page''']] 
[[:Category:Summit_2011_Tracks|'''Return to Global Summit 2011 Working Sessions''']]

[[Category:Summit_2011]]
[[Category: Summit 2011 Tracks]]

Summit 2011 Working Sessions/Session003

2011-01-27T13:24:49Z

John.wilander:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = John Wilander
| summit_session_attendee_email1 = john.wilander@owasp.org
| summit_session_attendee_company1=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 = Michael Coates
| summit_session_attendee_email2 = Michael.Coates@owasp.org
| summit_session_attendee_company2=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 = Colin Watson
| summit_session_attendee_email3 = colin.watson@owasp.org
| summit_session_attendee_company3=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=

| summit_session_attendee_name4 = Stefano Di Paola
| summit_session_attendee_email4 =
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 = Isaac Dawson
| summit_session_attendee_email5 =
| summit_session_attendee_company5= Veracode
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 =
| summit_session_attendee_email6 =
| summit_session_attendee_company6=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6=

| summit_session_attendee_name7 =
| summit_session_attendee_email7 =
| summit_session_attendee_company7=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 =
| summit_session_attendee_email8 =
| summit_session_attendee_company8=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8=

| summit_session_attendee_name9 =
| summit_session_attendee_email9 =
| summit_session_attendee_company9=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._browser_security.jpg]]
| summit_ws_logo = [[Image:WS._browser_security.jpg]]
| summit_session_name = EcmaScript 5 Security
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session003
| mailing_list = https://groups.google.com/group/owasp-summit-browsersec
|-

| short_working_session_description=
|-

| related_project_name1 = Browser Security Track - main page
| related_project_url_1 = http://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track

| related_project_name2 = Google Group for the Browser Security Track
| related_project_url_2 = https://groups.google.com/group/owasp-summit-browsersec

| related_project_name3 =
| related_project_url_3 =

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1= '''Fix the problems with Object.defineProperty() and property unsealing / [https://bugzilla.mozilla.org/show_bug.cgi?id=588138 double-freezing]'''.<noinclude> Implement it if not yet done.</noinclude>

| summit_session_objective_name2 = <noinclude>'''Goal I''': </noinclude>Raise awareness for the power or object freezing in a security context. <noinclude>ES5 can really make a change here.</noinclude>

| summit_session_objective_name3 = <noinclude>'''Goal II''':</noinclude> Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented. <noinclude> CSP is a great yet still immature start - but worth discussing and extending. Discuss specification drafts for a secure DOM and easy to configure capability profiles with reasonable and quantitative proofs of concept.</noinclude>

| summit_session_objective_name4 = '''Long Term Goal''': Discuss the possibility of vendor supported client side security mechanisms. <noinclude>Client side IDS/IPS based on ES5 can be possible - yet have to be designed and specified. </noinclude>

| summit_session_objective_name5 =
|-

| working_session_date_and_time = Tuesday, 09 February Time: TBA

|-

| discussion_model = The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details = 

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair 2===
To be confirmed.

|-

|summit_session_deliverable_name1 = Browser Security Report

|summit_session_deliverable_name2 = Browser Security Priority List

|summit_session_deliverable_name3 =

|summit_session_deliverable_name4 =

|summit_session_deliverable_name5 =

|summit_session_deliverable_name6 =

|summit_session_deliverable_name7 =

|summit_session_deliverable_name8 =

|-

| summit_session_leader_name1 = Mario Heiderich
| summit_session_leader_email1 =
| summit_session_leader_username1 =

| summit_session_leader_name2 = TBC
| summit_session_leader_email2 =
| summit_session_leader_username2 =

| summit_session_leader_name3 =
| summit_session_leader_email3 =
| summit_session_leader_username3 =

|-

| operational_leader_name1 = John Wilander
| operational_leader_email1 = john.wilander@owasp.org

|-
| meeting_notes =
|-
| session_name_mask =  Session003
| session_home_page =  Summit_2011_Working_Sessions/Session003
}}
</includeonly>

