OWASP - User contributions [en]

Belgium Events 2019

2019-12-05T19:14:40Z

LievenDesmet: /* Agenda */

<noinclude>
These are the 2019 events of the [[Belgium|OWASP Belgium Chapter]]. 

Previous year: [[Belgium Events 2018|2018]].

</noinclude>
== 25 November 2019 Meeting ==

=== Where ===

* Host: [https://www.radissonhotels.com/en-us/hotels/park-inn-leuven Park Inn by Radisson Leuven] The event is co-located with [https://impulsprogramma-cybersecurity-2019-11-25.eventbrite.com/ a briefing and industry opportunity meeting of the Flanders Cyber Security impuls program]. Feel free to [https://impulsprogramma-cybersecurity-2019-11-25.eventbrite.com/ register] for this co-located event if interested.

* Address:
Park Inn by Radisson Leuven
Martelarenlaan 36
3010 Leuven

=== Agenda ===

*18h00 - 19h00: Welcome & networking
*19h00 - 19h10: ''[https://www.owasp.org/images/a/a3/Owasp_be_update_20191125.pdf OWASP Update]'' by Lieven Desmet (OWASP BE)
*19h10 - 20h00: ''[https://www.owasp.org/images/3/39/Owasp-be-20191125-deryck-recentevolutionsoauth.pdf Recent evolutions in the OAuth 2.0 and OpenID Connect landscape]'' by Philippe De Ryck (Founder of Pragmatic Web Security and Google Developer Expert)
*20u00 - 20u50: ''[https://www.owasp.org/images/2/23/Owasp-be-2019-11-25-desmet.pdf Detection and Prevention of DNS abuse in .eu TLD]'' by Lieven Desmet (DistriNet, KU Leuven)

=== Program ===

==== Recent evolutions in the OAuth 2.0 and OpenID Connect landscape ====

''Abstract''

Ever since the introduction of OAuth 2.0, the framework has been in continuous evolution. The initial specification addressed a strong need for delegation. However, since then, various addendums focus on the needs of modern applications. Today, the suite of OAuth 2.0 specifications supports a broad spectrum of different scenarios. For each of these scenarios makes their security assumptions and defines a set of best practices.

In this talk, we will investigate a number of these recent additions. We look at the recently added “Proof of Key for Code Exchange” (PKCE) flow. We also investigate how it is becoming the default flow for Single Page Applications. We also extensively dive into “Proof of Possession” tokens. Their security properties are significantly better than bearer tokens. Consequentially, everyone should know what they entail, and how to use them. You will walk away with a solid overview of recent evolutions in OAuth 2.0, and where to use them in your applications.

''Speaker Bio''

Philippe De Ryck helps developers protect companies through better web security. As the founder of Pragmatic Web Security, he travels the world to train developers on web security and security engineering. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. Google recognizes Philippe as a Google Developer Expert for his work on security in Angular applications.

==== Detection and Prevention of DNS abuse in .eu TLD ====

''Abstract''

This session reports on an extensive analysis of 14 months of domain registration in the .eu TLD. In particular, we investigate domain names that are registered for malicious purposes (such as spam, phishing, botnets C&C, ...). The goal of our research is to understand and identify large-scale malicious campaigns, and to early detect and prevent malicious registrations.

We explore the ecosystem and modus operandi of elaborate cyber criminal entities that recurrently register large amounts of domains for one-shot, malicious use. We further report on insights in the operational aspects of this business and observe, for instance, that their processes are only partially automated.

Finally, we present our automatic prediction system, that classifies at registration time whether a domain name will be used maliciously or benign. As such, malicious domain registrations can effectively be prevented from doing any harm. As part of the talk, we discuss the first results of this prediction system, which currently runs in production at EURid, the registry of the .eu TLD.

''Speaker Bio''

Lieven Desmet is a Senior Research Manager on Secure Software in the imec-DistriNet Research Group at the Katholieke Universiteit Leuven (Belgium), where he outlines and implements the research strategy, coaches junior researchers in web and infrastructure security, and participates in dissemination, valorisation and spin-off activities.

=== Registration ===

Registration is via EventBrite: https://owasp-belgium-2019-11-25.eventbrite.com.

=== Coverage ===

n/a

== summit working session on OWASP SAMM ==

OWASP Belgium presents a summit working session on OWASP SAMM in Antwerp on 30 April:

Registration via https://www.eventbrite.com/e/open-security-summit-working-session-tickets-60456102831

== 20 February 2019 Meeting ==



=== Where ===

* Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2019-02-18 to 2018-02-22.)

* Address ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions]):
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee

=== Agenda ===

*18h15 - 19h00: Welcome & sandwiches
*19h00 - 19h10: ''[https://www.owasp.org/images/6/69/Owasp_Belgium_update_2019-02-20_v1.pdf OWASP Update]'' by Sebastien Deleersnyder (OWASP)
*19h10 - 20h00: '[https://www.owasp.org/images/5/54/CSP_Martin_Johns_OWASP_BE.pdf 'CSP in the age of Script Gadgets]'' by Prof. Martin Johns (TU Braunschweig)
*20h00 - 20h10: Break
*20h10 - 21h00: ''Zero to DevSecOps - security in a DevOps world'' (part [https://www.owasp.org/images/7/7d/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_0.pdf 1], [https://www.owasp.org/images/3/3a/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_1.pdf 2], [https://www.owasp.org/images/0/0c/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_2.pdf 3]) by Jimmy Mesta (CTO, Manicode Security)

=== Program ===

==== CSP in the age of Script Gadgets ====

* Speaker:  Prof. Martin Johns (TU Braunschweig)
* Presentation:  not yet available

''Abstract''

Content Security Policy (CSP) was first introduced in 2012. It should have been a silver-bullet defense against various injection attacks, including the rampant Cross-Site Scripting vulnerabilities. Unfortunately, modern development practices and legacy code bases proved to be substantial obstacles. New versions of CSP were released to address usability and compatibility for developers. Unfortunately, researchers discovered many bypasses and vulnerabilities in real-world CSP policies. The latest problem is known as script gadgets, where data is turned into code by legitimate functionality.

In this session, we will take a look at the problems you might encounter when deploying CSP. We start at CSP level 1 and work towards the latest level 3 version. We discuss CSP's features, potential bypasses, and pitfalls to avoid. In the end, you will have gained the knowledge to deploy a secure and effective CSP policy.

''Speaker Bio''

Martin Johns is a full professor at the TU Braunschweig.

==== Zero to DevSecOps - security in a DevOps world ====

* Speaker:  Jimmy Mesta (CTO, Manicode Security)
* Presentation:  not yet available

''Abstract''

The way that software is being deployed is undergoing a massive transformation. As a result, security teams are at a point where they must adapt or be left in the dust. Traditional application security used to be heavyweight and human-driven. Tasks are more often than not mostly manual efforts. Time-consuming security testing often breaks down in an automated world. Dynamic vulnerability scanning and manual code reviews are incompatible with a world where code changes are automatically being pushed to production hundreds of times per day.

This talk will share lessons learned from helping teams of all sizes and maturity levels with their transformation to a DevSecOps model where security goes from being a blocker to an enabler. Specifically, we will cover some of the tools and processes you can start using right now. These tools allow you to start adding real value to your organization through enhanced visibility, vulnerability discovery, and feedback loops. It is time to adapt and embrace a new era of security.

''Speaker Bio''

Jimmy Mesta is CTO at Manicode Security. He is a DevSecOps, Mobile, and Kubernetes Secure Coding Instructor.

=== Registration ===

Registration is via EventBrite: https://owasp-belgium-2019-02-20.eventbrite.com.

=== Coverage ===

n/a

File:Securing Containers on the High Seas (OWASP Belgium September 17-09-2018).pdf

2018-09-24T08:17:04Z

LievenDesmet: Jack Mannino, OWASP BE chapter meeting (17 September 2018) Securing Containers on the High Seas

Jack Mannino, OWASP BE chapter meeting (17 September 2018)
Securing Containers on the High Seas

Belgium Events 2018

2018-09-15T06:27:54Z

LievenDesmet: /* PROGRAM */

<noinclude>
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].

