https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Owen+PendleburyOWASP - User contributions [en]2026-05-01T21:07:30ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=Board&diff=256011Board2019-11-10T19:35:14Z<p>Owen Pendlebury: </p>
<hr />
<div>__NOTOC__<br />
<br />
= Board Meetings =<br />
[https://www.owasp.org/index.php/About_OWASP#OWASP_Foundation_Bylaws Bylaws] are the most important legal document of any organization. Bylaws outline in writing the day-to-day rules for your organization and provide comprehensive guidelines to keep things running smoothly. If you want to understand the business of OWASP Foundation the best way to do that would be to examine the bylaws the the [https://www.owasp.org/index.php/About_OWASP#Form_990_Documents 990 forms filed with the United States Government as a non-profit annually.]<br />
<br />
[https://www.owasp.org/index.php/About_OWASP#OWASP_Foundation_Bylaws Global Bylaws]<br />
<br />
== Upcoming 2019 Meetings ==<br />
* [[November 2019 |November 19, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=11&day=18&hour=19&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
<br />
* [[December 2019 |December 17, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=12&day=23&hour=19&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
<br />
All board meeting notes that include actions as a result will be tracked in a single document for all meetings [https://docs.google.com/a/owasp.org/document/d/1aPmftVZH3-G96J6-wrpynwwZhBHtREe5a7g8owVYUag/edit?usp=sharing click here]<br />
<br />
== 2018 Elected by Membership, Global Board Members == <br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Member, Meeting Attendance Tracking]<br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_History Historical Board Members by Year]<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[User:Knoblochmartin | Martin Knobloch]]: Chair ====<br />
<br />
The Chairman of the Board shall serve as the principal executive officer of the Foundation.<br />
<br />
Fiduciary responsibilities: He/She shall, in general, supervise and control all of the business and affairs of the Foundation. He/She will monitor financial planning and financial reports He/She or he may sign, with the Secretary or any other proper officer of the Foundation thereunto authorized by the Board of Directors, any deeds, mortgages, bonds, contracts, or other instruments which the Board of Directors has authorized to be executed, except in cases where the signing and execution thereof shall be expressly delegated by the Board of Directors or by these Bylaws to some other officer or agent of the Foundation, or shall be required by law to be otherwise signed or executed;<br />
<br />
Leadership and Direction: provides leadership to the Board of Directors with regards to policy setting and strategic planning. He/She helps guide and mediate board actions with respect to organizational priorities and governance concerns, and in general shall perform all duties incident to the office of Chairman of the Board subject to the control of the Board of Directors.<br />
<br />
Organizational Responsibilities: He/She plays a leading role in fundraising activities, formally evaluate the performance of the Foundation Director and informally evaluate the effectiveness of the board members. An annual, overall evaluation of the performance of the organization in achieving its mission will be accomplished. He or she shall, when present, preside at all meetings of the Board of Directors, unless otherwise delegated, and such other duties as may be prescribed by the Board of Directors from time to time. <br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
<br />
==== [[Owen_Pendlebury_2017_Bio_%26_Why_Me%3F | Owen Pendlebury]]: Vice Chair ====<br />
<br />
Performs Chair responsibilities when the Chair cannot be available, works closely with Chair and other Board Members, participates closely with Chair to develop and implement officer transition plans, performs other responsibilities as assigned by the Board.<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[Sherif_Mansour_2017_Bio_%26_Why_Me%3F | Sherif Mansour]]: Treasurer==== <br />
<br />
Treasurer manages finances of the organization, administers fiscal matters of the organization, provides annual budget to the board for member’s approval, ensures development and board review of financial policies and procedures. [[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
<br><br />
==== [[User:Ofer_Maor | Ofer Maor]]: Secretary ====<br />
<br />
Maintains records of the board and ensures effective management of organization’s records, manages minutes of board meetings, ensures minutes are distributed shortly after each meeting, is sufficiently familiar with legal documents (articles, bylaws, IRS letters, etc.) to note applicability during meetings; is the custodian of the corporate records and of the seal of the Foundation and see that the seal of the Foundation is affixed to all documents, the execution of which on behalf of the Foundation under its seal is duly authorized; keeps a register of the post office address of each Director which shall be furnished to the Secretary by such Director; and, in general perform all duties incident to the office of the Secretary and such other duties as from time to time may be assigned to him by the Chairman of the Board or by the Board. <br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[Chenxi_Wang,_Ph.D._(Forrester_Research) | Chenxi Wang, Ph.D.]]: Member at Large====<br />
<br><br />
Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br />
==== [[User:Richard_greenberg | Richard Greenberg]]: Member at Large ====<br />
<br>Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br />
<br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
====[[Gary_Robinson_2018_Bio_and_Why_me | Gary Robinson]]: Member at Large ====<br />
<br />
<br><br />
Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br><br />
<br />
<br />
= How Meetings Operate =<br />
'''CALL TO ORDER'''<br />
<br />
The first order of business is for the chair to announce the call to order, along with the time. The secretary enters the time of the call to order in the minutes. After the meeting is called to order, the board chair may make welcoming remarks, ask for introductions, or read the organization’s mission and vision statements.<br />
<br />
'''CHANGES TO THE AGENDA'''<br />
<br />
The second order of business is for the chair to ask for changes to the agenda. Additions and deletions to the agenda will be made at this time. Having no changes, the agenda moves to approving the prior meeting’s minutes.<br />
<br />
<br />
'''APPROVAL OF MINUTES'''<br />
<br />
The third item on the agenda should list “Approval of Minutes” along with the date of the most recent meeting. In most cases, board members should have received a copy of the minutes prior to the meeting. If they have not contacted the secretary prior to the meeting with corrections or changes to the minutes, they have to opportunity to make them during this item on the agenda.<br />
<br />
Board members have an ethical and legal responsibility to make sure that the recording of the minutes accurately reflect the board’s business.<br />
<br />
'''REPORTS'''<br />
<br />
The fourth item on the agenda is the reports. This first report should be a report from the Executive Director. This report should include a review of operations and projects. The Executive Director should give board members on overview of the business outlook including positive and negative trends, major initiatives, business updates, and other aspects of the business.<br />
<br />
Following the Executive Director report, the Finance Director gives a report. Board members should make an effort to understand the financial reports so that they can identify potential financial threats. Understanding financial reports may also generate discussion about potential opportunities.<br />
<br />
Subsequent reports may be given by committee chairs.<br />
<br />
'''OLD BUSINESS'''<br />
<br />
Items should include past business items that are unresolved, need further discussion, or require a board vote. Items may be tabled or referred to committee for further exploration.<br />
<br />
'''NEW BUSINESS'''<br />
<br />
Board members should have a discussion about new business items and identify a plan to take action. This may include tabling them, delaying action to a future date, or referring them to a committee.<br />
<br />
'''COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS'''<br />
<br />
At this point in the agenda, members may make announcements, such as offering congratulations or condolences, or make other special announcements. Any other business may be brought up at this time, for example, items that may need to be added to the next meeting’s agenda.<br />
<br />
'''ADJOURNMENT'''<br />
<br />
This is a formal closing of the meeting by the board chair. He should state the time that the meeting closed, so that the secretary may including it in the board minutes. The date of the next meeting should follow the adjournment item, so that board members will be reminded to put it on their calendars.<br />
<br />
For more information about the Roberts Rules of Order see this [http://www.umecra.com/BylawsAndRules/Roberts%20Rules%20Handout.pdf CHEAT SHEET]<br />
<br />
= Voting History =<br />
<br />
=== Historical Votes on Motions ===<br />
The purpose of this is to track the position on each motion as presented and how the elected official voted on the motion. This is useful for the membership to review how elected officials voted on items that effect the organization and its [https://www.owasp.org/index.php/OWASP_Foundation_ByLaws bylaws]. A motion is a request for action (budget requests, policy changes, new partnerships etc.) they can be presented by ANYONE to the board such as a member of the public, a member of the OWASP Foundation but does require a sponsor on the Board. That sponsor will present the motion to the board at least (10) working days in advance so it can be read in advance of the meeting. If appropriate a motion can be presented based to take action on the motion as written. For a vote to be called and action to be taken a second board member is required to carry the business to vote. On completion of the discussion the chairman will call for a vote to the motion YES, NO, ABSTAIN. For more details on this process try this [http://www.umecra.com/BylawsAndRules/Roberts%20Rules%20Handout.pdf CHEAT SHEET]<br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_Votes Historical Board Votes]<br />
<br />
Note that if a motion is presented and is voted on and it is approved action will be taken to implement the motion. If the motion fails it can be resubmitted and the process starts again as if it is a new motion.<br />
<br />
=== Attendance Tracker===<br />
This is used to keep track that Board Members meet 75% attendance requirements as noted in section 3.03 of the organization bylaws. A meeting is logged as attended if the board member attends the entire meeting as scheduled from the call to order until it is adjourned, this includes executive session if applicable that is closed to the membership and general public for reasons related to human resources and legal issues that require it by law or for the good of the OWASP Foundation Inc. - <br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Meeting Attendance Tracker]<br />
<br />
= Historical Meeting Archive =<br />
== Archive 2019 ==<br />
* [[October 2019|October 15, 2019]]11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=10&day=21&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[September 2019 |September 25, 2019]] 7 PM The Netherlands CET - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=9&day=25&hour=17&min=0&sec=0&p1=16&p2=179&p3=137 other time zones]<br />
* <s>[[August 2019 |August 20, 2019]] 11 AM US Pacific</s> - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=8&day=19&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones] '''CANCELLED'''* [[July 2019 |July 16, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=7&day=15&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[June 2019 |June 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=6&day=17&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[May 2019 |May 21, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=5&day=20&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[April 2019 |April 29, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=4&day=15&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[March 2019 |March 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=3&day=18&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[February 2019 |February 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=2&day=18&hour=19&min=0&sec=0&p1=16&p2=919& other time zones]<br />
* [[January 2019 |January 23rd, 2019]] - 3:00 PM to 4:00 PM PST([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=1&day=23&hour=23&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
<br />
== Archive 2018 ==<br />
* [[December 2018 |December 19th, 2018]] - 1:00 PM to 2:30 PM EST ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=12&day=19&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
* [[November 2018 |November 21, 2018]] - 12:00 PM to 1:30 PM EST ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=11&day=21&hour=17&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
* [[October 2018 |October 10, 2018]] - 3:00 to 4:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=10&day=10&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) at AppSec USA 2018 Conference<br />