Summit 2011 Working Sessions/Session002

2011-01-27T12:47:58Z

John.wilander:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = John Wilander
| summit_session_attendee_email1 = john.wilander@owasp.org
| summit_session_attendee_company1=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 = Michael Coates
| summit_session_attendee_email2 = Michael.Coates@owasp.org
| summit_session_attendee_company2=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 = Colin Watson
| summit_session_attendee_email3 = colin.watson@owasp.org
| summit_session_attendee_company3=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=

| summit_session_attendee_name4 = Stefano Di Paola
| summit_session_attendee_email4 =
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 = Isaac Dawson
| summit_session_attendee_email5 =
| summit_session_attendee_company5= Veracode
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 =
| summit_session_attendee_email6 =
| summit_session_attendee_company6=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6=

| summit_session_attendee_name7 =
| summit_session_attendee_email7 =
| summit_session_attendee_company7=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 =
| summit_session_attendee_email8 =
| summit_session_attendee_company8=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8=

| summit_session_attendee_name9 =
| summit_session_attendee_email9 =
| summit_session_attendee_company9=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._browser_security.jpg]]
| summit_ws_logo = [[Image:WS._browser_security.jpg]]
| summit_session_name = HTML5 Security
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session002
| mailing_list = https://groups.google.com/group/owasp-summit-browsersec
|-

| short_working_session_description=
|-

| related_project_name1 = Browser Security Track - main page
| related_project_url_1 = http://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track

| related_project_name2 = Google Group for the Browser Security Track
| related_project_url_2 = https://groups.google.com/group/owasp-summit-browsersec

| related_project_name3 =
| related_project_url_3 =

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1= '''Handle autofocus in a unified and secure way'''.<noinclude> Make sure SOP applies for autofocus usage in frame/iframe'd websites. Re-discuss necessity for (future) attributes like this.</noinclude>

| summit_session_objective_name2 = '''Discuss necessity and capability for the HTML5 form controls'''.<noinclude> Do we need a non-SOP formaction attribute and why? </noinclude>

| summit_session_objective_name3 = <noinclude>'''Goal I''':</noinclude> Initiate and create documentation and references for developers that address security issues. <noinclude>Html5sec.org is a start but impossible to continue or extend large scale without vendor help</noinclude>

| summit_session_objective_name4 = <noinclude>'''Goal II''':</noinclude>Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags. <noinclude>Mainly Opera and Mozilla are addressed here.</noinclude>

| summit_session_objective_name5 = '''Long Term Goal(s)''': Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier. <noinclude>Browser vendors should participate in creating security software and filters - not undermine them as we could experience in the last decade.</noinclude>
|-

| working_session_date_and_time = Tuesday, 09 February Time: TBA

|-

| discussion_model = The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details = 

[[Image:Html5_mario_hackvertor.jpg‎‎]]

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

|-

|summit_session_deliverable_name1 = Browser Security Report
|summit_session_deliverable_url_1 =

|summit_session_deliverable_name2 = Browser Security Priority Report
|summit_session_deliverable_url_2 =

|summit_session_deliverable_name3 =
|summit_session_deliverable_url_3 =

|summit_session_deliverable_name4 =
|summit_session_deliverable_url_4 =

|summit_session_deliverable_name5 =
|summit_session_deliverable_url_5 =

|summit_session_deliverable_name6 =
|summit_session_deliverable_url_6 =

|summit_session_deliverable_name7 =
|summit_session_deliverable_url_7 =

|summit_session_deliverable_name8 =
|summit_session_deliverable_url_8 =

|-

| summit_session_leader_name1 = Mario Heiderich
| summit_session_leader_email1 =
| summit_session_leader_username1 =

| summit_session_leader_name2 = Gareth Heyes
| summit_session_leader_email2 = gazheyes@gmail.com
| summit_session_leader_username2 = Gareth Heyes

| summit_session_leader_name3 =
| summit_session_leader_email3 =
| summit_session_leader_username3 =

|-

| operational_leader_name1 = John Wilander
| operational_leader_email1 = john.wilander@owasp.org

|-
| meeting_notes =
|-
| session_name_mask =  Session002
| session_home_page =  Summit_2011_Working_Sessions/Session002
}}
</includeonly>