Previous year: [[Belgium Events 2017|2017]].
</noinclude>
== 17 September 2018 Meeting ==

=== WHEN ===
Monday 17 September 2018

=== WHERE ===

; Host: European Commission
: Place Madou, 1
:1210 - Saint-Josse-Ten-Noode
<pre style="color: red">
Pre-registration of the participants' ID is needed to enter the venue; see registration link below!!!
</pre>

=== PROGRAM ===
The agenda:

*18h00 - 18h50: '''Welcome & sandwiches''' 
*18h50 - 19h00: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) 
*19h00 - 19h10: '''Intro by the EC''' (by Miguel Soria Machado, Head of Sector (CSIRC), DIGIT IT Security Directorate, European Commission) 
*19h10 - 20h00: '''Docker Threat Modeling and Top 10''' (by Dirk Wetter) 
:''Abstract:'' Docker containers offer several advantages for developers. Most notably they fit perfectly in software development processes, they enable fast, reproducible
deployments and when properly done, with little change the same container can
run either in a test or production environment.

Despite threatening information out there Docker offers per se also several
security advantages. However it is important to make use of them and as a
minimum avoid several pitfalls. In a worst case scenario this can lead
otherwise to less security or the security benefits which the containment
technology offers are not being used at all.

To avoid this a proper fundamental approach is needed.

Thus this talk models first the most important threats to containerized
environments out there. Based on that the speaker will present 10 security
bullet points which covers

* important Do's and Dont's,
* for advanced needs how to tighten security further.

At the end the speaker gives advice how to check your Docker and
Kubernetes security status yourself.

The talk is based on practical experiences at several costumers and on the
speaker's solid network and systems security expertise.

:''Bio:'' [https://twitter.com/drwetter Dirk Wetter (Ph.D.)] is an independent security consultant with more than 20 years professional experience in information security with a broad technical
and information security management background.

His primary focus nowadays is around web application security. He has also a
solid background on network and systems security.

He's also founder and maintainer of the open source project testssl.sh which
checks the encryption of every SSL/TLS enabled service.

*20h00 - 20h10: break 
*20h10 - 21h00: '''Securing Containers on the High Seas''' (by Jack Mannino) 
:''Abstract:'' It can be a difficult challenge for organizations to securely migrate to containers while shifting processes and security controls. Making the move from legacy virtualization and monolithic deployments to containers requires a solid strategy. Containers offer many inherent security benefits but it’s important to build controls in beyond the containers themselves. From development through container registries and deployment to a runtime environment, it’s important to enforce security and eliminate risks as they’re introduced.

This presentation will focus on scaling container security within an enterprise and building security controls into the way you build, ship, and run containerized services. We will discuss the modern container landscape including different container runtimes and isolation models. We will explore the container lifecycle from your developer’s laptop through your production environment and examine the key security problems to mitigate.

:''Bio:'' [https://twitter.com/jack_mannino Jack Mannino] is the CEO of nVisium. Passionate about security and impossible to keep away from a keyboard, his expertise spans over 15 years of building, breaking, and securing software. Jack founded nVisium in 2009, and since has helped the world's largest software teams enhance security across their software portfolios. He has spoken at conferences globally on topics such as secure design, mobile application security, and cloud-native security.

=== REGISTRATION ===
<pre style="color: red">
Two step registration:
Step 1: Registration via Eventbrite
Step 2: Pre-registration of participants'ID (European Commission)

Pre-registration of the participants' ID will be needed to enter the security on site!!!
</pre>

'''Step 1''': Registration via Eventbrite: https://owasp-belgium-2018-09-17.eventbrite.com

'''Step 2''': Pre-registration of participants'ID: https://ec.europa.eu/eusurvey/runner/OWASPBelgiumChapterMeetingSept17 .

'''The registration deadline for the participants' ID expires on ''Sunday, September 16th midnight''. After this time the registration and admission to the event will not be possible.'''

=== Coverage ===

== 19 March 2018 Meeting ==

=== Where ===

* Host: [https://www.ing.be ING Belgium]

* Address ([https://branches.ing.be/branch/1040_bxl-non-residents map])
Cours St Michel 60
1040 Brussel

=== Agenda ===

* 18h15 - 19h00: Welcome & sandwiches
* 19h00 - 19h10: OWASP Update (by Sebastien Deleersnyder, OWASP)
* 19h10 - 20h00: [[#2018-03-19 Talk 1|KRACKing WPA2 in Practice Using Key Reinstallation Attacks]] (by Mathy Vanhoef, imec-DistriNet-KU Leuven)
* 20h00 - 20h10: Break
* 20h10 - 21h00: [[#2018-03-19 Talk 2|Making the web secure by design]] (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia)
* 21h00 - 21h30: Networking drink

=== Program ===

==== KRACKing WPA2 in Practice Using Key Reinstallation Attacks ====

* Speaker: Mathy Vanhoef, imec-DistriNet-KU Leuven)

''Abstract''

This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.

All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.

The talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.

''Speaker Bio''

Mathy Vanhoef is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where he discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.

==== Making the web secure by design ====

* Speaker: Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia

''Abstract''

Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.

''Speaker Bios''

As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.

As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.

=== Registration ===

Registration was via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com

=== Coverage ===

== 20 February 2018 Meeting ==

=== Where ===

* Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)

* Address ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions]):
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee

=== Agenda ===

*18h15 - 19h00: Welcome & sandwiches
*19h00 - 19h10: [https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update] (by Sebastien Deleersnyder, OWASP)
*19h10 - 20h00: [[#2018-02-20 Talk 1|Developers are not the enemy -- Usable Security for Experts]] (by Prof. Matthew Smith, University of Bonn)
*20h00 - 20h10: Break
*20h10 - 21h00: [[#2018-02-20 Talk 2|The Code Behind The Vulnerability]] (by Barry Dorrans, Microsoft)

=== Program ===

==== Developers are not the enemy -- Usable Security for Experts ====

* Speaker: Prof. Matthew Smith, University of Bonn
* Presentation: https://schd.ws/hosted_files/secappdev2018/a9/Developer%20are%20not%20the%20enemy%20SecAppDev%20web.pdf

''Abstract''

Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.

''Speaker Bio''

Matthew Smith is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at, among others, IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding.

==== The Code Behind The Vulnerability ====

* Speaker: Barry Dorrans, Microsoft
* Presentation: https://schd.ws/hosted_files/secappdev2018/75/The%20code%20behind%20the%20vulnerability.pdf

''Abstract''

Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.

''Speaker Bio''

Barry Dorrans is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.

=== Registration ===

Registration was via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com

=== Coverage ===

n/a

Belgium Events 2018

2018-09-11T07:19:14Z

LievenDesmet: /* PROGRAM */

<noinclude>
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].

Previous year: [[Belgium Events 2017|2017]].
</noinclude>
== 17 September 2018 Meeting ==

=== WHEN ===
Monday 17 September 2018

=== WHERE ===

; Host: European Commission
: Place Madou, 1
:1210 - Saint-Josse-Ten-Noode
<pre style="color: red">
Pre-registration of the participants' ID is needed to enter the venue; see registration link below!!!
</pre>

=== PROGRAM ===
The agenda:

*18h00 - 18h50: '''Welcome & sandwiches''' 
*18h50 - 19h00: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) 
*19h00 - 19h10: '''Intro by the EC''' (by TBD) 
*19h10 - 20h00: '''Docker Threat Modeling and Top 10''' (by Dirk Wetter) 
:''Abstract:'' Docker containers offer several advantages for developers. Most notably they fit perfectly in software development processes, they enable fast, reproducible
deployments and when properly done, with little change the same container can
run either in a test or production environment.

Despite threatening information out there Docker offers per se also several
security advantages. However it is important to make use of them and as a
minimum avoid several pitfalls. In a worst case scenario this can lead
otherwise to less security or the security benefits which the containment
technology offers are not being used at all.

To avoid this a proper fundamental approach is needed.

Thus this talk models first the most important threats to containerized
environments out there. Based on that the speaker will present 10 security
bullet points which covers

* important Do's and Dont's,
* for advanced needs how to tighten security further.

At the end the speaker gives advice how to check your Docker and
Kubernetes security status yourself.

The talk is based on practical experiences at several costumers and on the
speaker's solid network and systems security expertise.

:''Bio:'' [https://twitter.com/drwetter Dirk Wetter (Ph.D.)] is an independent security consultant with more than 20 years professional experience in information security with a broad technical
and information security management background.

His primary focus nowadays is around web application security. He has also a
solid background on network and systems security.

He's also founder and maintainer of the open source project testssl.sh which
checks the encryption of every SSL/TLS enabled service.

*20h00 - 20h10: break 
*20h10 - 21h00: '''Securing Containers on the High Seas''' (by Jack Mannino) 
:''Abstract:'' It can be a difficult challenge for organizations to securely migrate to containers while shifting processes and security controls. Making the move from legacy virtualization and monolithic deployments to containers requires a solid strategy. Containers offer many inherent security benefits but it’s important to build controls in beyond the containers themselves. From development through container registries and deployment to a runtime environment, it’s important to enforce security and eliminate risks as they’re introduced.