* [[September 2018 |September 27, 2018]] - 2:00 PM to 3:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=9&day=19&hour=18&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) <br />
* [[August 2018 |August 15, 2018]] - 1:00 PM to 2:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=8&day=15&hour=17&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) <br />
* [[July 4th, 2018|July 4th, 2018]] - during AppSec EU 2018<br />
* [[June_19,_2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=6&day=19&hour=18&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 Click Here for Meeting Time in Your Timezone]<br />
* [[May 15, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=5&day=15&hour=19&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 Click Here for Meeting Time in Your Timezone]<br />
* [[April 4, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=4&day=4&hour=14&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 TimeZone Converter]<br />
* [[March 7, 2018]] - 3:00pm - 4:00pm EST - [https://www.timeanddate.com/worldclock/converted.html?iso=20180307T21&p1=16&p2=16&p3=676&p4=136&p5=78&p6=179&p7=224&p8=240&p9=102 Time Converter]<br />
* [[February 7, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=2&day=7&hour=20&min=0&sec=0&p1=16&p2=179&p3=78&p4=102&p5=224&p6=136&p7=152&p8=676 TimeZone Converter]<br />
* [[January 24, 2018]], [https://www.timeanddate.com/worldclock/fixedtime.html?msg=OWASP+Board+Meeting%2C+January+24+2018&iso=20180124T19&p1=16&ah=1&am=30 TimeZone Converter]<br />
<br />
== Archive 2017 ==<br />
* [[December 6, 2017]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=12&day=06&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[November 8, 2017]], 07:00-08:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=11&day=8&hour=15&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[October 11, 2017]], 15:00 - 17:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=10&day=11&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[September 19, 2017]] 15:00-17:30 PDT, in Orlando at AppSecUSA - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=9&day=19&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[September 6, 2017]] 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=09&day=06&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] (Cancelled for interviews)<br />
*[[August 9, 2017]], 16:00-17:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=08&day=09&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[July 5, 2017]], 07:00-08:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=07&day=05&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[June 7, 2017]], 18:00-21:00 CEST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=06&day=07&hour=16&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[May 9, 2017]], 18:00-19:30 IST, in Belfast at AppSecEU - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=5&day=9&hour=17&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[April 12, 2017]], 16:00-17:00 PDT - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=04&day=12&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] ('''Cancelled''' [http://lists.owasp.org/pipermail/owasp-board/2017-April/017969.html Notice by Matt Konda])<br />
*[[March 22, 2017]] 06:00-07:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=3&day=22&hour=13&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] - *Special Meeting to approve the 2017 Budget*<br />
* [[March 8, 2017]], 06:00-07:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=03&day=08&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[February 8, 2017]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=02&day=08&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[January 11, 2017]], 14:00-15:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=1&day=10&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
<br />
== Archive for 2016 Meetings ==<br />
* [[December 14, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=12&day=14&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[November 8, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=11&day=09&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* CANCELLED - [[November 30, 2016]], 15:00-16:30 PST - placeholder only optional if needed - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=11&day=30&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[October 11, 2016]], at AppSecUSA 18:00 - 21:00 EDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=10&day=11&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[September 21, 2016]] 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=09&day=21&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[August 23, 2016]], 16:00-17:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=08&day=23&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[July 1, 2016]], 18:00-21:00 CEST, in Rome at AppSecEU - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=07&day=01&hour=16&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[July 27, 2016]], 07:00-08:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=07&day=27&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[May 18, 2016]], 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=05&day=18&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[April 20, 2016]], 16:00-17:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=04&day=20&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[March 16, 2016]], 16:00-17:00 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=03&day=16&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[February 17, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=02&day=17&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[January 13, 2016]], 16:00-17:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=01&day=14&hour=00&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
<br />
== Archive for 2015 Meetings ==<br />
* [[December 9, 2015]], 15:00-17:00 PST <br />
* [[November 18, 2015]], 14:00-15:30 PST<br />
* [[November 4, 2015]], 12:00-13:30 PST<br />
* [[October 14, 2015]], 14:00-15:00 PDT<br />
* [[September 25, 2015]] at AppSecUSA 18:00 - 20:00 PST<br />
* [[August 12, 2015]], 16:00-17:00 PST<br />
* [[July 22, 2015]], 14:00-15:00 PDT<br />
* [[June 24, 2015]], 14:00-15:00 PDT<br />
* [[May 22, 2015]], 18:00-20:00 CEST in Amsterdam @ AppSec-EU , 9:00am-11:00am PST;<br />
* [[April 29, 2015]], 12:00-13:00 PST<br />
* [[March 25, 2015]], 12:00-13:00 PST <br />
* [[February 11, 2015]], 16:00-17:00 PST<br />
* [[January 14, 2015]], 9am-10am PST<br />
<br />
<br />
== Archive for 2014 Meetings ==<br />
* [[December 10, 2014]], 9am-10am PST<br />
* [[November 12, 2014]], 9am - 10am PST<br />
* [[October 8, 2014]], 9am-10am PST<br />
* [[September 16, 2014]], 6pm - 9pm MST, In person at Appsec USA <br />
* [[August 13, 2014]], 9am-10am PST<br />
* [[July 9, 2014]], 9am-10am PST<br />
* [[June 27, 2014]], 8am - 4 pm BST, In person at AppSec Europe<br />
* [[April 30, 2014]],9am - 12pm PST<br />
* [[March 3, 2014]], 7am - 10am PST<br />
* [[February 24, 2014]], 8am - 10am PST<br />
<br />
== Archive for 2013 Meetings ==<br />
<br />
*[[December 9, 2013]]<br />
<br />
* December 2, 2013 - Special Board Meeting - [https://docs.google.com/spreadsheet/ccc?key=0ApZ9zE0hx0LNdGdJZ1BIaEZkc2V1QV81NmJ4dnI0R1E&usp=sharing 2014 Budget] walk through, Q & A (no meeting notes)<br />
<br />
*[[November 22, 2013]] - In person meeting at AppSec USA - New York, NY<br />
<br />
* November 11, 2013 - cancelled due to in person meeting on Nov. 22<br />
<br />
*[[October 14, 2013]]<br />
<br />
*[[September 9, 2013]]<br />
<br />
*[[In person meeting at AppSec EU - Hamburg, Germany; August 19-24]]<br />
<br />
* August 12, 2013 - canceled due to in person meeting on Aug 19<br />
<br />
*[[July 8, 2013]]<br />
<br />
*[[June 10, 2013]]<br />
<br />
*[[May 31, 2013]]<br />
<br />
*[[May 13, 2013]]<br />
<br />
*[[April 8, 2013]]<br />
<br />
*[[March 11, 2013]]<br />
<br />
*[[February 11, 2013]]<br />
<br />
*[[January 14, 2013]]<br />
<br />
== Archive for 2012 Meetings ==<br />
<br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Meeting Attendance Tracking]<br />
<br />
OWASP Foundation [https://www.owasp.org/images/a/ae/2012ByLawsFINAL.pdf ByLaws]<br />
<br />
[https://www.owasp.org/index.php/Global_Committee_Pages Global Committees] <br />
<br />
*[[January 9, 2012]]<br />
<br />
*[[February 6, 2012]]<br />
<br />
*[[February 15, 2012]] <br />
<br />
*[[March 12, 2012]]<br />
<br />
*[[April 5, 2012]]<br />
<br />
*[[May 14,2012]]<br />
<br />
*[[June 11, 2012]]<br />
<br />
*[[July 11, 2012]]<br />
<br />
*[[Aug 13, 2012]]<br />
<br />
*[[Sept 10, 2012]]<br />
<br />
*[[Oct 8, 2012]]<br />
<br />
*[[Oct 24, 2012]]<br />
<br />
*[[Nov 12, 2012]]<br />
<br />
*[[Nov 26, 2012]] - 2013 Budget Focused<br />
<br />
*[[Dec 10, 2012]]<br />
<br />
*[[Dec 27, 2012]] - 2013 Budget Focused<br />
<br />
== Archive for 2011 Meetings ==<br />
<br />
*[[January 3, 2011]]<br />
<br />
*[[March 7, 2011]]<br />
<br />
*[[April_4_2011]]<br />
<br />
*[[May_2_2011]]<br />
<br />
*[[June 6, 2011]]<br />
<br />
*[[July 11, 2011]]<br />
<br />
*[[August 8, 2011]] <br />
<br />
*[[September 6, 2011]]<br />
<br />
*[[September 20, 2011]]<br />
<br />
*[[September 22, 2011]]<br />
<br />
*[[October 10, 2011]]<br />
<br />
*[[November 14, 2011]]<br />
<br />
*[[December 5, 2011]]<br />
<br />
== Minutes for 2011 Meetings == <br />
<br />
<hr /><br />
<br />
* [https://www.owasp.org/index.php/OWASP_Board_Votes Board Votes Historical]<br />
<br />
<hr /><br />
<br />
*[[Minutes January 3, 2011]]<br />
<br />
*[[Minutes March 8, 2011]]<br />
<br />
*[[Minutes April 4, 2011]]<br />
<br />
*[[Minutes May 2, 2011]]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1VD9ZHEwht9tmM8FKEQ6DBrtmL_gTAhSSnQhiFXYkJ7I/edit?hl=en_US&authkey=CIavkP4B June 6 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1VMwYrP6owtZ-SchBxUcWTIF-ITvzUX8PjUkLPwr2ipg/edit?hl=en_US&authkey=CIGTx5sD July 11 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1CLu9aQpS7LdeX87rJ5N9cuJ-RGGVzDWf34l6gdMml7M/edit?hl=en_US&authkey=CI-U5qEP August 8, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1HM32VcvWb0hizD5_mhWMULLaouzuRgA3ZYjODRZwyAs/edit?hl=en_US September 6, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1Y-8tZisUZM5ZKP8AxJqvkiNtFanVFM0m--bMG2PZ3ww/edit October 10, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/13-aHX2pSUXjCP8ivsbls6u1VX1BVSYewyMUH8LI7zpQ/edit November 14, 2011]<br />
<br />
== Archive for 2010 Meetings ==<br />
*[[January 5, 2010]]<br />
<br />
*[[February 2, 2010]]<br />
<br />
*[[March 2, 2010]] <span style="color:blue">Postponed until March 9, 2010</span> <br />
<br />
*[[April 6, 2010]]<br />
<br />
*[[May 4, 2010]]<br />
<br />
*[[June 7, 2010]]<br />
<br />
*[[July 12, 2010]]<br />
<br />
*[[August 2, 2010]]<br />
<br />
*[[September 8, 2010]]<br />
<br />
*[[October 11, 2010]]<br />
<br />
*[[November 9, 2010]]<br />
<br />
*[[December_6_2010]]<br />
<br />
== Archive of 2010 Meetings ==<br />
<br />
*[[Jan 5, 2010]]<br />
<br />
*[[Feb 2, 2010]]<br />
<br />
*[[March 2, 2010]]<br />
<br />
*[[Minutes April 6, 2010]]<br />
<br />
*[[Minutes May 11, 2010]]<br />
<br />
*[[Minutes June 7, 2010]]<br />
<br />
*[[Minutes July 12, 2010]]<br />
<br />
*[[Minutes October 11, 2010]]<br />
<br />
*[[Minutes November 9, 2010]]<br />
<br />
*[[Minutes_December_6,_2010]]<br />
<br />
*[[OWASP Board Meetings January Agenda]]<br />
*[[OWASP Board Meetings February Agenda]]<br />
*[[OWASP Board Meetings March Agenda]]<br />
*[[OWASP Board Meetings April09 Agenda]]<br />
*[[OWASP Board Meetings May09 Agenda]]<br />
*[[OWASP Board Meetings June 09 Agenda]]<br />
*[[OWASP Board Meeting July 7, 2009 Agenda]]<br />
*[[OWASP Board Meeting August 4, 2009 Agenda]]<br />
*[[OWASP Board Meeting September 1, 2009 Agenda]] <br />
*[[OWASP Board Meeting October 6, 2009 Agenda]]<br />
*[[OWASP Board Meeting November 10, 2009 Agenda]]<br />
*[[OWASP Board Meeting December 1, 2009 Agenda]]<br />
<br />
== Archive of 2009 Meetings ==<br />
* [[OWASP Board Meetings 01-06-09]]<br />
* [[OWASP Board Meetings 02-03-09]]<br />
* [[OWASP Board Meetings 03-10-09]]<br />
* [[OWASP Board Meetings April 09]]<br />
* [[OWASP Board Meetings May 09]]<br />
* [[OWASP Board Meetings June 09]]<br />
* [[OWASP Board Meeting July 09]]<br />
* [[OWASP Board Meeting August 09]]<br />
* [[OWASP Board Meeting September 09]]<br />
* [[OWASP Board Meeting October 09]]<br />
* [[OWASP Board Meeting December 09]]<br />
<br />
== Archive for 2008 Meetings ==<br />
*[[OWASP Board Meetings March Agenda]]<br />
*[[OWASP Board Meetings April Agenda]]<br />
*[[OWASP Board Meetings May Agenda]]<br />
*[[OWASP Board Meetings June Agenda]]<br />
*[[OWASP Board Meetings July Agenda]]<br />
*[[OWASP Board Meetings August Agenda]]<br />
*[[OWASP Board Meetings September Agenda]]<br />
*[[OWASP Board Meetings October Agenda]]<br />
*[[OWASP Board Meetings December Agenda]]<br />
<br />
== Archive of 2008 Meetings ==<br />
* [[OWASP Board Meetings 2-7-08]]<br />
* [[OWASP Board Meetings 3-6-08]]<br />
* [[OWASP Board Meetings 5-6-08]]<br />
* [[OWASP Board Meetings 6-3-08]]<br />
* [[OWASP Board Meetings 8-14-08]]<br />
* [[OWASP Board Meetings 9-2-08]] <br />
* [[Owasp Board Meetings 10-07-08]]<br />
* [[Owasp Board Meetings 11-07-08]]<br />
* [[Owasp Board Meetings 12-02-08]]<br />
<br />
= Board Election Archive =<br />
<br />
All elected officers are required to [https://docs.google.com/document/d/10zBT6oY2Q3B6kr6r7DGl3Cc0f5rGmQ0Slc6RYvbxmus/edit review sign and return] the following document before starting their term in office to the then current board Secretary <br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_History OWASP Board History]<br />
<br />
===2017 Election===<br />
[https://www.owasp.org/index.php/2017_Global_Board_of_Directors_Election 2017 Board Election]<br />