Summit 2011 Working Sessions/Session001

2011-01-27T12:46:43Z

John.wilander:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = Email John Wilander if you are unable to edit the Wiki and would like to sign up!
| summit_session_attendee_email1 = john.wilander@owasp.org
| summit_session_attendee_company1=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 = Michael Coates
| summit_session_attendee_email2 =
| summit_session_attendee_company2=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 = Colin Watson
| summit_session_attendee_email3 =
| summit_session_attendee_company3=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=

| summit_session_attendee_name4 = Stefano Di Paola
| summit_session_attendee_email4 =
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 = Isaac Dawson
| summit_session_attendee_email5 =
| summit_session_attendee_company5= Veracode
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 =
| summit_session_attendee_email6 =
| summit_session_attendee_company6=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6=

| summit_session_attendee_name7 =
| summit_session_attendee_email7 =
| summit_session_attendee_company7=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 =
| summit_session_attendee_email8 =
| summit_session_attendee_company8=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8=

| summit_session_attendee_name9 =
| summit_session_attendee_email9 =
| summit_session_attendee_company9=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._browser_security.jpg]]
| summit_ws_logo = [[Image:WS._browser_security.jpg]]
| summit_session_name = DOM Sandboxing
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session001
| mailing_list = https://groups.google.com/group/owasp-summit-browsersec
|-

| short_working_session_description= '''Virtualization and Sandboxing for Secure Multi-Domain Web Apps'''
|-

| related_project_name1 = Browser Security Track - main page
| related_project_url_1 = http://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track

| related_project_name2 = Google Group for the Browser Security Track
| related_project_url_2 = https://groups.google.com/group/owasp-summit-browsersec

| related_project_name3 =
| related_project_url_3 =

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1= '''Attenuated versions of existing apis to sandboxed code'''. <noinclude>How should browsers introduce new apis into the sandbox or allow the sandbox to provide attenuated versions of existing apis to sandboxed code? For example, lets say the sandbox wants to provide an attenuated "alert" function to sandboxed code which does something slightly different than the real "alert". What kind of apis could the browser provide to safely allow such extensions/apis? Do these need to be standardized such that different sandbox vendors can interoperate.</noinclude>

| summit_session_objective_name2 = '''Client side sandboxed apps maintaining state and authentication'''.<noinclude> For example if a user is created in a sandboxed app how is it determined what that user can do?</noinclude>

| summit_session_objective_name3 = '''Create a standard for modifying a sandboxed environment'''

| summit_session_objective_name4 = '''Deprecate and discourage standards''' which ambiently or undeniably pass credentials.

| summit_session_objective_name5 = '''Create a standard for authentication within a sandboxed environment''' (maybe interfacing with existing auth without passing creds like 0Auth works)

|-

| working_session_date_and_time = Tuesday, 09 February Time: TBA

|-

| discussion_model = The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details = 
[[Image:JS_DOM_Box_Jasvir_Gaz.jpg]]

===Co-chair Dr Jasvir Nagra===
Jasvir Nagra is a researcher and software engineer at Google. He is the designer of [http://code.google.com/p/google-caja/ Caja] - a secure subset of HTML, CSS and JavaScript; co-author of [http://www.amazon.com/Surreptitious-Software-Obfuscation-Watermarking-Tamperproofing/dp/0321549252 Surreptitious Software] - a book on obfuscation, software watermarking and tamper-proofing, contributer to [http://shindig.apache.org/ Shindig] - the reference implementation of OpenSocial.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

|-

|summit_session_deliverable_name1 = Browser Security Report

|summit_session_deliverable_name2 = Browser Security Priority List

|summit_session_deliverable_name3 =

|summit_session_deliverable_name4 =

|summit_session_deliverable_name5 =

|summit_session_deliverable_name6 =

|summit_session_deliverable_name7 =

|summit_session_deliverable_name8 =

|-

| summit_session_leader_name1 = Dr. Jasvir Nagra
| summit_session_leader_email1 =
| summit_session_leader_username1 =

| summit_session_leader_name2 = Gareth Heyes
| summit_session_leader_email2 = gazheyes@gmail.com
| summit_session_leader_username2 = Gareth Heyes

| summit_session_leader_name3 =
| summit_session_leader_email3 =
| summit_session_leader_username3 =

|-

| operational_leader_name1 = John Wilander
| operational_leader_email1 = john.wilander@owasp.org

|-
| meeting_notes =
|-
| session_name_mask =  Session001
| session_home_page =  Summit_2011_Working_Sessions/Session001
}}
</includeonly>