This presentation will focus on scaling container security within an enterprise and building security controls into the way you build, ship, and run containerized services. We will discuss the modern container landscape including different container runtimes and isolation models. We will explore the container lifecycle from your developer’s laptop through your production environment and examine the key security problems to mitigate.

:''Bio:'' [https://twitter.com/jack_mannino Jack Mannino] is the CEO of nVisium. Passionate about security and impossible to keep away from a keyboard, his expertise spans over 15 years of building, breaking, and securing software. Jack founded nVisium in 2009, and since has helped the world's largest software teams enhance security across their software portfolios. He has spoken at conferences globally on topics such as secure design, mobile application security, and cloud-native security.

=== REGISTRATION ===
<pre style="color: red">
Two step registration:
Step 1: Registration via Eventbrite
Step 2: Pre-registration of participants'ID (European Commission)

Pre-registration of the participants' ID will be needed to enter the security on site!!!
</pre>

'''Step 1''': Registration via Eventbrite: https://owasp-belgium-2018-09-17.eventbrite.com

'''Step 2''': Pre-registration of participants'ID: https://ec.europa.eu/eusurvey/runner/OWASPBelgiumChapterMeetingSept17 .

'''The registration deadline for the participants' ID expires on ''Sunday, September 16th midnight''. After this time the registration and admission to the event will not be possible.'''

=== Coverage ===

== 19 March 2018 Meeting ==

=== WHEN ===
Monday 19 March 2018

=== WHERE ===

; Host: ING Belgium
; Address
: Cours St Michel 60 - 1040 Brussel

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''KRACKing WPA2 in Practice Using Key Reinstallation Attacks''' (by Mathy Vanhoef, imec-DistriNet-KU Leuven) 
:''Abstract:'' This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.
:All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.
:Talk talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.
:''Bio:'' '''Mathy Vanhoef''' is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where is discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.
*20h00 - 20h10: break 
*20h10 - 21h00: '''Making the web secure by design''' (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia) 
:''Abstract:'' Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.
:''Bio:'' As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.
:''Bio:'' As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.
*21h00 - 21h30: '''Networking drink''' 

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com

=== Coverage ===

== 20 February 2018 Meeting ==

=== WHEN ===
Tuesday 20 February 2018

=== WHERE ===

; Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)
; Address
: Department of Computer Science (foyer at ground floor) Celestijnenlaan 200 A 3001 Heverlee
: ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions])

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''[https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update]''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''[https://schd.ws/hosted_files/secappdev2018/a9/Developer%20are%20not%20the%20enemy%20SecAppDev%20web.pdf Developers are not the enemy -- Usable Security for Experts]''' (by Prof. Matthew Smith, University of Bonn) 
:''Abstract:'' Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.
:''Bio:'' '''Matthew Smith''' is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at amongst others IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding.
*20h00 - 20h10: '''Break''' 
*20h10 - 21h00: '''[https://schd.ws/hosted_files/secappdev2018/75/The%20code%20behind%20the%20vulnerability.pdf The Code Behind The Vulnerability]''' (by Barry Dorrans) 
:''Abstract:'' Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.
:''Bio:'' '''Barry Dorrans''' is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com

=== Coverage ===

Belgium

2018-09-04T12:05:17Z

LievenDesmet: /* Upcoming chapter meetings */

Belgium Events 2018

2018-09-04T12:04:56Z

LievenDesmet: /* REGISTRATION */

<noinclude>
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].

Previous year: [[Belgium Events 2017|2017]].
</noinclude>
== 17 September 2018 Meeting ==

=== WHEN ===
Monday 17 September 2018

=== WHERE ===

; Host: European Commission
: Place Madou, 1
:1210 - Saint-Josse-Ten-Noode
<pre style="color: red">
Pre-registration of the participants' ID is needed to enter the venue; see registration link below!!!
</pre>

=== PROGRAM ===
The agenda:

(no sandwiches/drinks, unless further notice)
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''Docker Threat Modeling and Top 10''' (by Dirk Wetter) 
:''Abstract:'' Docker containers offer several advantages for developers. Most notably they fit perfectly in software development processes, they enable fast, reproducible
deployments and when properly done, with little change the same container can
run either in a test or production environment.

Despite threatening information out there Docker offers per se also several
security advantages. However it is important to make use of them and as a
minimum avoid several pitfalls. In a worst case scenario this can lead
otherwise to less security or the security benefits which the containment
technology offers are not being used at all.

To avoid this a proper fundamental approach is needed.

Thus this talk models first the most important threats to containerized
environments out there. Based on that the speaker will present 10 security
bullet points which covers

* important Do's and Dont's,
* for advanced needs how to tighten security further.

At the end the speaker gives advice how to check your Docker and
Kubernetes security status yourself.

The talk is based on practical experiences at several costumers and on the
speaker's solid network and systems security expertise.

:''Bio:'' [https://twitter.com/drwetter Dirk Wetter (Ph.D.)] is an independent security consultant with more than 20 years professional experience in information security with a broad technical
and information security management background.

His primary focus nowadays is around web application security. He has also a
solid background on network and systems security.

He's also founder and maintainer of the open source project testssl.sh which
checks the encryption of every SSL/TLS enabled service.

*20h00 - 20h10: break 
*20h10 - 21h00: '''Securing Containers on the High Seas''' (by Jack Mannino) 
:''Abstract:'' It can be a difficult challenge for organizations to securely migrate to containers while shifting processes and security controls. Making the move from legacy virtualization and monolithic deployments to containers requires a solid strategy. Containers offer many inherent security benefits but it’s important to build controls in beyond the containers themselves. From development through container registries and deployment to a runtime environment, it’s important to enforce security and eliminate risks as they’re introduced.

This presentation will focus on scaling container security within an enterprise and building security controls into the way you build, ship, and run containerized services. We will discuss the modern container landscape including different container runtimes and isolation models. We will explore the container lifecycle from your developer’s laptop through your production environment and examine the key security problems to mitigate.

:''Bio:'' [https://twitter.com/jack_mannino Jack Mannino] is the CEO of nVisium. Passionate about security and impossible to keep away from a keyboard, his expertise spans over 15 years of building, breaking, and securing software. Jack founded nVisium in 2009, and since has helped the world's largest software teams enhance security across their software portfolios. He has spoken at conferences globally on topics such as secure design, mobile application security, and cloud-native security.

=== REGISTRATION ===
<pre style="color: red">
Two step registration:
Step 1: Registration via Eventbrite
Step 2: Pre-registration of participants'ID (European Commission)

Pre-registration of the participants' ID will be needed to enter the security on site!!!
</pre>

'''Step 1''': Registration via Eventbrite: https://owasp-belgium-2018-09-17.eventbrite.com

'''Step 2''': Pre-registration of participants'ID: https://ec.europa.eu/eusurvey/runner/OWASPBelgiumChapterMeetingSept17 .

'''The registration deadline for the participants' ID expires on ''Sunday, September 16th midnight''. After this time the registration and admission to the event will not be possible.'''

=== Coverage ===

== 19 March 2018 Meeting ==

=== WHEN ===
Monday 19 March 2018

=== WHERE ===

; Host: ING Belgium
; Address
: Cours St Michel 60 - 1040 Brussel

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''KRACKing WPA2 in Practice Using Key Reinstallation Attacks''' (by Mathy Vanhoef, imec-DistriNet-KU Leuven) 
:''Abstract:'' This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.
:All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.
:Talk talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.
:''Bio:'' '''Mathy Vanhoef''' is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where is discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.
*20h00 - 20h10: break 
*20h10 - 21h00: '''Making the web secure by design''' (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia) 
:''Abstract:'' Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.
:''Bio:'' As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.
:''Bio:'' As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.
*21h00 - 21h30: '''Networking drink''' 

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com

=== Coverage ===

== 20 February 2018 Meeting ==

=== WHEN ===
Tuesday 20 February 2018

=== WHERE ===

; Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)
; Address
: Department of Computer Science (foyer at ground floor) Celestijnenlaan 200 A 3001 Heverlee
: ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions])

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''[https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update]''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''[https://schd.ws/hosted_files/secappdev2018/a9/Developer%20are%20not%20the%20enemy%20SecAppDev%20web.pdf Developers are not the enemy -- Usable Security for Experts]''' (by Prof. Matthew Smith, University of Bonn) 
:''Abstract:'' Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.
:''Bio:'' '''Matthew Smith''' is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at amongst others IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding.
*20h00 - 20h10: '''Break''' 
*20h10 - 21h00: '''[https://schd.ws/hosted_files/secappdev2018/75/The%20code%20behind%20the%20vulnerability.pdf The Code Behind The Vulnerability]''' (by Barry Dorrans) 
:''Abstract:'' Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.
:''Bio:'' '''Barry Dorrans''' is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com

=== Coverage ===

Belgium Events 2018

2018-09-04T12:02:10Z

LievenDesmet: /* PROGRAM */

<noinclude>
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].