=== 2016 Election ===<br />
[https://www.owasp.org/index.php/2016_Global_Board_of_Directors_Election 2016 Board Election]<br />
=== 2015 Election ===<br />
[https://www.owasp.org/index.php/2015_Global_Board_of_Directors_Election 2015 Board Election]<br />
=== 2014 Election ===<br />
[https://www.owasp.org/index.php/2014_Board_Elections 2014 Board Election]<br />
=== 2013 Election ===<br />
[https://www.owasp.org/index.php/2013_Board_Elections 2013 Board Election]<br />
=== 2012 Election ===<br />
[https://www.owasp.org/index.php/Membership/2012_Election 2012 Board Election]<br />
=== 2011 Election ===<br />
[https://www.owasp.org/index.php/Membership/2011Election 2011 Board Election]<br />
=== 2009 Election ===<br />
[https://www.owasp.org/index.php/Board_Election_2009 2009 Board Election]<br />
<br />
=== Past OWASP Boards ===<br />
<br />
[[Board-2018]]<br />
<br />
[[Board-2017]]<br />
<br />
[[Board-2016]]<br />
<br />
[[Board-2015]]<br />
<br />
[[Board-2014]]<br />
<br />
[[Board-2013]]<br />
<br />
[[Board-2012]]<br />
<br />
[[Board-2011]]<br />
<br />
= Misc. =<br />
<br />
* Teleconference Information: **CHECK MEETING INFORMATION**<br />
<br />
* [https://www.owasp.org/index.php/International_Toll_Free_Calling_Information International Toll Free Calling Info]<br />
<br />
* Meeting Template found [https://www.owasp.org/index.php/Board-Meeting-template here]<br />
<br />
<headertabs> </headertabs></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Board&diff=256010Board2019-11-10T19:33:06Z<p>Owen Pendlebury: </p>
<hr />
<div>__NOTOC__<br />
<br />
= Board Meetings =<br />
[https://www.owasp.org/index.php/About_OWASP#OWASP_Foundation_Bylaws Bylaws] are the most important legal document of any organization. Bylaws outline in writing the day-to-day rules for your organization and provide comprehensive guidelines to keep things running smoothly. If you want to understand the business of OWASP Foundation the best way to do that would be to examine the bylaws the the [https://www.owasp.org/index.php/About_OWASP#Form_990_Documents 990 forms filed with the United States Government as a non-profit annually.]<br />
<br />
[https://www.owasp.org/index.php/About_OWASP#OWASP_Foundation_Bylaws Global Bylaws]<br />
<br />
== Upcoming 2019 Meetings ==<br />
* [[November 2019 |November 19, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=11&day=18&hour=19&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
<br />
* [[December 2019 |December 17, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=12&day=23&hour=19&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
<br />
All board meeting notes that include actions as a result will be tracked in a single document for all meetings [https://docs.google.com/a/owasp.org/document/d/1aPmftVZH3-G96J6-wrpynwwZhBHtREe5a7g8owVYUag/edit?usp=sharing click here]<br />
<br />
== 2018 Elected by Membership, Global Board Members == <br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Member, Meeting Attendance Tracking]<br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_History Historical Board Members by Year]<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[User:Knoblochmartin | Martin Knobloch]]: Chair ====<br />
<br />
The Chairman of the Board shall serve as the principal executive officer of the Foundation.<br />
<br />
Fiduciary responsibilities: He/She shall, in general, supervise and control all of the business and affairs of the Foundation. He/She will monitor financial planning and financial reports He/She or he may sign, with the Secretary or any other proper officer of the Foundation thereunto authorized by the Board of Directors, any deeds, mortgages, bonds, contracts, or other instruments which the Board of Directors has authorized to be executed, except in cases where the signing and execution thereof shall be expressly delegated by the Board of Directors or by these Bylaws to some other officer or agent of the Foundation, or shall be required by law to be otherwise signed or executed;<br />
<br />
Leadership and Direction: provides leadership to the Board of Directors with regards to policy setting and strategic planning. He/She helps guide and mediate board actions with respect to organizational priorities and governance concerns, and in general shall perform all duties incident to the office of Chairman of the Board subject to the control of the Board of Directors.<br />
<br />
Organizational Responsibilities: He/She plays a leading role in fundraising activities, formally evaluate the performance of the Foundation Director and informally evaluate the effectiveness of the board members. An annual, overall evaluation of the performance of the organization in achieving its mission will be accomplished. He or she shall, when present, preside at all meetings of the Board of Directors, unless otherwise delegated, and such other duties as may be prescribed by the Board of Directors from time to time. <br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
<br />
==== [[Owen_Pendlebury_2017_Bio_%26_Why_Me%3F | Owen Pendlebury]]: Vice Chair ====<br />
<br />
Performs Chair responsibilities when the Chair cannot be available, works closely with Chair and other Board Members, participates closely with Chair to develop and implement officer transition plans, performs other responsibilities as assigned by the Board.<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[Sherif_Mansour_2017_Bio_%26_Why_Me%3F | Sherif Mansour]]: Treasurer==== <br />
<br />
Treasurer manages finances of the organization, administers fiscal matters of the organization, provides annual budget to the board for member’s approval, ensures development and board review of financial policies and procedures. [[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
<br><br />
==== [[User:Ofer_Maor | Ofer Maor]]: Secretary ====<br />
<br />
Maintains records of the board and ensures effective management of organization’s records, manages minutes of board meetings, ensures minutes are distributed shortly after each meeting, is sufficiently familiar with legal documents (articles, bylaws, IRS letters, etc.) to note applicability during meetings; is the custodian of the corporate records and of the seal of the Foundation and see that the seal of the Foundation is affixed to all documents, the execution of which on behalf of the Foundation under its seal is duly authorized; keeps a register of the post office address of each Director which shall be furnished to the Secretary by such Director; and, in general perform all duties incident to the office of the Secretary and such other duties as from time to time may be assigned to him by the Chairman of the Board or by the Board. <br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[Chenxi_Wang,_Ph.D._(Forrester_Research) | Chenxi Wang, Ph.D.]]: Member at Large====<br />
<br><br />
Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br />
==== [[User:Richard_greenberg | Richard Greenberg]]: Member at Large ====<br />
<br>Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br />
<br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
====[[Gary_Robinson_2018_Bio_and_Why_me | Gary Robinson]]: Member at Large ====<br />
<br />
<br><br />
Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br><br />
<br />
<br />
= How Meetings Operate =<br />
'''CALL TO ORDER'''<br />
<br />
The first order of business is for the chair to announce the call to order, along with the time. The secretary enters the time of the call to order in the minutes. After the meeting is called to order, the board chair may make welcoming remarks, ask for introductions, or read the organization’s mission and vision statements.<br />
<br />
'''CHANGES TO THE AGENDA'''<br />
<br />
The second order of business is for the chair to ask for changes to the agenda. Additions and deletions to the agenda will be made at this time. Having no changes, the agenda moves to approving the prior meeting’s minutes.<br />
<br />
<br />
'''APPROVAL OF MINUTES'''<br />
<br />
The third item on the agenda should list “Approval of Minutes” along with the date of the most recent meeting. In most cases, board members should have received a copy of the minutes prior to the meeting. If they have not contacted the secretary prior to the meeting with corrections or changes to the minutes, they have to opportunity to make them during this item on the agenda.<br />
<br />
Board members have an ethical and legal responsibility to make sure that the recording of the minutes accurately reflect the board’s business.<br />
<br />
'''REPORTS'''<br />
<br />
The fourth item on the agenda is the reports. This first report should be a report from the Executive Director. This report should include a review of operations and projects. The Executive Director should give board members on overview of the business outlook including positive and negative trends, major initiatives, business updates, and other aspects of the business.<br />
<br />
Following the Executive Director report, the Finance Director gives a report. Board members should make an effort to understand the financial reports so that they can identify potential financial threats. Understanding financial reports may also generate discussion about potential opportunities.<br />
<br />
Subsequent reports may be given by committee chairs.<br />
<br />
'''OLD BUSINESS'''<br />
<br />
Items should include past business items that are unresolved, need further discussion, or require a board vote. Items may be tabled or referred to committee for further exploration.<br />
<br />
'''NEW BUSINESS'''<br />
<br />
Board members should have a discussion about new business items and identify a plan to take action. This may include tabling them, delaying action to a future date, or referring them to a committee.<br />
<br />
'''COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS'''<br />
<br />
At this point in the agenda, members may make announcements, such as offering congratulations or condolences, or make other special announcements. Any other business may be brought up at this time, for example, items that may need to be added to the next meeting’s agenda.<br />
<br />
'''ADJOURNMENT'''<br />
<br />
This is a formal closing of the meeting by the board chair. He should state the time that the meeting closed, so that the secretary may including it in the board minutes. The date of the next meeting should follow the adjournment item, so that board members will be reminded to put it on their calendars.<br />
<br />
For more information about the Roberts Rules of Order see this [http://www.umecra.com/BylawsAndRules/Roberts%20Rules%20Handout.pdf CHEAT SHEET]<br />
<br />
= Voting History =<br />
<br />
=== Historical Votes on Motions ===<br />
The purpose of this is to track the position on each motion as presented and how the elected official voted on the motion. This is useful for the membership to review how elected officials voted on items that effect the organization and its [https://www.owasp.org/index.php/OWASP_Foundation_ByLaws bylaws]. A motion is a request for action (budget requests, policy changes, new partnerships etc.) they can be presented by ANYONE to the board such as a member of the public, a member of the OWASP Foundation but does require a sponsor on the Board. That sponsor will present the motion to the board at least (10) working days in advance so it can be read in advance of the meeting. If appropriate a motion can be presented based to take action on the motion as written. For a vote to be called and action to be taken a second board member is required to carry the business to vote. On completion of the discussion the chairman will call for a vote to the motion YES, NO, ABSTAIN. For more details on this process try this [http://www.umecra.com/BylawsAndRules/Roberts%20Rules%20Handout.pdf CHEAT SHEET]<br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_Votes Historical Board Votes]<br />
<br />
Note that if a motion is presented and is voted on and it is approved action will be taken to implement the motion. If the motion fails it can be resubmitted and the process starts again as if it is a new motion.<br />
<br />
=== Attendance Tracker===<br />
This is used to keep track that Board Members meet 75% attendance requirements as noted in section 3.03 of the organization bylaws. A meeting is logged as attended if the board member attends the entire meeting as scheduled from the call to order until it is adjourned, this includes executive session if applicable that is closed to the membership and general public for reasons related to human resources and legal issues that require it by law or for the good of the OWASP Foundation Inc. - <br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Meeting Attendance Tracker]<br />
<br />
= Historical Meeting Archive =<br />
== Archive 2019 ==<br />
* [[September 2019 |September 25, 2019]] 7 PM The Netherlands CET - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=9&day=25&hour=17&min=0&sec=0&p1=16&p2=179&p3=137 other time zones]<br />
* <s>[[August 2019 |August 20, 2019]] 11 AM US Pacific</s> - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=8&day=19&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones] '''CANCELLED'''* [[July 2019 |July 16, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=7&day=15&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[June 2019 |June 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=6&day=17&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[May 2019 |May 21, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=5&day=20&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[April 2019 |April 29, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=4&day=15&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[March 2019 |March 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=3&day=18&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[February 2019 |February 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=2&day=18&hour=19&min=0&sec=0&p1=16&p2=919& other time zones]<br />