Previous year: [[Belgium Events 2017|2017]].
</noinclude>
== 17 September 2018 Meeting ==

=== WHEN ===
Monday 17 September 2018

=== WHERE ===

; Host: European Commission
: Place Madou, 1
:1210 - Saint-Josse-Ten-Noode
<pre style="color: red">
Pre-registration of the participants' ID is needed to enter the venue; see registration link below!!!
</pre>

=== PROGRAM ===
The agenda:

(no sandwiches/drinks, unless further notice)
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''Docker Threat Modeling and Top 10''' (by Dirk Wetter) 
:''Abstract:'' Docker containers offer several advantages for developers. Most notably they fit perfectly in software development processes, they enable fast, reproducible
deployments and when properly done, with little change the same container can
run either in a test or production environment.

Despite threatening information out there Docker offers per se also several
security advantages. However it is important to make use of them and as a
minimum avoid several pitfalls. In a worst case scenario this can lead
otherwise to less security or the security benefits which the containment
technology offers are not being used at all.

To avoid this a proper fundamental approach is needed.

Thus this talk models first the most important threats to containerized
environments out there. Based on that the speaker will present 10 security
bullet points which covers

* important Do's and Dont's,
* for advanced needs how to tighten security further.

At the end the speaker gives advice how to check your Docker and
Kubernetes security status yourself.

The talk is based on practical experiences at several costumers and on the
speaker's solid network and systems security expertise.

:''Bio:'' [https://twitter.com/drwetter Dirk Wetter (Ph.D.)] is an independent security consultant with more than 20 years professional experience in information security with a broad technical
and information security management background.

His primary focus nowadays is around web application security. He has also a
solid background on network and systems security.

He's also founder and maintainer of the open source project testssl.sh which
checks the encryption of every SSL/TLS enabled service.

*20h00 - 20h10: break 
*20h10 - 21h00: '''Securing Containers on the High Seas''' (by Jack Mannino) 
:''Abstract:'' It can be a difficult challenge for organizations to securely migrate to containers while shifting processes and security controls. Making the move from legacy virtualization and monolithic deployments to containers requires a solid strategy. Containers offer many inherent security benefits but it’s important to build controls in beyond the containers themselves. From development through container registries and deployment to a runtime environment, it’s important to enforce security and eliminate risks as they’re introduced.

This presentation will focus on scaling container security within an enterprise and building security controls into the way you build, ship, and run containerized services. We will discuss the modern container landscape including different container runtimes and isolation models. We will explore the container lifecycle from your developer’s laptop through your production environment and examine the key security problems to mitigate.

:''Bio:'' [https://twitter.com/jack_mannino Jack Mannino] is the CEO of nVisium. Passionate about security and impossible to keep away from a keyboard, his expertise spans over 15 years of building, breaking, and securing software. Jack founded nVisium in 2009, and since has helped the world's largest software teams enhance security across their software portfolios. He has spoken at conferences globally on topics such as secure design, mobile application security, and cloud-native security.

=== REGISTRATION ===
<pre style="color: red">
Pre-registration of the participants' ID will be needed to enter the security on site.
</pre>
Therefore, please register via this form at the European Commission: https://ec.europa.eu/eusurvey/runner/OWASPBelgiumChapterMeetingSept17 .

'''The registration deadline expires on ''Sunday, September 16th midnight''. After this time the registration and admission to the event will not be possible.'''

=== Coverage ===

== 19 March 2018 Meeting ==

=== WHEN ===
Monday 19 March 2018

=== WHERE ===

; Host: ING Belgium
; Address
: Cours St Michel 60 - 1040 Brussel

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''KRACKing WPA2 in Practice Using Key Reinstallation Attacks''' (by Mathy Vanhoef, imec-DistriNet-KU Leuven) 
:''Abstract:'' This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.
:All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.
:Talk talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.
:''Bio:'' '''Mathy Vanhoef''' is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where is discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.
*20h00 - 20h10: break 
*20h10 - 21h00: '''Making the web secure by design''' (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia) 
:''Abstract:'' Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.
:''Bio:'' As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.
:''Bio:'' As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.
*21h00 - 21h30: '''Networking drink''' 

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com

=== Coverage ===

== 20 February 2018 Meeting ==

=== WHEN ===
Tuesday 20 February 2018

=== WHERE ===

; Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)
; Address
: Department of Computer Science (foyer at ground floor) Celestijnenlaan 200 A 3001 Heverlee
: ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions])

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''[https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update]''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''[https://schd.ws/hosted_files/secappdev2018/a9/Developer%20are%20not%20the%20enemy%20SecAppDev%20web.pdf Developers are not the enemy -- Usable Security for Experts]''' (by Prof. Matthew Smith, University of Bonn) 
:''Abstract:'' Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.
:''Bio:'' '''Matthew Smith''' is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at amongst others IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding.
*20h00 - 20h10: '''Break''' 
*20h10 - 21h00: '''[https://schd.ws/hosted_files/secappdev2018/75/The%20code%20behind%20the%20vulnerability.pdf The Code Behind The Vulnerability]''' (by Barry Dorrans) 
:''Abstract:'' Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.
:''Bio:'' '''Barry Dorrans''' is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com

=== Coverage ===

Belgium Events 2018

2018-09-04T08:08:32Z

2018-03-01T14:12:12Z

LievenDesmet: /* Local News */

Belgium

2018-03-01T14:10:54Z

LievenDesmet: /* Local News */

Belgium Events 2018

2018-03-01T11:52:17Z

LievenDesmet: Added chapter meeting of 19 March

<noinclude>
These are the 2018 events of the [[Belgium|OWASP Belgium Chapter]].

Previous year: [[Belgium Events 2017|2017]].
</noinclude>
== 19 March 2018 Meeting ==

=== WHEN ===
Monday 19 March 2018

=== WHERE ===

; Host: ING Belgium
; Address
: TBD

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''KRACKing WPA2 in Practice Using Key Reinstallation Attacks''' (by Mathy Vanhoef, imec-DistriNet-KU Leuven) 
:''Abstract:'' This talk presents the key reinstallation attack against WPA2 (KRACK attack). It abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key’s associated parameters such as transmit nonces and receive replay counters. Several cryptographic Wi-Fi handshakes are affected by the attack.
:All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value.
:Talk talk also discusses the vulnerability disclosure process that was followed. Since the discovery affected numerous vendors, coordinating the disclosure was non-trivial.
:''Bio:'' '''Mathy Vanhoef''' is a postdoctoral researcher at KU Leuven. He did his PhD on the security of WPA-TKIP, TLS, and RC4. His research interest is in computer security with a focus on wireless security (e.g. Wi-Fi), network protocols in general, the RC4 stream cipher (where is discovered the RC NOMORE attack), and software security (discovering and exploiting vulnerabilities). Currently his main research is about automatically discovering vulnerabilities in network protocol implementations, and proving the correctness of protocol implementations.
*20h10 - 21h00: '''Making the web secure by design''' (by Glenn Ten Cate, ING Belgium, and Riccardo Ten Cate, Xebia) 
:''Abstract:'' Education is the first step in the Secure Software Development Lifecycle. The free OWASP Security Knowledge Framework (SKF) is intended to be a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security. This talk will help you as a developer to become THE Neo of your development team. We will show how you can do security by design and introduce other quality gates into your development pipeline to ensure high end quality and security of your project.
:''Bio:'' As a coder, hacker, speaker, trainer and security researcher employed at ING Belgium, '''Glenn Ten Cate''' has over 10 years experience in the field of security. One of the founders of defensive development [defdev] a security training and conference series dedicated to helping you build and maintain secure software and also speaking at multiple other security conferences in the world. His goals is to create an open-source software development life cycle with the tools and knowledge gathered over the years.
:''Bio:'' As a penetration tester from the Netherlands employed at Xebia, '''Riccardo Ten Cate''' specialises in web-application security and has extensive knowledge in securing web applications in multiple coding languages. He is also a specialist in setting up Secure Software Development Life Cycles.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2018-03-19.eventbrite.com

=== Coverage ===

== 20 February 2018 Meeting ==

=== WHEN ===
Tuesday 20 February 2018

=== WHERE ===

; Host: [https://distrinet.cs.kuleuven.be DistriNet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2018-02-19 to 2018-02-23.)
; Address
: Department of Computer Science (foyer at ground floor) Celestijnenlaan 200 A 3001 Heverlee
: ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions])

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''[https://www.owasp.org/images/7/7a/Owasp_Belgium_update_2018-02-20_v1.pdf OWASP Update]''' (by Sebastien Deleersnyder, OWASP) 
*19h10 - 20h00: '''Developers are not the enemy -- Usable Security for Experts''' (by Prof. Matthew Smith, University of Bonn) 
:''Abstract:'' Usability problems are a major cause of many of today's IT-security incidents. Security systems are often too complicated, time-consuming, and error prone. For more than a decade researchers in the domain of usable security (USEC) have attempted to combat these problems by conducting interdisciplinary research focusing on the root causes of the problems and on the creation of usable security mechanisms. While major improvements have been made, to date USEC research has focused almost entirely on the non-expert end-user. However, many of the most catastrophic security incidents were not caused by end-users, but by developers or administrators. Heartbleed and Shellshock were both caused by single developers yet had global consequences. The Sony hack in 2014 compromised an entire multi-national IT-infrastructure and misappropriated over 100 TB of data, unnoticed. Fundamentally, every software vulnerability and misconfigured system is caused by developers or administrators making mistakes, but very little research has been done into the underlying causalities and possible mitigation strategies. In this talk we will explore the transition from end-user to expert usable security research and look at several application areas, including TLS, passwords, malware analysis and vulnerability analysis.
:''Bio:'' '''Matthew Smith''' is a Professor for Usable Security and Privacy at the University of Bonn. His research is focused on human factors of security and privacy mechanisms with a wide range of application areas, including TLS and network security, authentication, mobile and app security and, most recently, usable security for developers and administrators. His work has been published at amongst others IEEE S&P, ACM CCS, USENIX Security, NDSS, ACM SIGCHI and SOUPS the Symposium on Usable Security and Privacy. In 2015 his ERC Starting Grant "Frontiers of Usable Security" was selected for funding.
*20h00 - 20h10: '''Break''' 
*20h10 - 21h00: '''The Code Behind The Vulnerability''' (by Barry Dorrans) 
:''Abstract:'' Everyone makes security mistakes, and that includes Microsoft (seriously!). Many developers can spot and prevent vulnerabilities listed in the OWASP top 10. But that narrative changes when we look beyond the scope of the OWASP top 10. Compared to some more recent attacks, fixing XSS or SQL injection almost seems easy. In this session, we dive into a couple of .NET core cases that have been reported to the Microsoft Security Response Center (MSRC). Mind you; these vulnerabilities are not just framework vulnerabilities. Instead, they are coding patterns that you may have introduced in your applications. Examples are issues with hash tables, compression, encryption, regular expressions and more. In this session, you will learn how to spot these vulnerabilities in your code. On top of that, you will walk away with the skills to fix them.
:''Bio:'' '''Barry Dorrans''' is the .NET Security Czar, which means he tries to tell everyone else how to code securely and taking the credit when it goes right, as well as running the .NET Core Bug Bounty. He also ends up triaging publicly and privately reported vulnerabilities when it goes wrong before getting someone else to fix the mistakes. This he gets all the fun and none of the real work, aside from the endless stress wondering when the next vulnerability will be discovered.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2018-02-20.eventbrite.com

=== Coverage ===

2017-05-29T14:52:54Z

LievenDesmet: /* Upcoming chapter meetings */

Belgium Events 2017

2017-05-29T14:51:21Z

LievenDesmet:

<noinclude>
These are the 2017 events of the [[Belgium|OWASP Belgium Chapter]].

Previous year: [[Belgium Events 2016|2016]].
</noinclude>
== 19 June 2017 Meeting ==

=== WHEN ===
Monday 19 June 2017

=== WHERE ===

; Host: [https://www.nviso.be NVISO]
; Address
: Sinter-Goedelevoorplein 5 Parvis Sainte Gudule, 1000 Brussels
: ([https://www.google.com/maps/place/Place+Sainte-Gudule+5,+1000+Bruxelles,+Belgium/@50.8474433,4.3586377,151m/data=!3m2!1e3!4b1!4m5!3m4!1s0x47c3c4800313a0a5:0xb62b4416d53a6f8d!8m2!3d50.8474433!4d4.3591849 map], [https://www.google.com/maps/dir//Place+Sainte-Gudule+5,+1000+Bruxelles,+Belgium/@50.8474433,4.3586377,151m/data=!3m1!1e3!4m16!1m7!3m6!1s0x47c3c4800313a0a5:0xb62b4416d53a6f8d!2sPlace+Sainte-Gudule+5,+1000+Bruxelles,+Belgium!3b1!8m2!3d50.8474433!4d4.3591849!4m7!1m0!1m5!1m1!1s0x47c3c4800313a0a5:0xb62b4416d53a6f8d!2m2!1d4.3591849!2d50.8474433 directions])

=== PROGRAM ===
The agenda:
*18h00 - 18h50: '''Welcome & sandwiches'''

*18h50 - 19h00: '''OWASP Update'''

*19h00 - 19h45: '''Threat modeling lessons from Star Wars''' (by Adam Shostack, freelance security consultant)
:''Abstract:'' T.B.D.
:''Bio:''

*19h45 - 20h30: '''T.B.D.''' (by T.B.D)
:''Abstract:'' T.B.D.
:''Bio:'' T.B.D.

*20h30 - ... : '''Reception'''

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2017-06-19.eventbrite.com

=== Coverage ===

== Upcoming Meeting (29 May 2017) in Machelen ==

=== WHEN ===
Monday 29 May 2017

=== WHERE ===

; Host: [https://www.ey.com Ernst & Young]
; Address
: De Kleetlaan 2, 1831 Machelen
: ([https://www.google.com/maps/place/EY+Belgium/@50.88652,4.448027,605m/data=!3m1!1e3!4m5!3m4!1s0x0:0x1d0b0a9e75dc9641!8m2!3d50.8871901!4d4.4500013 map], [https://www.google.com/maps/dir//EY+Belgium,+De+Kleetlaan+2,+1831+Machelen,+Belgium/@50.88652,4.448027,746m/data=!3m1!1e3!4m15!1m6!3m5!1s0x0:0x1d0b0a9e75dc9641!2sEY+Belgium!8m2!3d50.8871901!4d4.4500013!4m7!1m0!1m5!1m1!1s0x47c3dd1d72c2032f:0x1d0b0a9e75dc9641!2m2!1d4.4500011!2d50.8871901 directions])

=== PROGRAM ===
The agenda:
*18h00 - 18h50: '''Welcome & sandwiches''' 
*18h50 - 19h00: '''OWASP Update''' 
*19h00 - 19h45: '''HTTP for the worst and the best''' (by Xavier Mertens, freelance security consultant) 
:''Abstract:'' Today, the classic infection vectors remain SMTP and HTTP. Many spam & phishing campaigns are delivered to the victim’s mailbox and usually the next step of the attack is performed on top of HTTP, by visiting a malicious website or downloading a piece of malicious code. This talk will be split in two parts. To begin, I’ll explain how HTTP techniques are used to make the life of security researchers and incident handlers more difficult (attackers use many techniques to prevent access to their juicy data). The next part will demonstrate that attackers are also humans and make mistakes like all of us. They also need to follow the OWASP Top-10! I’ll review some example of bad code / bad configuration that I found during my investigations.
:''Bio:'' '''Xavier Mertens''' is a freelance security consultant based in Belgium. His job focuses on protecting his customers by applying “offensive” (pentesting) as well as “defensive” security (incident handling, log management, SIEM, security visualisation, OSINT). Xavier is also a SANS Internet Storm Center handler (<nowiki>https://isc.sans.org</nowiki>). He’s also maintaining his security blog (<nowiki>https://blog.rootshell.be</nowiki>) and is a co-organizer of the BruCON security conference (<nowiki>http://www.brucon.org</nowiki>). 
*19h45 - 20h30: '''Reverse engineering with Panopticon: a Libre Cross-Platform Disassembler''' (by Kai Michaelis) 
:''Abstract:'' The Panopticon project aims to develop a tool to end the dominance of proprietary software for reverse engineering.
:Panopticon is a graphical disassembler written in Rust that runs on GNU/Linux, Windows and OS X, which aims to create a free replacement for tools like IDA Pro and BinDiff.
:What sets Panopticon apart from other free disassembler is the belief that an intuitive GUI is paramount to aid human analysts to understand as much of the binary as possible. As such Panopticon comes with an Qt 5 UI written in QML that allows browsing and annotating control flow graphs.
:''Bio:'' '''Kai Michaelis''' studies IT-Security in Bochum, Germany and works part-time on Free Software. When he's not on the campus you can meet him at the local hackerspace. His interests are program analysis, reverse engineering and cryptography.
*20h30 - ... : '''Reception'''