* [[January 2019 |January 23rd, 2019]] - 3:00 PM to 4:00 PM PST([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=1&day=23&hour=23&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
<br />
== Archive 2018 ==<br />
* [[December 2018 |December 19th, 2018]] - 1:00 PM to 2:30 PM EST ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=12&day=19&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
* [[November 2018 |November 21, 2018]] - 12:00 PM to 1:30 PM EST ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=11&day=21&hour=17&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
* [[October 2018 |October 10, 2018]] - 3:00 to 4:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=10&day=10&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) at AppSec USA 2018 Conference<br />
* [[September 2018 |September 27, 2018]] - 2:00 PM to 3:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=9&day=19&hour=18&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) <br />
* [[August 2018 |August 15, 2018]] - 1:00 PM to 2:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=8&day=15&hour=17&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) <br />
* [[July 4th, 2018|July 4th, 2018]] - during AppSec EU 2018<br />
* [[June_19,_2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=6&day=19&hour=18&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 Click Here for Meeting Time in Your Timezone]<br />
* [[May 15, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=5&day=15&hour=19&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 Click Here for Meeting Time in Your Timezone]<br />
* [[April 4, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=4&day=4&hour=14&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 TimeZone Converter]<br />
* [[March 7, 2018]] - 3:00pm - 4:00pm EST - [https://www.timeanddate.com/worldclock/converted.html?iso=20180307T21&p1=16&p2=16&p3=676&p4=136&p5=78&p6=179&p7=224&p8=240&p9=102 Time Converter]<br />
* [[February 7, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=2&day=7&hour=20&min=0&sec=0&p1=16&p2=179&p3=78&p4=102&p5=224&p6=136&p7=152&p8=676 TimeZone Converter]<br />
* [[January 24, 2018]], [https://www.timeanddate.com/worldclock/fixedtime.html?msg=OWASP+Board+Meeting%2C+January+24+2018&iso=20180124T19&p1=16&ah=1&am=30 TimeZone Converter]<br />
<br />
== Archive 2017 ==<br />
* [[December 6, 2017]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=12&day=06&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[November 8, 2017]], 07:00-08:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=11&day=8&hour=15&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[October 11, 2017]], 15:00 - 17:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=10&day=11&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[September 19, 2017]] 15:00-17:30 PDT, in Orlando at AppSecUSA - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=9&day=19&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[September 6, 2017]] 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=09&day=06&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] (Cancelled for interviews)<br />
*[[August 9, 2017]], 16:00-17:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=08&day=09&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[July 5, 2017]], 07:00-08:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=07&day=05&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[June 7, 2017]], 18:00-21:00 CEST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=06&day=07&hour=16&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[May 9, 2017]], 18:00-19:30 IST, in Belfast at AppSecEU - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=5&day=9&hour=17&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[April 12, 2017]], 16:00-17:00 PDT - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=04&day=12&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] ('''Cancelled''' [http://lists.owasp.org/pipermail/owasp-board/2017-April/017969.html Notice by Matt Konda])<br />
*[[March 22, 2017]] 06:00-07:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=3&day=22&hour=13&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] - *Special Meeting to approve the 2017 Budget*<br />
* [[March 8, 2017]], 06:00-07:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=03&day=08&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[February 8, 2017]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=02&day=08&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[January 11, 2017]], 14:00-15:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=1&day=10&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
<br />
== Archive for 2016 Meetings ==<br />
* [[December 14, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=12&day=14&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[November 8, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=11&day=09&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* CANCELLED - [[November 30, 2016]], 15:00-16:30 PST - placeholder only optional if needed - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=11&day=30&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[October 11, 2016]], at AppSecUSA 18:00 - 21:00 EDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=10&day=11&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[September 21, 2016]] 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=09&day=21&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[August 23, 2016]], 16:00-17:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=08&day=23&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[July 1, 2016]], 18:00-21:00 CEST, in Rome at AppSecEU - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=07&day=01&hour=16&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[July 27, 2016]], 07:00-08:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=07&day=27&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[May 18, 2016]], 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=05&day=18&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[April 20, 2016]], 16:00-17:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=04&day=20&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[March 16, 2016]], 16:00-17:00 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=03&day=16&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[February 17, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=02&day=17&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[January 13, 2016]], 16:00-17:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=01&day=14&hour=00&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
<br />
== Archive for 2015 Meetings ==<br />
* [[December 9, 2015]], 15:00-17:00 PST <br />
* [[November 18, 2015]], 14:00-15:30 PST<br />
* [[November 4, 2015]], 12:00-13:30 PST<br />
* [[October 14, 2015]], 14:00-15:00 PDT<br />
* [[September 25, 2015]] at AppSecUSA 18:00 - 20:00 PST<br />
* [[August 12, 2015]], 16:00-17:00 PST<br />
* [[July 22, 2015]], 14:00-15:00 PDT<br />
* [[June 24, 2015]], 14:00-15:00 PDT<br />
* [[May 22, 2015]], 18:00-20:00 CEST in Amsterdam @ AppSec-EU , 9:00am-11:00am PST;<br />
* [[April 29, 2015]], 12:00-13:00 PST<br />
* [[March 25, 2015]], 12:00-13:00 PST <br />
* [[February 11, 2015]], 16:00-17:00 PST<br />
* [[January 14, 2015]], 9am-10am PST<br />
<br />
<br />
== Archive for 2014 Meetings ==<br />
* [[December 10, 2014]], 9am-10am PST<br />
* [[November 12, 2014]], 9am - 10am PST<br />
* [[October 8, 2014]], 9am-10am PST<br />
* [[September 16, 2014]], 6pm - 9pm MST, In person at Appsec USA <br />
* [[August 13, 2014]], 9am-10am PST<br />
* [[July 9, 2014]], 9am-10am PST<br />
* [[June 27, 2014]], 8am - 4 pm BST, In person at AppSec Europe<br />
* [[April 30, 2014]],9am - 12pm PST<br />
* [[March 3, 2014]], 7am - 10am PST<br />
* [[February 24, 2014]], 8am - 10am PST<br />
<br />
== Archive for 2013 Meetings ==<br />
<br />
*[[December 9, 2013]]<br />
<br />
* December 2, 2013 - Special Board Meeting - [https://docs.google.com/spreadsheet/ccc?key=0ApZ9zE0hx0LNdGdJZ1BIaEZkc2V1QV81NmJ4dnI0R1E&usp=sharing 2014 Budget] walk through, Q & A (no meeting notes)<br />
<br />
*[[November 22, 2013]] - In person meeting at AppSec USA - New York, NY<br />
<br />
* November 11, 2013 - cancelled due to in person meeting on Nov. 22<br />
<br />
*[[October 14, 2013]]<br />
<br />
*[[September 9, 2013]]<br />
<br />
*[[In person meeting at AppSec EU - Hamburg, Germany; August 19-24]]<br />
<br />
* August 12, 2013 - canceled due to in person meeting on Aug 19<br />
<br />
*[[July 8, 2013]]<br />
<br />
*[[June 10, 2013]]<br />
<br />
*[[May 31, 2013]]<br />
<br />
*[[May 13, 2013]]<br />
<br />
*[[April 8, 2013]]<br />
<br />
*[[March 11, 2013]]<br />
<br />
*[[February 11, 2013]]<br />
<br />
*[[January 14, 2013]]<br />
<br />
== Archive for 2012 Meetings ==<br />
<br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Meeting Attendance Tracking]<br />
<br />
OWASP Foundation [https://www.owasp.org/images/a/ae/2012ByLawsFINAL.pdf ByLaws]<br />
<br />
[https://www.owasp.org/index.php/Global_Committee_Pages Global Committees] <br />
<br />
*[[January 9, 2012]]<br />
<br />
*[[February 6, 2012]]<br />
<br />
*[[February 15, 2012]] <br />
<br />
*[[March 12, 2012]]<br />
<br />
*[[April 5, 2012]]<br />
<br />
*[[May 14,2012]]<br />
<br />
*[[June 11, 2012]]<br />
<br />
*[[July 11, 2012]]<br />
<br />
*[[Aug 13, 2012]]<br />
<br />
*[[Sept 10, 2012]]<br />
<br />
*[[Oct 8, 2012]]<br />
<br />
*[[Oct 24, 2012]]<br />
<br />
*[[Nov 12, 2012]]<br />
<br />
*[[Nov 26, 2012]] - 2013 Budget Focused<br />
<br />
*[[Dec 10, 2012]]<br />
<br />
*[[Dec 27, 2012]] - 2013 Budget Focused<br />
<br />
== Archive for 2011 Meetings ==<br />
<br />
*[[January 3, 2011]]<br />
<br />
*[[March 7, 2011]]<br />
<br />
*[[April_4_2011]]<br />
<br />
*[[May_2_2011]]<br />
<br />
*[[June 6, 2011]]<br />
<br />
*[[July 11, 2011]]<br />
<br />
*[[August 8, 2011]] <br />
<br />
*[[September 6, 2011]]<br />
<br />
*[[September 20, 2011]]<br />
<br />
*[[September 22, 2011]]<br />
<br />
*[[October 10, 2011]]<br />
<br />
*[[November 14, 2011]]<br />
<br />
*[[December 5, 2011]]<br />
<br />
== Minutes for 2011 Meetings == <br />
<br />
<hr /><br />
<br />
* [https://www.owasp.org/index.php/OWASP_Board_Votes Board Votes Historical]<br />
<br />
<hr /><br />
<br />
*[[Minutes January 3, 2011]]<br />
<br />
*[[Minutes March 8, 2011]]<br />
<br />
*[[Minutes April 4, 2011]]<br />
<br />
*[[Minutes May 2, 2011]]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1VD9ZHEwht9tmM8FKEQ6DBrtmL_gTAhSSnQhiFXYkJ7I/edit?hl=en_US&authkey=CIavkP4B June 6 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1VMwYrP6owtZ-SchBxUcWTIF-ITvzUX8PjUkLPwr2ipg/edit?hl=en_US&authkey=CIGTx5sD July 11 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1CLu9aQpS7LdeX87rJ5N9cuJ-RGGVzDWf34l6gdMml7M/edit?hl=en_US&authkey=CI-U5qEP August 8, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1HM32VcvWb0hizD5_mhWMULLaouzuRgA3ZYjODRZwyAs/edit?hl=en_US September 6, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1Y-8tZisUZM5ZKP8AxJqvkiNtFanVFM0m--bMG2PZ3ww/edit October 10, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/13-aHX2pSUXjCP8ivsbls6u1VX1BVSYewyMUH8LI7zpQ/edit November 14, 2011]<br />
<br />
== Archive for 2010 Meetings ==<br />
*[[January 5, 2010]]<br />
<br />
*[[February 2, 2010]]<br />
<br />
*[[March 2, 2010]] <span style="color:blue">Postponed until March 9, 2010</span> <br />
<br />
*[[April 6, 2010]]<br />
<br />
*[[May 4, 2010]]<br />
<br />
*[[June 7, 2010]]<br />
<br />
*[[July 12, 2010]]<br />
<br />
*[[August 2, 2010]]<br />
<br />
*[[September 8, 2010]]<br />
<br />
*[[October 11, 2010]]<br />
<br />
*[[November 9, 2010]]<br />
<br />
*[[December_6_2010]]<br />
<br />
== Archive of 2010 Meetings ==<br />
<br />
*[[Jan 5, 2010]]<br />
<br />
*[[Feb 2, 2010]]<br />
<br />
*[[March 2, 2010]]<br />
<br />
*[[Minutes April 6, 2010]]<br />
<br />
*[[Minutes May 11, 2010]]<br />
<br />
*[[Minutes June 7, 2010]]<br />
<br />
*[[Minutes July 12, 2010]]<br />
<br />
*[[Minutes October 11, 2010]]<br />
<br />
*[[Minutes November 9, 2010]]<br />
<br />
*[[Minutes_December_6,_2010]]<br />
<br />
*[[OWASP Board Meetings January Agenda]]<br />
*[[OWASP Board Meetings February Agenda]]<br />
*[[OWASP Board Meetings March Agenda]]<br />
*[[OWASP Board Meetings April09 Agenda]]<br />
*[[OWASP Board Meetings May09 Agenda]]<br />
*[[OWASP Board Meetings June 09 Agenda]]<br />
*[[OWASP Board Meeting July 7, 2009 Agenda]]<br />
*[[OWASP Board Meeting August 4, 2009 Agenda]]<br />
*[[OWASP Board Meeting September 1, 2009 Agenda]] <br />
*[[OWASP Board Meeting October 6, 2009 Agenda]]<br />
*[[OWASP Board Meeting November 10, 2009 Agenda]]<br />
*[[OWASP Board Meeting December 1, 2009 Agenda]]<br />
<br />
== Archive of 2009 Meetings ==<br />
* [[OWASP Board Meetings 01-06-09]]<br />
* [[OWASP Board Meetings 02-03-09]]<br />
* [[OWASP Board Meetings 03-10-09]]<br />
* [[OWASP Board Meetings April 09]]<br />
* [[OWASP Board Meetings May 09]]<br />
* [[OWASP Board Meetings June 09]]<br />
* [[OWASP Board Meeting July 09]]<br />
* [[OWASP Board Meeting August 09]]<br />
* [[OWASP Board Meeting September 09]]<br />
* [[OWASP Board Meeting October 09]]<br />
* [[OWASP Board Meeting December 09]]<br />
<br />
== Archive for 2008 Meetings ==<br />
*[[OWASP Board Meetings March Agenda]]<br />
*[[OWASP Board Meetings April Agenda]]<br />
*[[OWASP Board Meetings May Agenda]]<br />