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2017-05-29.eventbrite.com

=== Coverage ===

== Previous Meeting (28 February 2017) in Leuven ==

=== WHEN ===
Tuesday 28 Feburary 2017

=== WHERE ===

; Host: [https://distrinet.cs.kuleuven.be Distrinet Research Group (KU Leuven)] (Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course held in Leuven from 2017-02-27 to 2017-03-03.)
; Address
: Department of Computer Science (foyer at ground floor) Celestijnenlaan 200 A 3001 Heverlee
: ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap map], [https://distrinet.cs.kuleuven.be/about/route/ directions])

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''[https://www.owasp.org/images/2/24/Owasp_Belgium_update_2017-02-28.pdf OWASP Update]''' (by Lieven Desmet) 
*19h10 - 20h00: '''[https://www.owasp.org/images/c/c6/Manico_XSS_Defense_Summary_2017-02-28.pdf XSS defense strategies]''' (by Jim Manico, Manicode Security) 
:''Abstract:'' TBD
:''Bio:'' '''Jim Manico''' is the founder of Manicode Security where he trains software developers on secure coding and security engineering. Jim is a frequent speaker on secure software practices and is a member of the Java-One Rock Star speaker community. Jim was a Global Board Member for the OWASP foundation and is the author of "Iron-Clad Java: Building Secure Web Applications" from McGraw-Hill..
*20h00 - 20h10: '''Break''' 
*20h10 - 21h00: '''[https://www.owasp.org/images/d/db/DeRyck_OWASP_WebSecurityOverview_2017-02-28.pdf Why traditional Web security technologies no longer suffice]''' (by Philippe De Ryck, KU Leuven) 
:''Abstract:'' Not a day goes by without a story on a Web security incident somewhere. A data breach disclosing millions of people’s details. A defacement of a major Web site. Malware served from a legitimate Web site to thousands of users. Contrary to popular belief, the people running these Web sites are generally not clueless about security, but getting it right is just not that easy. Recent evolutions, like the rise of public networks, or the strong dependence on third-party code, have made it easier to attack Web sites, and harder to defend them. Join us to get an overview of these threats, and to take a dive into HTTP Strict Transport Security (HSTS), one of the latest Web security technologies that really help you improve security.
:''Bio:'' '''Philippe De Ryck''' is a professional speaker and trainer on software security and web security. Since he obtained his PhD at the imec-DistriNet research group (KU Leuven, Belgium), he has been running the group's Web Security Training program, which ensures a sustainable knowledge transfer of the group’s security expertise towards practitioners.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2017-02-28.eventbrite.com

=== Coverage ===

Belgium

2017-05-11T07:46:21Z

LievenDesmet: /* WHERE */

{{Chapter Template|chaptername=Belgium|extra=The chapter leader is [mailto:seba@owasp.org Sebastien Deleersnyder]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-belgium|emailarchives=http://lists.owasp.org/pipermail/owasp-belgium}}

= Local News =

== Upcoming events ==

=== Upcoming chapter meetings ===
* '''29 May 2017 in Machelen'''
* others to be decided

See https://www.owasp.org/index.php/Belgium#Chapter_Meetings for more details.

== '''Stay in touch''' ==

<center>
{| cellspacing="15"
|-
| [[Image:Meetup-logo-2x.png|120px|link=http://www.meetup.com/Belgium-OWASP-Open-Web-Application-Security-Project/]]
| [[Image:Join the list.png|150px|link=http://lists.owasp.org/mailman/listinfo/owasp-belgium]]
| [[Image:Follow-us-on-twitter.png|175px|link=https://twitter.com/owasp_be]]
| [[Image:Linkedin-button.gif|135px|link=https://www.linkedin.com/groups/37865]]
|}
</center>
If you want to be invited for the next OWASP Belgium Chapter meetings, please [http://eepurl.com/iFZtb drop us your contact info].

== Structural Sponsors 2017 ==

OWASP Belgium thanks its structural chapter supporters for 2017 and the OWASP BeNeLux Days 2016:

[[File:VeraCode logo.png|250px|link=https://www.veracode.com]]
[[File:Vest.jpg|250px|link=http://www.vest.nl]]
[[File:Intigriti_verticaal.jpg|link=http://www.intigriti.be]]
[[File:Ecurify-2016.png|link=http://www.securify.nl]]
[[File:HPE_logo_250.png|link=http://www8.hp.com/nl/nl/software-solutions/enterprise-security.html]]
[[File:LogoToreon.jpg|250px|link=https://www.toreon.com]]
[[File:Zionsecurity.jpg|link=http://www.zionsecurity.com]]
[[File:Nviso_logo_RGB_baseline_200px.png|link=http://www.nviso.be]]
[[File:Whitehat-security_hor.jpg|link=http://www.whitehatsec.com]]

If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]

= Chapter Meetings =

== Upcoming Meeting (29 May 2017) in Machelen ==

=== WHEN ===
Monday 29 May 2017

=== WHERE ===
Hosted by Ernst & Young.

Address:

De Kleetlaan 2,

1831 Machelen 

=== PROGRAM ===
The agenda:
*18h00 - 18h50: '''Welcome & sandwiches''' 
*18h50 - 19h00: '''OWASP Update''' 
*19h00 - 19h45: '''HTTP for the worst and the best''' (by Xavier Mertens, freelance security consultant) 
:''Abstract:'' Today, the classic infection vectors remain SMTP and HTTP. Many spam & phishing campaigns are delivered to the victim’s mailbox and usually the next step of the attack is performed on top of HTTP, by visiting a malicious website or downloading a piece of malicious code. This talk will be split in two parts. To begin, I’ll explain how HTTP techniques are used to make the life of security researchers and incident handlers more difficult (attackers use many techniques to prevent access to their juicy data). The next part will demonstrate that attackers are also humans and make mistakes like all of us. They also need to follow the OWASP Top-10! I’ll review some example of bad code / bad configuration that I found during my investigations.
:''Bio:'' '''Xavier Mertens''' is a freelance security consultant based in Belgium. His job focuses on protecting his customers by applying “offensive” (pentesting) as well as “defensive” security (incident handling, log management, SIEM, security visualisation, OSINT). Xavier is also a SANS Internet Storm Center handler (<nowiki>https://isc.sans.org</nowiki>). He’s also maintaining his security blog (<nowiki>https://blog.rootshell.be</nowiki>) and is a co-organizer of the BruCON security conference (<nowiki>http://www.brucon.org</nowiki>). 
*19h45 - 20h30: '''Reverse engineering with Panopticon: a Libre Cross-Platform Disassembler''' (by Kai Michaelis) 
:''Abstract:'' The Panopticon project aims to develop a tool to end the dominance of proprietary software for reverse engineering.
:Panopticon is a graphical disassembler written in Rust that runs on GNU/Linux, Windows and OS X, which aims to create a free replacement for tools like IDA Pro and BinDiff.
:What sets Panopticon apart from other free disassembler is the belief that an intuitive GUI is paramount to aid human analysts to understand as much of the binary as possible. As such Panopticon comes with an Qt 5 UI written in QML that allows browsing and annotating control flow graphs.
:''Bio:'' '''Kai Michaelis''' studies IT-Security in Bochum, Germany and works part-time on Free Software. When he's not on the campus you can meet him at the local hackerspace. His interests are program analysis, reverse engineering and cryptography.
*20h30 - ... : '''Reception'''

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2017-05-29.eventbrite.com

=== Coverage ===

== Previous Meeting (28 February 2017) in Leuven ==

=== WHEN ===
Tuesday 28 Feburary 2017

=== WHERE ===
Hosted by [https://distrinet.cs.kuleuven.be Distrinet Research Group (KU Leuven)].

Both speakers are faculty of the [https://www.secappdev.org/ Secure Application Development] course which is held in Leuven from February 27 to March 3.

Address: 
Department of Computer Science (foyer at ground floor) Celestijnenlaan 200 A 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap google maps])

Routemap: https://distrinet.cs.kuleuven.be/about/route/

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''[https://www.owasp.org/images/2/24/Owasp_Belgium_update_2017-02-28.pdf OWASP Update]''' (by Lieven Desmet) 
*19h10 - 20h00: '''[https://www.owasp.org/images/c/c6/Manico_XSS_Defense_Summary_2017-02-28.pdf XSS defense strategies]''' (by Jim Manico, Manicode Security) 
:''Abstract:'' TBD
:''Bio:'' '''Jim Manico''' is the founder of Manicode Security where he trains software developers on secure coding and security engineering. Jim is a frequent speaker on secure software practices and is a member of the Java-One Rock Star speaker community. Jim was a Global Board Member for the OWASP foundation and is the author of "Iron-Clad Java: Building Secure Web Applications" from McGraw-Hill..
*20h00 - 20h10: '''Break''' 
*20h10 - 21h00: '''[https://www.owasp.org/images/d/db/DeRyck_OWASP_WebSecurityOverview_2017-02-28.pdf Why traditional Web security technologies no longer suffice]''' (by Philippe De Ryck, KU Leuven) 
:''Abstract:'' Not a day goes by without a story on a Web security incident somewhere. A data breach disclosing millions of people’s details. A defacement of a major Web site. Malware served from a legitimate Web site to thousands of users. Contrary to popular belief, the people running these Web sites are generally not clueless about security, but getting it right is just not that easy. Recent evolutions, like the rise of public networks, or the strong dependence on third-party code, have made it easier to attack Web sites, and harder to defend them. Join us to get an overview of these threats, and to take a dive into HTTP Strict Transport Security (HSTS), one of the latest Web security technologies that really help you improve security.
:''Bio:'' '''Philippe De Ryck''' is a professional speaker and trainer on software security and web security. Since he obtained his PhD at the imec-DistriNet research group (KU Leuven, Belgium), he has been running the group's Web Security Training program, which ensures a sustainable knowledge transfer of the group’s security expertise towards practitioners.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2017-02-28.eventbrite.com

=== Coverage ===

== Previous Meeting (18 October 2016) in Ghent ==

=== WHEN ===
Tuesday 18 October 2016

=== WHERE ===
Hosted at [http://www.ugent.be/ UGent]

Faculteit Ingenieurswetenschappen en Architectuur 
Campus Boekentoren 
Jozef Plateaustraat 22 
9000 Gent 
Belgium 

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''[https://www.owasp.org/images/1/1c/Owasp_Belgium_update_2016-10-18_v1.pptx OWASP Update] '''
*19h15 - 19h45: '''[https://www.owasp.org/images/7/73/Presentation_Sensei_Security_v17_for_distribution.pdf Find and fix software security problems… wait, do not make security mistakes in the first place!]''' (by Matias Madou) 
:''Abstract:'' Today, companies do not have a shortage of known security problems in their solutions. Tools and people point out numerous software security problems that eventually should be fixed. So how do organizations deal with all these issues? What is the most effective way to get issues fixed? For companies taking security serious, the question is no longer “How many problems can you find?”, but the real question is “How many security issues can you fix or prevent developers from making?” In this session, we explore different routes on how to find and fix security issues, or prevent making them in the first place.
:''Bio:'' Matias is the founder of Sensei Security, a software security startup building solutions to effectively fix and prevent security problems in software. Matias has over a decade of hands-on software security experience ranging from the research to improve existing solutions to scoping and building new solutions. A dozen patents and a bunch of papers are the result of his research that eventually led to a hand full of commercial products.
*19h45 - 19h55: '''Break''' 
*19h55 - 20h30: '''[https://www.owasp.org/images/b/b8/OWASP_MVEE.pptx Exploit mitigation using Multi-Variant Execution]''' (by Stijn Volckaert) 
:''Abstract:'' Software we rely on every day is riddled with security vulnerabilities that can be exploited to crash, extract data, or seize control of computer systems. Current exploit mitigations do not seem to suffice to remedy this situation because hackers can circumvent them with relative ease. In this talk, I will present GHUMVEE, a state-of-the-art Multi-Variant Execution framework that was developed at Ghent University. GHUMVEE can amplify the effectiveness of other exploit mitigations and enable them to detect and block zero-day attacks. The idea is to create multiple diversified replicas of a vulnerable program and to execute these replicas in parallel on the same inputs while simultaneously monitoring their behavior. The program replicas are functionally equivalent under normal circumstances but behave differently when attacked. GHUMVEE detects this behavioral difference using a monitor. In the talk, I will discuss GHUMVEE’s design and implementation, as well as some of the follow-up research sponsored by the Defense Advanced Research Projects Agency (DARPA) in the USA.
:''Bio:'' Stijn is a Postdoctoral Scholar in Prof. Michael Franz’ research group at the University of California, Irvine. He received his Ph.D. from Ghent University in 2015, under the supervision of Prof. Bjorn De Sutter and Prof. Koen De Bosschere. His research interests include systems security, reliability, and compilation. He is the recipient of the 2016 IBM Innovation Award (awarded by the F.W.O) for his PhD thesis on the topic of Multi-Variant Execution.
*20h30 - 20h40: '''Break''' 
*20h40 - 21h15: '''[https://www.owasp.org/images/d/de/OWASP-ASPIRE.pdf ASPIRE: Advanced Software Protection: Integration, Research, and Exploitation]''' (by Bjorn De Sutter) 
:''Abstract:'' ASPIRE is a three year European FP7 research project on software protection to mitigate Man-at-the-End attacks on native code libraries on mobile systems. Together with Nagravision, Gemalto, and SafeNet, world leaders in their respective security markets, four academic institutes aim for developing layered, but software-only protection techniques that can protect the assets embedded in mobile apps of content, software and service providers as well as can be achieved with custom hardware-based protections such as smart cards and dongles. The project also aims for developing a quantitative evaluation methodology to assess the value of combinations of protections, and decision support to aid users of the ASPIRE protection framework. ASPIRE ends in October 2016, so this talk will present a preview off the final project results.
:''Bio:'' Since 2008, Bjorn is a professor in the Computer Systems Lab at Ghent University. His research topics include compiler technologies and software protection, incl. binary rewriting techniques for a wide range of applications such as fault-injection mitigation, side-channel leakage mitigation, anti-reverse engineer, anti-tampering, and anti-debugging. He coordinates the ASPIRE project.
*21h15 - ...: '''drink and networking event'''

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2016-10-18.eventbrite.com

=== Coverage ===

== Previous Meeting (8 September 2016) in Zaventem ==

=== WHEN ===
Thursday 8 September 2016

=== WHERE ===
Hosted at [http://www.pwc.be PwC]

Woluwedal 18 
1932 Zaventem 
Belgium 

Google Maps: https://goo.gl/maps/3Jo8u

=== PROGRAM ===
'''UPDATED AGENDA:'''

The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h15: '''OWASP Update '''
*19h15 - 20h00: '''[https://www.owasp.org/images/0/0e/CloudPiercerOwasp_20160908.pdf CloudPiercer: Bypassing Cloud-based Security Providers]''' (by Thomas Vissers, iMinds-DistriNet-KU Leuven) 
:''Abstract:'' Many website owners turn to Cloud-based Security Providers (CBSPs) to protect their websites from DDoS and web application attacks. Some of these security services rely solely on changing the DNS settings of a customer’s domain name to reroute his traffic through the CBSP's cloud infrastructure. This allows for complete circumvention of the security service by directly attacking the website’s hosting IP address. Therefore, it is crucial that a web server's hosting IP address remains hidden from potential attackers. Despite this risk, our study has shown that, in practice, over 70% of CBSP-protected domains are exposing their real IP address. In this talk, we will discuss several significant attack vectors and steps administrators can take to prevent their IP address from being discovered by attackers.
:''Bio:'' '''Thomas Vissers''' Thomas Vissers is a PhD Researcher at iMinds-Distrinet, KU Leuven. His research is broadly focused on internet security and privacy topics, such as cloud-based security, domain name abuse, denial-of-service attacks, email security and browser fingerprinting. Furthermore, he has a special interest in machine learning, data mining and large-scale analyses. Thomas has published and presented his research at various international conferences, such as CCS, NDSS and HotPETS. He obtained his Master’s degree in Engineering from the University of Antwerp and was a research intern at Anna University, India.
*20h00 - 20h15: '''Break''' 
*20h15 - 21h15: '''[https://www.owasp.org/images/5/58/Owasp_Hackers_Do_we_shoot_or_do_we_hug.pdf Hackers! Do we shoot or do we hug?]''' (by Edwin van Andel, Zerocopter) 
:''Abstract:'' In the ever changing security landscape we are slowly seeing a shift from labeling hackers per default as 'bad and malicious individuals', to accepting them slowly as 'useful and potentially friendly’. We see more and more compagnies starting a bug bounty program and/or a Responsible Disclosure (Coordinated vulnerability disclosure) program.
:We in te Netherlands are (at least in Europe) leading the pack on this last subject, also backed heavily by the Dutch NCSC, the Dutch government and the Dutch prosecution services with their Responsible Disclosure guideline .
:In this interactive and mostly humorous talk I’ll start with defining security (in a grotesk way), followed bij the definition of hackers, the way hackers think and work, and how they can be used instead of feared by compagnies. I’ll show how bug bounties and the Responsible Disclosure processes work, or how they sometimes do not. I will also take the audience with me on some examples on how and why some websites fail in being secure, and the development errors behind those fails.
:During the talk I interact a lot with the audience, do quiz questions about the subject, and reward good answers with a bottle of club-mate. At the end of the talk the combined audience consensus should of course be to hug the hackers!
:''Bio:'' '''Edwin van Andel''' , better known as @Yafsec, joined Zerocopter, where he's mostly working on publicly expanding their “continuous security” platform. Elected winner of the Lightning talks at BruCON 2013, and organizer of the alternative NCSC conference "because no hackers were invited" #ALT-S, he is now a renown speaker that will introduce you -in a humorous way- to the dangers, virtues and current state of affairs in the security landscape.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2016-09-08.eventbrite.com

=== Coverage ===

== Previous Meeting (23 May 2016) in Mechelen ==

=== WHEN ===
Monday 23 May 2016

=== WHERE ===
Hosted at Moonbeat (Mechelen), kindly offered by [http://www.is4u.be/ is4u].