*[[OWASP Board Meetings June Agenda]]<br />
*[[OWASP Board Meetings July Agenda]]<br />
*[[OWASP Board Meetings August Agenda]]<br />
*[[OWASP Board Meetings September Agenda]]<br />
*[[OWASP Board Meetings October Agenda]]<br />
*[[OWASP Board Meetings December Agenda]]<br />
<br />
== Archive of 2008 Meetings ==<br />
* [[OWASP Board Meetings 2-7-08]]<br />
* [[OWASP Board Meetings 3-6-08]]<br />
* [[OWASP Board Meetings 5-6-08]]<br />
* [[OWASP Board Meetings 6-3-08]]<br />
* [[OWASP Board Meetings 8-14-08]]<br />
* [[OWASP Board Meetings 9-2-08]] <br />
* [[Owasp Board Meetings 10-07-08]]<br />
* [[Owasp Board Meetings 11-07-08]]<br />
* [[Owasp Board Meetings 12-02-08]]<br />
<br />
= Board Election Archive =<br />
<br />
All elected officers are required to [https://docs.google.com/document/d/10zBT6oY2Q3B6kr6r7DGl3Cc0f5rGmQ0Slc6RYvbxmus/edit review sign and return] the following document before starting their term in office to the then current board Secretary <br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_History OWASP Board History]<br />
<br />
===2017 Election===<br />
[https://www.owasp.org/index.php/2017_Global_Board_of_Directors_Election 2017 Board Election]<br />
=== 2016 Election ===<br />
[https://www.owasp.org/index.php/2016_Global_Board_of_Directors_Election 2016 Board Election]<br />
=== 2015 Election ===<br />
[https://www.owasp.org/index.php/2015_Global_Board_of_Directors_Election 2015 Board Election]<br />
=== 2014 Election ===<br />
[https://www.owasp.org/index.php/2014_Board_Elections 2014 Board Election]<br />
=== 2013 Election ===<br />
[https://www.owasp.org/index.php/2013_Board_Elections 2013 Board Election]<br />
=== 2012 Election ===<br />
[https://www.owasp.org/index.php/Membership/2012_Election 2012 Board Election]<br />
=== 2011 Election ===<br />
[https://www.owasp.org/index.php/Membership/2011Election 2011 Board Election]<br />
=== 2009 Election ===<br />
[https://www.owasp.org/index.php/Board_Election_2009 2009 Board Election]<br />
<br />
=== Past OWASP Boards ===<br />
<br />
[[Board-2018]]<br />
<br />
[[Board-2017]]<br />
<br />
[[Board-2016]]<br />
<br />
[[Board-2015]]<br />
<br />
[[Board-2014]]<br />
<br />
[[Board-2013]]<br />
<br />
[[Board-2012]]<br />
<br />
[[Board-2011]]<br />
<br />
= Misc. =<br />
<br />
* Teleconference Information: **CHECK MEETING INFORMATION**<br />
<br />
* [https://www.owasp.org/index.php/International_Toll_Free_Calling_Information International Toll Free Calling Info]<br />
<br />
* Meeting Template found [https://www.owasp.org/index.php/Board-Meeting-template here]<br />
<br />
<headertabs> </headertabs></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=October_2019&diff=256009October 20192019-11-10T19:32:31Z<p>Owen Pendlebury: </p>
<hr />
<div><br />
Meeting Date:<br />
Oct 15<br />
<br />
Meeting Time:<br />
11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=10&day=21&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
<br />
Meeting Location:<br />
Remote<br />
<br />
Virtual: <br />
[https://zoom.us/j/282821949 Zoom Meeting Link] Meeting ID: 282 821 949 - [https://zoom.us/u/kvUg3969 local dial in numbers]<br />
<br />
Link to meeting Recording: - https://drive.google.com/open?id=1y-ojjcUp4bZ-RU8xbylCOlM_xdN-3Ly9<br />
<br />
AGENDA<br />
<br />
CALL TO ORDER<br />
<br />
CHANGES TO THE AGENDA<br />
<br />
APPROVAL OF MINUTES<br />
[https://docs.google.com/document/d/1C1RGzyApVHQ9zIm83pHkzFXuGlaFCQR8D-n8Btm1-8s/edit?usp=sharing September 2019 Minutes]<br />
<br />
REPORTS<br />
<br />
=== Executive Director Update for October 2019 ===<br />
<br />
===== Key Metrics (Sept): ===== <br />
* Members: 2,800<br />
* Momentum: 643.3K visitors to websites in Sept (1.4K increase to 2018)<br />
* Money: (Draft financials will be available around the 20th)<br />
* Operations<br />
** 100% of Service Desk tickets closed within SLA<br />
** 87% of Non-Funding tickets were closed within SLA<br />
<br />
===== Global Conferences ===== <br />
We successfully hosted two Global Conferences in a short three week window. Many thanks to everyone for making the events a success - and especially Emily and Sibah from staff. The DC event hosted 723 attendees and AMS has 513. We are working with accounting to get a final P&L for both events. I do expect the end profit to be less than budgeted, but as we have been stating we are also closely watching expenses so the net profit should be closer aligned with our budget. I have already provided the final survey results from attendees. As previously noted, over 90% of attendees for both conferences would recommend the event to others.<br />
<br />
Planning is already well underway for 2020. SF contract has been signed and the Dublin contract is on the Board call agenda for today. Budgets have been developed and a more proper project plan should be complete for both events in the next few weeks. Both conferences together are budgeted to generate over $1,200,000 in profits for the Foundation. Also of note is our migration to a Program Team and away from the local chapter model for the event program. We are completing the final details on that change and will share details soon.<br />
<br />
===== Projects Summit ===== <br />
Staff have been collecting feedback and discussing the best setup for these events. As part of the 2020 Operating Plan, we will be recommending TWO events that host five projects each hosted in Winter and Summer. We elected for this format primarily to reduce the risk of a bad initial design that we correct for 2H20 and to offer two geographies for project volunteer convenience. We intend for projects to self-nominate with a work plan and goals for the Summit. If accepted we would offer travel grants for up to 5 contributors to each project. Others would be allowed to attend but we would make it VERY clear that these are contributing events - not suitable for spectators. Our expectation is that each of these events will cost approximately $75,000. Emily is sourcing locations for the last week of February in Cancun in Mexico.<br />
<br />
===== Website =====<br />
Work continues to get the website launched. Our current target launch continues to slip. There have been a variety of factors: delays in assistance from GitHub, slow pickup and migration work by Projects and Chapter leaders (only 97 leader have signed up), and we are rethinking our launch plan. We will likely engage the firm recommended by Chengxi to assist with our migration and follow on SEO support. Our search and backlink ranking - especially given the scope of our content - is too valuable to try to do inhouse. This change alone will move our launch date to early December. The site is ready for Chapters and Projects to migrate their pages and some have already done so. In addition to this work, Dawn and Mike have been working on the Policies/Procedure content which is posing some challenges. Finally we plan to contract our some commerce form work for the new site which includes Donations, Membership, and Events. Our expectation is this migration will improve the user experience and lower our costs.<br />
<br />
===== Preparing for 2020 =====<br />
I have been working on the 2020 Operating Plan and Budget. Generally there will not be wholesale changes but likely incremental new projects like the Projects Summit and our plans to pilot AppSec Days. I intend to present both of these work items for the Boards review as early as the next Board meeting. My goal is that our Budget is approved NO LATER than the November call.<br />
<br />
===== Board Elections =====<br />
We will be announcing the results of the election tomorrow. As of this morning that have been 496 votes cast.<br />
<br />
===== Trademark =====<br />
The EU PTO rejected our application for OWASP. I have approved an additional work item with counsel to respond with additional evidence of prior use and distinctness. We expect news on that filing before the end of the year. There haven't been any other updates on our other filings as of today.<br />
<br />
OLD BUSINESS<br />
<br />
NEW BUSINESS<br />
<br />
COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS<br />
<br />
ADJOURNMENT<br />
<br />
<br />
===<br />
<br />
==Old Business==<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]<br />
<br />
==New Business==<br />
Resolved that the OWASP Board of Directors authorizes the Executive Director to sign an agreement with the Dublin, Ireland Convention Centre with a projected financial commitment of 150,000 EUR to host Global AppSec Dublin in June of 2020.<br />
<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=About_OWASP/HR&diff=254810About OWASP/HR2019-09-19T14:25:09Z<p>Owen Pendlebury: removing interim</p>
<hr />
<div>__NOTOC__<br />
<br />
{| <br />
|-<br />
| style="vertical-align: top;" | [[Image:Staff_mike.jpg|140 px|left]]<br />
| <h1>Mike McCamon</h1><br />'''Executive Director'''<br />Kansas<p>The Executive Director is ultimately responsible for overseeing the administration, programs and strategic plan of the organization.</p><br />
|-<br />
| style="vertical-align: top;" |[[Image:Staff_emily.jpg|140 px|left]]<br />
| <h1>Emily Berman</h1><br />'''Director of Events'''<br />Colorado<p>The Director of Events is responsible for the success of the Company’s event programming including global events and other initiatives. Additionally the Events Director will collaborate with leaders, members, and partners to grow and evolve our regional and local events.</p><br />
|-<br />
| style="vertical-align: top;" |[[Image:Staff_harold.jpg|140 px|left]]<br />
| <h1>Harold Blankenship</h1><br />'''Director of Technology & Projects'''<br />Texas<p>The Director of Technology & Projects nurtures, manages, facilitates, and supports the volunteer open source programs of the Foundation. Additionally the Director of Technology & Projects will, with the support of staff and partners, champion, manage, and execute the technology roadmap of the Foundation.</p><br />
|-<br />
| style="vertical-align: top;" |[[Image:Staff_kelly.jpg|140 px|left]]<br />
| <h1>Kelly Santalucia</h1><br />'''Director of Corporate Support'''<br />New Jersey<p>The Director of Corporate Support identifies, nurtures, develops, documents, solicits, and closes sponsorships and grants for the Foundation and its mission. Also the Director of Corporate Support will collaborate with staff, leaders, and members to improve our membership and events offerings for partners.</p><br />
|-<br />
| style="vertical-align: top;" |[[Image:Staff_dawn.png|140 px|left]]<br />
| <h1>Dawn Aitken</h1><br />'''Community & Operations Manager'''<br />Florida<p>The Community & Operations Manager proactively runs the Foundation’s core business and chapter functions in a professional, consistent, efficient, and cost-effective manner. Generally these functions include opening and closing local chapters; proactively supporting chapter leaders; regularly ensuring the accuracy and integrity of chapter, member and other data; leadership and primary liaison for accounts payable; and semi-annually audit processes and signatory authorities ensuring issues are resolved. Additionally the Community & Operations Manager along with support from staff and partners will accurately document and implement the policies of the Foundation.</p><br />
|-<br />
| style="vertical-align: top;" |[[Image:Staff_lisa.jpg|140 px|left]]<br />
| <h1>Lisa Jones</h1><br />'''Sales & Marketing Operations Manager'''<br />North Carolina<p>The Sales & Marketing Operations Manager supports and coordinates core communication, promotional, member, and sales functions of the Foundation. Generally these functions include the development and execution of professional, regular, and impactful communications in both long and short form through email marketing and social media; proactively leading, managing, and facilitating co-marketing programs; regularly ensuring the accuracy and integrity of member data; supporting and assisting potential individual members; execution of and primary liaison for invoicing and accounts receivable; and ensure corporate member and sponsor benefits are delivered accurately and on schedule.</p><br />
|-<br />
| style="vertical-align: top;" |[[Image:Staff_sibah.jpg|140 px|left]]<br />
| <h1>Sibah Poede</h1><br />'''Events Coordinator'''<br />U.K.<p>Organize logistical and administrative support for while coordinating with sales team to develop the strategy and direction of events. Collaborate with the marketing and design teams to facilitate event promotion. Support staff in managing budgets, calendars, and partnerships for event efforts. Collaborate with leaders, members, and partners to grow and evolve regional events.</p> <br />
|}<br />
<br />
==OWASP HR Resources==<br />
* [https://www.owasp.org/images/2/28/EmployeeHandbook2014.pdf OWASP Foundation Employee Handbook]<br />
* [https://docs.google.com/document/d/1ZWqUOcCYY40yBsdiSf9Y9oY4XLM8AR67VQu9aYN0syI/edit?usp=sharing Employee and Contractor Annual Review Process], [https://docs.google.com/document/d/1yjgy-G5vOvzKN7_vIksElEYtbTwm016SdckvLst_yxw/edit?usp=sharing Employee Self Review and Supervisor Review Form], [https://docs.google.com/document/d/1GsGf5WCsj-6-MVb-vyguiSku7v_XK5K4K6DxX9f2tOQ/edit?usp=sharing Employee Peer Review Form]<br />
*[https://www.owasp.org/index.php/Governance/Conflict_of_Interest_Policy OWASP Conflict of Interest Policy and Annual Questionnaire]<br />
*[https://www.owasp.org/index.php/Governance/Whistleblower_Policy OWASP Whistleblower & Anti-Retaliation Policy]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=254768User:Owen Pendlebury2019-09-16T12:54:03Z<p>Owen Pendlebury: </p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