Venue address: 
Moonbeat 
Oude Brusselsestraat 10-12 
2800 mechelen 

Route/Parking: http://www.moonbeat.be/contact .

=== PROGRAM ===
The agenda:
*18h00 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h10: '''OWASP Update '''
*19h10 - 20h00: '''All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS''' (by Mathy Vanhoef, iMinds-DistriNet-KU Leuven) 
:''Abstract:'' We present new biases in RC4, break the Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP), and design a practical plaintext recovery attack against the Transport Layer Security (TLS) protocol. To empirically find new biases in the RC4 keystream we use statistical hypothesis tests. This reveals many new biases in the initial keystream bytes, as well as several new long-term biases. Our fixed-plaintext recovery algorithms are capable of using multiple types of biases, and return a list of plaintext candidates in decreasing likelihood.
:To break WPA-TKIP we introduce a method to generate a large number of identical packets. This packet is decrypted by generating its plaintext candidate list, and using redundant packet structure to prune bad candidates. From the decrypted packet we derive the TKIP MIC key, which can be used to inject and decrypt packets. In practice the attack can be executed within an hour. We also attack TLS as used by HTTPS, where we show how to decrypt a secure cookie with a high success rate using roughly one billion ciphertexts. This is done by injecting known data around the cookie, abusing this using Mantin's ABSAB bias, and brute-forcing the cookie by traversing the plaintext candidates. Using our traffic generation technique, we are able to execute the attack in merely 75 hours.
:''Bio:'' '''Mathy Vanhoef''' is a PhD student at KU Leuven, where he performs research on RC4 and its usage in network protocols such as WPA-TKIP and SSL/TLS (e.g. he discovered the RC4 NOMORE attack). He also focuses on wireless security, where he studies MAC address randomization, analyzes protocols like WPA-TKIP, and implements low-layer Wi-Fi attacks using commodity hardware. Apart from research, he is also interested in low-level security, reverse engineering, and binary exploitation. He regularly participates in CTFs with KU Leuven's Hacknamstyle CTF team.
*20h00 - 20h10: '''Break''' 
*20h10 - 21h00: '''Docker Security''' (by Nils De Moor, CTO at WooRank) 
:''Abstract:'' Docker, the new kid on the block, has taken the Ops world by storm. Suddenly everybody wants applications to be containerized and kick them from a development machine up to a production stack in seconds. But this new paradigm obviously has consequences in terms of security and compliance. In this talk we'll look at how to construct a container around applications and dive deeper into how we can put a tight lock around it, thanks to the built-in security primitives.
:''Bio:'' '''Nils De Moor''' is co-founder and CTO at WooRank, a SaaS tool for digital marketing agencies to monitor online presence of a brand. By grabbing and calculating millions of data points every day, he developed a passion for automating, scaling and distributing applications. Besides that he is passionate about open source communities and has started some initiatives, like techbelgium.io, Docker and AWS meetup groups, etc.
*21h00 - ... : Networking drink

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2016-05-23.eventbrite.com

=== Coverage ===

== Previous Meeting (8 March 2016) in Leuven ==

=== WHEN ===
Tuesday 8 March 2016

=== WHERE ===
Hosted by [https://distrinet.cs.kuleuven.be iMinds-Distrinet Research Group (KU Leuven)].

Both speakers are faculty of the [http://www.secappdev.org/ Secure Application Development] course which is held in Leuven from 7-11 March 2016. OWASP Members get a 10% discount to attend the course.

Address: 
Department of Computer Science (foyer at ground floor) Celestijnenlaan 200 A 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap google maps])

Routemap: https://distrinet.cs.kuleuven.be/about/route/

=== PROGRAM ===
The agenda:
*18h15 - 19h00: '''Welcome & sandwiches''' 
*19h00 - 19h15: '''OWASP Update ([https://www.owasp.org/images/4/4e/Owasp_Belgium_update_2016-03-08_v1.pptx PDF])''' 
*19h15 - 20h15: '''[https://www.owasp.org/images/5/5f/JS_RobustModern_VanCutsem_OWASP2016.pdf Writing robust client-side code using Modern JavaScript]''' (by Tom Van Cutsem, Bell Labs, Nokia) 
:''Abstract:'' In this talk, I will take the audience on a tour of recent evolutions in the JavaScript language (and surrounding ecosystem) and how they can use these changes to their advantage to write better client-side code that is more robust against bugs and other exploits. JavaScript — still unquestionably the dominant client-side language in use on the Web — has evolved significantly over the past five years, with two significant updates to ECMAScript, its defining standard. I will give a brief introduction to the language and its Good and Bad parts and then move on to features added in ECMAScript 5th edition, such as "strict mode", which are by now widely deployed in major browsers. Next, I will look at relevant language features that were introduced recently as part of ECMAScript 6th edition. Finally, I will give a brief introduction to Secure ECMAScript (SES), which is a secure JavaScript dialect that enables the safe embedding of third-party scripts in a webpage, also forming the basis for Google’s Caja compiler.
:''Bio:'' '''Tom Van Cutsem''' is a senior researcher at Nokia Bell Labs in Antwerp, Belgium. Prior to joining Bell Labs, he was a professor of computer science at Vrije Universiteit Brussel. He sat on the ECMA TC39 committee in charge of standardising JavaScript and actively contributed to the ECMAScript 2015 (a.k.a. “ES6”) standard. Together with Mark S. Miller, he designed and specified ECMAScript’s new reflection API. Tom's broader research interests lie in distributed systems, programming languages, stream processing, concurrency and parallelism. He received his PhD in 2008 from Vrije Universiteit Brussel for his research on AmbientTalk, a distributed scripting language for mobile phones.
*20h15 - 20h30: '''Break''' 
*20h30 - 21h30: '''[https://www.owasp.org/images/a/a6/Dan-Wallach-internet-censorship.pdf Internet Censorship: Studies from China and Turkey]''' (by prof. Dan Wallach, Rice University) 
:''Abstract:'' TBA
:''Bio:'' '''Dan Wallach''' is a professor in the systems group at Rice University's Department of Computer Science, He manages Rice's [http://seclab.cs.rice.edu/ computer security lab]. His research interests include mobile code, wireless and smartphone security, and the security of electronic voting systems.

=== REGISTRATION ===
Please register via EventBrite: https://owasp-belgium-2016-03-08.eventbrite.com

=== Coverage ===

== Past Events ==
*Events held in [[Belgium Previous Events 2015|2015]]
*Events held in [[Belgium Previous Events 2014|2014]]
*Events held in [[Belgium Previous Events 2013|2013]]
*Events held in [[Belgium Previous Events 2012|2012]]
*Events held in [[Belgium Previous Events 2011|2011]]
*Events held in [[Belgium Previous Events 2010|2010]]
*Events held in [[Belgium Previous Events 2009|2009]]
*Events held in [[Belgium Previous Events 2008|2008]]
*Events held in [[Belgium Previous Events 2007|2007]]
*Events held in [[Belgium Previous Events 2006|2006]]
*Events held in [[Belgium Previous Events 2005|2005]]

= Belgium OWASP Chapter Leaders =

The Belgium Chapter is supported by the following board:

*Sebastien Deleersnyder, Toreon
*Erwin Geirnaert, Zion Security
*Philippe Bogaerts, AviNetworks
*Lieven Desmet, KU Leuven
*Bart De Win, PWC
*David Mathy, Freelance

Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.
__NOTOC__ <headertabs></headertabs>
[[Category:Europe]]