Owen is the current Vice-Chair of the OWASP global Board of Directors. <br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and led the Dublin Chapter of the Open Web Application Security Project (OWASP) organisation. In 2017 was elected to its Global Board of Directors where he held the role of Secretary and recently Vice-Chair of the global foundation. In 2016, Owen was awarded an OWASP Web Application Person of the Year (WASPY) award for Innovation and Sharing. <br />
<br />
Some of the projects that Owen has been involved in include, AppSec EU 2016/2017/2018/2019 Committee/ Training/ Speaker Committee chair, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, speaking on behalf of OWASP at BlackHat USA and EU, Cyber Security Summer Camp for school kids and OWASP Women in AppSec Committee/ mentoring. <br />
<br />
Owen has over 10 years’ experience in penetration testing and red teaming, working as part of several global Attack and Penetration Teams at “Big 4” professional service firms. He currently leads the penetration testing and red teaming teams for Deloitte Ireland and has in-depth experience of application, network, wireless and device penetration testing, having served numerous local and global institutions as clients in this area. Within Deloitte, Owen acts as vulnerability management lead for the EMEA region, setting the strategic direction, quality standards and deliverables for vulnerability management across EMEA. As part of this role, Owen has brought his colleagues from both EMEA and across the globe together to collaborate on innovative projects as well as client pitches. <br />
<br />
He also lectures and sits on the computer science program boards at the National College of Ireland (NCI) in web application, network security, and secure application development. In 2017, Owen was approached to architect a MSc, Degree and HDip in cyber security for NCI and has been working actively in supporting the bridge between academia and industry. He is also a keen advocate of diversity in cyber security and takes an active role in supporting the OWASP Women in AppSec group through mentoring and working with those who are trying to get into the field. <br />
<br />
== '''Answers to 2019 Global Board of Directors Questions/ Answers''' ==<br />
<br />
Link to Video - https://youtu.be/Gr0bZLz1o3Y<br />
<br />
'''1. What are the 3 biggest challenges you think OWASP is facing and how do you think we can solve them?'''<br />
* Economies of scale - I think as a global community we are facing a lot of challenges, one of which is how can we bring OWASP and our conferences to more economically challenged areas. To combat this, we on the board of directors have been discussing introducing an economy of scales for locations like this. <br />
* Diversity – we have an extremely big community but one thing we need to put a lot of effort into is, reaching out to the minorities. We have been doing this already through WIA and outreach programs such as Defcon/ BlackHat. We need to put more emphasis into our outreach to these minorities. <br />
* Staying relevant – OWASP is nothing without our community, who create the content/ projects that makes OWASP what it is. If we do not put the time and effort into making OWASP the place to be to work on these projects, what’s to stop another organisation from competing with us. We need to ensure that OWASP is where people want to come to collaborate and further our mission of improving software security. <br />
'''2. Many say the "O" in OWASP stands for "Open", and that we must remain "open" at all costs. In the past this has resulted in allowing known-bullies to persist within our community. Do you feel that remaining "open" is more/less/equally important to ensuring a safe, respectful and harassment free community? And why.'''<br />
<br />
I think in my tenure on the board of directors we have not stood for this behaviour. We are all adults, we all have to act as the professionals and treat people how we would want to be treated. There is a line where we have to interpret peoples culture, whether it is misinterpreted as part of an email which is read in the heat of the moment or whether people are just being plain inappropriate. There is no place for this behaviour in OWASP and if re-elected I will maintain my stance of a safe, respectful and harassment free community. In the end the community is OWASP, and we need to make it a safe place for all the cool people that make OWASP what it is. <br />
<br />
'''3. How do you hope/plan to improve OWASP's financial situation?'''<br />
<br />
This is one of those hard to answer questions. In the past few years we have struggled as a foundation to maintain the standards expected of an organisation our size due to fluctuation at an ED level. Now that we have consistency in the form of Mike we are able to pick out the pain points within the foundation and start to improve on them. One of which is our conferences, im not going to lie this is our main source of revenue, although every time we run a conference we are starting from scratch each time. By creating a solid baseline for the foundation to grow from, I believe the financial situation will continue to improve<br />
<br />
'''4. How do you hope/plan to better support and encourage the OWASP projects, chapters, and staff?'''<br />
<br />
By being there for them, whether it be for a coffee, an email or a call I will always have been and will be available for all three groups. As I mentioned before OWASP is the community and projects, chapters and staff are all part of our community, we should all work together for our common goal. <br />
<br />
'''5. How do you hope/plan to improve OWASP's community? We have had some angry chapters, projects and community members, how do you hope/plan to improve community relations and relationships?'''<br />
<br />
By enabling them to provide feedback and prompt change. With the committee 2.0 model the community has a structure to enable change. None of us are perfect but if we all work together then we can really make a difference. One of the issues I’ve noticed over the past two years on the board is that information is communicated via email which can be misconstrued, maybe it’s time to make these communications via live town halls to enable the community to have an input. <br />
<br />
'''6. How do you hope/plan to draw a more diverse group of newcomers to OWASP? Women, people of colour, non-binary, students, second-career, LGBT, people with disabilities, and other groups that are under represented both in our industry and in our community. How do you hope/plan to attract them to our community, events, foundation, projects and chapters?'''<br />
<br />
We need to provide a platform for each. WIA is a great example of our diversity outreach program, another is the funds we are putting into scholarships for those to attend a global appsec conference. One idea I proposed at a recent board meeting and on social media was the idea of OWASP enabling college students to complete internships reporting directly into the project leader. <br />
<br />
'''7. How do you hope/plan to improve the AppSec Global events? Do you feel they need improving?'''<br />
<br />
We need to standardise our conferences, as previously mentioned every time we run a conference, we start as if we have never done it before. Everything needs to be documented and we need to run conferences as a conference in a box approach. We also need to promote our conferences earlier as well as encourage a more diverse audience/ speakers through scholarships and initiatives. <br />
<br />
'''8. How do you plan to handle the massive stress, time and responsibility of being an OWASP Board member on top of your other professional duties? How many hours a week do you plan to dedicate specifically to the role of OWASP board member?'''<br />
<br />
This is something that’s very volatile. In my first year on the global board I took up the secretary board role and in my second-year vice-chair. Both have involved putting in a lot of hours both in the evenings and on weekends to fulfil the roles. As vice chair I have at least 3 calls a week generally Monday- Wednesday with ad-hoc calls with staff and the chair when required. I’ve really enjoyed my role on the board and do not see it as a burden but a challenge to make something great, even better. <br />
<br />
== '''References''' ==<br />
'''John Doherty Msc Security & Forensic Computing'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
<br />
'''Mark Denihan OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
'''Fabio Cerullo Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
'''Jason flood CTO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=254273User:Owen Pendlebury2019-08-28T13:22:47Z<p>Owen Pendlebury: </p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and led the Dublin Chapter of the Open Web Application Security Project (OWASP) organisation. In 2017 was elected to its Global Board of Directors where he held the role of Secretary and recently Vice-Chair of the global foundation. In 2016, Owen was awarded an OWASP Web Application Person of the Year (WASPY) award for Innovation and Sharing. <br />
<br />
Some of the projects that Owen has been involved in include, AppSec EU 2016/2017/2018/2019 Committee/ Training/ Speaker Committee chair, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, speaking on behalf of OWASP at BlackHat USA and EU, Cyber Security Summer Camp for school kids and OWASP Women in AppSec Committee/ mentoring. <br />
<br />
Owen has over 10 years’ experience in penetration testing and red teaming, working as part of several global Attack and Penetration Teams at “Big 4” professional service firms. He currently leads the penetration testing and red teaming teams for Deloitte Ireland and has in-depth experience of application, network, wireless and device penetration testing, having served numerous local and global institutions as clients in this area. Within Deloitte, Owen acts as vulnerability management lead for the EMEA region, setting the strategic direction, quality standards and deliverables for vulnerability management across EMEA. As part of this role, Owen has brought his colleagues from both EMEA and across the globe together to collaborate on innovative projects as well as client pitches. <br />
<br />
He also lectures and sits on the computer science program boards at the National College of Ireland (NCI) in web application, network security, and secure application development. In 2017, Owen was approached to architect a MSc, Degree and HDip in cyber security for NCI and has been working actively in supporting the bridge between academia and industry. He is also a keen advocate of diversity in cyber security and takes an active role in supporting the OWASP Women in AppSec group through mentoring and working with those who are trying to get into the field. <br />
<br />
== '''Answers to 2019 Global Board of Directors Questions/ Answers''' ==<br />
<br />
Link to Video - https://youtu.be/Gr0bZLz1o3Y<br />
<br />
'''1. What are the 3 biggest challenges you think OWASP is facing and how do you think we can solve them?'''<br />
* Economies of scale - I think as a global community we are facing a lot of challenges, one of which is how can we bring OWASP and our conferences to more economically challenged areas. To combat this, we on the board of directors have been discussing introducing an economy of scales for locations like this. <br />
* Diversity – we have an extremely big community but one thing we need to put a lot of effort into is, reaching out to the minorities. We have been doing this already through WIA and outreach programs such as Defcon/ BlackHat. We need to put more emphasis into our outreach to these minorities. <br />
* Staying relevant – OWASP is nothing without our community, who create the content/ projects that makes OWASP what it is. If we do not put the time and effort into making OWASP the place to be to work on these projects, what’s to stop another organisation from competing with us. We need to ensure that OWASP is where people want to come to collaborate and further our mission of improving software security. <br />
'''2. Many say the "O" in OWASP stands for "Open", and that we must remain "open" at all costs. In the past this has resulted in allowing known-bullies to persist within our community. Do you feel that remaining "open" is more/less/equally important to ensuring a safe, respectful and harassment free community? And why.'''<br />
<br />
I think in my tenure on the board of directors we have not stood for this behaviour. We are all adults, we all have to act as the professionals and treat people how we would want to be treated. There is a line where we have to interpret peoples culture, whether it is misinterpreted as part of an email which is read in the heat of the moment or whether people are just being plain inappropriate. There is no place for this behaviour in OWASP and if re-elected I will maintain my stance of a safe, respectful and harassment free community. In the end the community is OWASP, and we need to make it a safe place for all the cool people that make OWASP what it is. <br />
<br />
'''3. How do you hope/plan to improve OWASP's financial situation?'''<br />
<br />
This is one of those hard to answer questions. In the past few years we have struggled as a foundation to maintain the standards expected of an organisation our size due to fluctuation at an ED level. Now that we have consistency in the form of Mike we are able to pick out the pain points within the foundation and start to improve on them. One of which is our conferences, im not going to lie this is our main source of revenue, although every time we run a conference we are starting from scratch each time. By creating a solid baseline for the foundation to grow from, I believe the financial situation will continue to improve<br />
<br />
'''4. How do you hope/plan to better support and encourage the OWASP projects, chapters, and staff?'''<br />
<br />
By being there for them, whether it be for a coffee, an email or a call I will always have been and will be available for all three groups. As I mentioned before OWASP is the community and projects, chapters and staff are all part of our community, we should all work together for our common goal. <br />
<br />
'''5. How do you hope/plan to improve OWASP's community? We have had some angry chapters, projects and community members, how do you hope/plan to improve community relations and relationships?'''<br />
<br />
By enabling them to provide feedback and prompt change. With the committee 2.0 model the community has a structure to enable change. None of us are perfect but if we all work together then we can really make a difference. One of the issues I’ve noticed over the past two years on the board is that information is communicated via email which can be misconstrued, maybe it’s time to make these communications via live town halls to enable the community to have an input. <br />
<br />
'''6. How do you hope/plan to draw a more diverse group of newcomers to OWASP? Women, people of colour, non-binary, students, second-career, LGBT, people with disabilities, and other groups that are under represented both in our industry and in our community. How do you hope/plan to attract them to our community, events, foundation, projects and chapters?'''<br />
<br />
We need to provide a platform for each. WIA is a great example of our diversity outreach program, another is the funds we are putting into scholarships for those to attend a global appsec conference. One idea I proposed at a recent board meeting and on social media was the idea of OWASP enabling college students to complete internships reporting directly into the project leader. <br />
<br />
'''7. How do you hope/plan to improve the AppSec Global events? Do you feel they need improving?'''<br />
<br />
We need to standardise our conferences, as previously mentioned every time we run a conference, we start as if we have never done it before. Everything needs to be documented and we need to run conferences as a conference in a box approach. We also need to promote our conferences earlier as well as encourage a more diverse audience/ speakers through scholarships and initiatives. <br />
<br />
'''8. How do you plan to handle the massive stress, time and responsibility of being an OWASP Board member on top of your other professional duties? How many hours a week do you plan to dedicate specifically to the role of OWASP board member?'''<br />
<br />
This is something that’s very volatile. In my first year on the global board I took up the secretary board role and in my second-year vice-chair. Both have involved putting in a lot of hours both in the evenings and on weekends to fulfil the roles. As vice chair I have at least 3 calls a week generally Monday- Wednesday with ad-hoc calls with staff and the chair when required. I’ve really enjoyed my role on the board and do not see it as a burden but a challenge to make something great, even better. <br />
<br />
== '''References''' ==<br />
'''John Doherty Msc Security & Forensic Computing'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
<br />
'''Mark Denihan OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
'''Fabio Cerullo Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
'''Jason flood CTO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=254251User:Owen Pendlebury2019-08-27T20:01:35Z<p>Owen Pendlebury: </p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and led the Dublin Chapter of the Open Web Application Security Project (OWASP) organisation. In 2017 was elected to its Global Board of Directors where he held the role of Secretary and recently Vice-Chair of the global foundation. In 2016, Owen was awarded an OWASP Web Application Person of the Year (WASPY) award for Innovation and Sharing. <br />
<br />
Some of the projects that Owen has been involved in include, AppSec EU 2016/2017/2018/2019 Committee/ Training/ Speaker Committee chair, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, speaking on behalf of OWASP at BlackHat USA and EU, Cyber Security Summer Camp for school kids and OWASP Women in AppSec Committee/ mentoring. <br />
<br />
Owen has over 10 years’ experience in penetration testing and red teaming, working as part of several global Attack and Penetration Teams at “Big 4” professional service firms. He currently leads the penetration testing and red teaming teams for Deloitte Ireland and has in-depth experience of application, network, wireless and device penetration testing, having served numerous local and global institutions as clients in this area. Within Deloitte, Owen acts as vulnerability management lead for the EMEA region, setting the strategic direction, quality standards and deliverables for vulnerability management across EMEA. As part of this role, Owen has brought his colleagues from both EMEA and across the globe together to collaborate on innovative projects as well as client pitches. <br />
<br />
He also lectures and sits on the computer science program boards at the National College of Ireland (NCI) in web application, network security, and secure application development. In 2017, Owen was approached to architect a MSc, Degree and HDip in cyber security for NCI and has been working actively in supporting the bridge between academia and industry. He is also a keen advocate of diversity in cyber security and takes an active role in supporting the OWASP Women in AppSec group through mentoring and working with those who are trying to get into the field. <br />
<br />
== '''Answers to 2019 Global Board of Directors Questions/ Answers''' ==<br />
<br />
'''1. What are the 3 biggest challenges you think OWASP is facing and how do you think we can solve them?'''<br />
* Economies of scale - I think as a global community we are facing a lot of challenges, one of which is how can we bring OWASP and our conferences to more economically challenged areas. To combat this, we on the board of directors have been discussing introducing an economy of scales for locations like this. <br />
* Diversity – we have an extremely big community but one thing we need to put a lot of effort into is, reaching out to the minorities. We have been doing this already through WIA and outreach programs such as Defcon/ BlackHat. We need to put more emphasis into our outreach to these minorities. <br />
* Staying relevant – OWASP is nothing without our community, who create the content/ projects that makes OWASP what it is. If we do not put the time and effort into making OWASP the place to be to work on these projects, what’s to stop another organisation from competing with us. We need to ensure that OWASP is where people want to come to collaborate and further our mission of improving software security. <br />
'''2. Many say the "O" in OWASP stands for "Open", and that we must remain "open" at all costs. In the past this has resulted in allowing known-bullies to persist within our community. Do you feel that remaining "open" is more/less/equally important to ensuring a safe, respectful and harassment free community? And why.'''<br />
<br />
I think in my tenure on the board of directors we have not stood for this behaviour. We are all adults, we all have to act as the professionals and treat people how we would want to be treated. There is a line where we have to interpret peoples culture, whether it is misinterpreted as part of an email which is read in the heat of the moment or whether people are just being plain inappropriate. There is no place for this behaviour in OWASP and if re-elected I will maintain my stance of a safe, respectful and harassment free community. In the end the community is OWASP, and we need to make it a safe place for all the cool people that make OWASP what it is. <br />
<br />
'''3. How do you hope/plan to improve OWASP's financial situation?'''<br />
<br />
This is one of those hard to answer questions. In the past few years we have struggled as a foundation to maintain the standards expected of an organisation our size due to fluctuation at an ED level. Now that we have consistency in the form of Mike we are able to pick out the pain points within the foundation and start to improve on them. One of which is our conferences, im not going to lie this is our main source of revenue, although every time we run a conference we are starting from scratch each time. By creating a solid baseline for the foundation to grow from, I believe the financial situation will continue to improve<br />
<br />
'''4. How do you hope/plan to better support and encourage the OWASP projects, chapters, and staff?'''<br />
<br />
By being there for them, whether it be for a coffee, an email or a call I will always have been and will be available for all three groups. As I mentioned before OWASP is the community and projects, chapters and staff are all part of our community, we should all work together for our common goal. <br />
<br />
'''5. How do you hope/plan to improve OWASP's community? We have had some angry chapters, projects and community members, how do you hope/plan to improve community relations and relationships?'''<br />
<br />
By enabling them to provide feedback and prompt change. With the committee 2.0 model the community has a structure to enable change. None of us are perfect but if we all work together then we can really make a difference. One of the issues I’ve noticed over the past two years on the board is that information is communicated via email which can be misconstrued, maybe it’s time to make these communications via live town halls to enable the community to have an input. <br />
<br />
'''6. How do you hope/plan to draw a more diverse group of newcomers to OWASP? Women, people of colour, non-binary, students, second-career, LGBT, people with disabilities, and other groups that are under represented both in our industry and in our community. How do you hope/plan to attract them to our community, events, foundation, projects and chapters?'''<br />
<br />
We need to provide a platform for each. WIA is a great example of our diversity outreach program, another is the funds we are putting into scholarships for those to attend a global appsec conference. One idea I proposed at a recent board meeting and on social media was the idea of OWASP enabling college students to complete internships reporting directly into the project leader. <br />
<br />
'''7. How do you hope/plan to improve the AppSec Global events? Do you feel they need improving?'''<br />
<br />
We need to standardise our conferences, as previously mentioned every time we run a conference, we start as if we have never done it before. Everything needs to be documented and we need to run conferences as a conference in a box approach. We also need to promote our conferences earlier as well as encourage a more diverse audience/ speakers through scholarships and initiatives. <br />
<br />
'''8. How do you plan to handle the massive stress, time and responsibility of being an OWASP Board member on top of your other professional duties? How many hours a week do you plan to dedicate specifically to the role of OWASP board member?'''<br />
<br />
This is something that’s very volatile. In my first year on the global board I took up the secretary board role and in my second-year vice-chair. Both have involved putting in a lot of hours both in the evenings and on weekends to fulfil the roles. As vice chair I have at least 3 calls a week generally Monday- Wednesday with ad-hoc calls with staff and the chair when required. I’ve really enjoyed my role on the board and do not see it as a burden but a challenge to make something great, even better. <br />
<br />
== '''References''' ==<br />
'''John Doherty Msc Security & Forensic Computing'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
<br />
'''Mark Denihan OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
'''Fabio Cerullo Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
'''Jason flood CTO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=254164User:Owen Pendlebury2019-08-26T14:41:50Z<p>Owen Pendlebury: </p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
<br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and led the Dublin Chapter of the Open Web Application Security Project (OWASP) organisation. In 2017 was elected to its Global Board of Directors where he held the role of Secretary and recently Vice-Chair of the global foundation. In 2016, Owen was awarded an OWASP Web Application Person of the Year (WASPY) award for Innovation and Sharing. <br />
<br />
Some of the projects that Owen has been involved in include, AppSec EU 2016/2017/2018/2019 Committee/ Training/ Speaker Committee chair, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, speaking on behalf of OWASP at BlackHat USA and EU, Cyber Security Summer Camp for school kids and OWASP Women in AppSec Committee/ mentoring. <br />
<br />
Owen has over 10 years’ experience in penetration testing and red teaming, working as part of several global Attack and Penetration Teams at “Big 4” professional service firms. He currently leads the penetration testing and red teaming teams for Deloitte Ireland and has in-depth experience of application, network, wireless and device penetration testing, having served numerous local and global institutions as clients in this area. Within Deloitte, Owen acts as vulnerability management lead for the EMEA region, setting the strategic direction, quality standards and deliverables for vulnerability management across EMEA. As part of this role, Owen has brought his colleagues from both EMEA and across the globe together to collaborate on innovative projects as well as client pitches. <br />
<br />
He also lectures and sits on the computer science program boards at the National College of Ireland (NCI) in web application, network security, and secure application development. In 2017, Owen was approached to architect a MSc, Degree and HDip in cyber security for NCI and has been working actively in supporting the bridge between academia and industry. He is also a keen advocate of diversity in cyber security and takes an active role in supporting the OWASP Women in AppSec group through mentoring and working with those who are trying to get into the field. <br />
<br />
Owen has also performed numerous web application, network, mobile, specialised technologies (ATM), device penetration tests for major organisations in the financial services, banking and pharmaceutical sectors, consisting of ‘black-box’, ‘white-box’ and ‘grey-box’ testing. <br />
<br />
'''References'''<br />
<br />
'''John Doherty Msc Security & Forensic Computing'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
<br />
'''Mark Denihan OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
'''Fabio Cerullo Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
'''Jason flood CTO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=253539Governance/OWASP Committees2019-08-05T18:56:38Z<p>Owen Pendlebury: updating the wording of cliff notes</p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
[[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets three applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The required roles for a committee board are: <br />
* Chair: <br />
* Vice-Chair; and <br />
* Secretary. <br />
<br />
Other roles that a committee board can be made up of, but are not limited to, PR/Marketing, Web, Membership, Finance & Meetings/Conferences <br />
<br />
<br><br />
<br />
<br><br />
<br><br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=253538Governance/OWASP Committees2019-08-05T18:54:39Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
[[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets three applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The required roles for a committee board are Chair, Vice-Chair and Secretary. Other roles that a committee board can be made up of, but are not limited to: <br />
<br />
* PR/Marketing <br />
* Web <br />
* Membership <br />
* Finance & Meetings/Conferences <br />
<br><br />
<br />
<br><br />
<br><br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=253537Governance/OWASP Committees2019-08-05T18:53:10Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
[[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets three applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The required roles for a committee board are Chair, Vice-Chair and Secretary. Other roles that a committee board can be made up of can be, but are not limited to: <br />
<br />
* PR/Marketing <br />
* Web <br />
* Membership <br />
* Finance & Meetings/Conferences <br />
<br><br />
<br />
<br><br />
<br><br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=253536Governance/OWASP Committees2019-08-05T18:29:28Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
[[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets three applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The roles for a committee board can be, but are not limited to: <br />
<br />
*Secretary <br />
* PR/Marketing <br />
* Web <br />
* Membership <br />
* Finance & Meetings/Conferences <br />
<br><br />
<br />
<br><br />
<br><br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=253535Governance/OWASP Committees2019-08-05T18:28:54Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
[[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets three applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The roles for a committee board can be but are not limited to: <br />
<br />
*Secretary <br />
* PR/Marketing <br />
* Web <br />
* Membership <br />
* Finance & Meetings/Conferences <br />
<br><br />
<br />
<br><br />
<br><br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=May_2019&diff=251762May 20192019-05-21T12:03:41Z<p>Owen Pendlebury: </p>
<hr />
<div><br />
Meeting Date:<br />
May 20<br />
<br />
Meeting Time:<br />
11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=5&day=20&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
<br />
Meeting Location:<br />
Remote<br />
<br />
Virtual: <br />
[https://zoom.us/j/282821949 Zoom Meeting Link] Meeting ID: 282 821 949 - [https://zoom.us/u/kvUg3969 local dial in numbers]<br />
<br />
AGENDA<br />
1, Conference Update (TelAviv, Amsterdam and DC)<br />
<br />
2, Open Security Summit Update/ Project funding<br />
<br />
3, Staffing requirements/ plans<br />
<br />
4, Website/ Internal Procedures/ Service Catalog update<br />
<br />
5, Update on Trademarks<br />
<br />
6, Update on next face to face meeting<br />
<br />
7, Update on projects and chapters<br />
<br />
CALL TO ORDER<br />
<br />
CHANGES TO THE AGENDA<br />
<br />
APPROVAL OF MINUTES<br />
[https://docs.google.com/document/d/1OBSxgWMKSZgfcfS7eQPrdCzDEgeINqhFWenuCkaO4ZM/edit?usp=sharing April 2019 Minutes]<br />
<br />
REPORTS<br />
<br />
OLD BUSINESS<br />
<br />
NEW BUSINESS<br />
<br />
COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS<br />
<br />
ADJOURNMENT<br />
<br />
<br />
===<br />
<br />
==Old Business==<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]<br />
<br />
==New Business==<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=May_2019&diff=251761May 20192019-05-21T12:03:12Z<p>Owen Pendlebury: </p>
<hr />
<div><br />
Meeting Date:<br />
May 20<br />
<br />
Meeting Time:<br />
11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=5&day=20&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
<br />
Meeting Location:<br />
Remote<br />
<br />
Virtual: <br />
[https://zoom.us/j/282821949 Zoom Meeting Link] Meeting ID: 282 821 949 - [https://zoom.us/u/kvUg3969 local dial in numbers]<br />
<br />
AGENDA<br />
1, Conference Update (TelAviv, Amsterdam and DC)<br />
2, Open Security Summit Update/ Project funding<br />
3, Staffing requirements/ plans<br />
4, Website/ Internal Procedures/ Service Catalog update<br />
5, Update on Trademarks<br />
6, Update on next face to face meeting<br />
7, Update on projects and chapters<br />
<br />
CALL TO ORDER<br />
<br />
CHANGES TO THE AGENDA<br />
<br />
APPROVAL OF MINUTES<br />
[https://docs.google.com/document/d/1OBSxgWMKSZgfcfS7eQPrdCzDEgeINqhFWenuCkaO4ZM/edit?usp=sharing April 2019 Minutes]<br />
<br />
REPORTS<br />
<br />
OLD BUSINESS<br />
<br />
NEW BUSINESS<br />
<br />
COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS<br />
<br />
ADJOURNMENT<br />
<br />
<br />
===<br />
<br />
==Old Business==<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]<br />
<br />
==New Business==<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Board&diff=250758Board2019-04-29T09:43:49Z<p>Owen Pendlebury: </p>
<hr />
<div>__NOTOC__<br />
<br />
= Board Meetings =<br />
[https://www.owasp.org/index.php/About_OWASP#OWASP_Foundation_Bylaws Bylaws] are the most important legal document of any organization. Bylaws outline in writing the day-to-day rules for your organization and provide comprehensive guidelines to keep things running smoothly. If you want to understand the business of OWASP Foundation the best way to do that would be to examine the bylaws the the [https://www.owasp.org/index.php/About_OWASP#Form_990_Documents 990 forms filed with the United States Government as a non-profit annually.]<br />
<br />
[https://www.owasp.org/index.php/About_OWASP#OWASP_Foundation_Bylaws Global Bylaws]<br />
<br />
== Upcoming 2019 Meetings == <br />
* [[April 2019 |April 29, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=4&day=15&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[May 2019 |May 21, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=5&day=20&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[June 2019 |June 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=6&day=17&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[July 2019 |July 16, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=7&day=15&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[August 2019 |August 20, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=8&day=19&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[September 2019 |September 17, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=9&day=16&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[October 2019 |October 22, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=10&day=21&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[November 2019 |November 29, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=11&day=18&hour=19&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[December 2019 |December 24, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=12&day=23&hour=19&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
<br />
All board meeting notes that include actions as a result will be tracked in a single document for all meetings [https://docs.google.com/a/owasp.org/document/d/1aPmftVZH3-G96J6-wrpynwwZhBHtREe5a7g8owVYUag/edit?usp=sharing click here]<br />
<br />
== 2018 Elected by Membership, Global Board Members == <br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Member, Meeting Attendance Tracking]<br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_History Historical Board Members by Year]<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[User:Knoblochmartin | Martin Knobloch]]: Chair ====<br />
<br />
The Chairman of the Board shall serve as the principal executive officer of the Foundation.<br />
<br />
Fiduciary responsibilities: He/She shall, in general, supervise and control all of the business and affairs of the Foundation. He/She will monitor financial planning and financial reports He/She or he may sign, with the Secretary or any other proper officer of the Foundation thereunto authorized by the Board of Directors, any deeds, mortgages, bonds, contracts, or other instruments which the Board of Directors has authorized to be executed, except in cases where the signing and execution thereof shall be expressly delegated by the Board of Directors or by these Bylaws to some other officer or agent of the Foundation, or shall be required by law to be otherwise signed or executed;<br />
<br />
Leadership and Direction: provides leadership to the Board of Directors with regards to policy setting and strategic planning. He/She helps guide and mediate board actions with respect to organizational priorities and governance concerns, and in general shall perform all duties incident to the office of Chairman of the Board subject to the control of the Board of Directors.<br />
<br />
Organizational Responsibilities: He/She plays a leading role in fundraising activities, formally evaluate the performance of the Foundation Director and informally evaluate the effectiveness of the board members. An annual, overall evaluation of the performance of the organization in achieving its mission will be accomplished. He or she shall, when present, preside at all meetings of the Board of Directors, unless otherwise delegated, and such other duties as may be prescribed by the Board of Directors from time to time. <br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
<br />
==== [[Owen_Pendlebury_2017_Bio_%26_Why_Me%3F | Owen Pendlebury]]: Vice Chair ====<br />
<br />
Performs Chair responsibilities when the Chair cannot be available, works closely with Chair and other Board Members, participates closely with Chair to develop and implement officer transition plans, performs other responsibilities as assigned by the Board.<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[Sherif_Mansour_2017_Bio_%26_Why_Me%3F | Sherif Mansour]]: Treasurer==== <br />
<br />
Treasurer manages finances of the organization, administers fiscal matters of the organization, provides annual budget to the board for member’s approval, ensures development and board review of financial policies and procedures. [[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
<br><br />
==== [[User:Ofer_Maor | Ofer Maor]]: Secretary ====<br />
<br />
Maintains records of the board and ensures effective management of organization’s records, manages minutes of board meetings, ensures minutes are distributed shortly after each meeting, is sufficiently familiar with legal documents (articles, bylaws, IRS letters, etc.) to note applicability during meetings; is the custodian of the corporate records and of the seal of the Foundation and see that the seal of the Foundation is affixed to all documents, the execution of which on behalf of the Foundation under its seal is duly authorized; keeps a register of the post office address of each Director which shall be furnished to the Secretary by such Director; and, in general perform all duties incident to the office of the Secretary and such other duties as from time to time may be assigned to him by the Chairman of the Board or by the Board. <br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[Chenxi_Wang,_Ph.D._(Forrester_Research) | Chenxi Wang, Ph.D.]]: Member at Large====<br />
<br><br />
Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br />
==== [[User:Richard_greenberg | Richard Greenberg]]: Member at Large ====<br />
<br>Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br />
<br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
====[[Gary_Robinson_2018_Bio_and_Why_me | Gary Robinson]]: Member at Large ====<br />
<br />
<br><br />
Regularly attends board meetings and important related meetings, volunteers for and willingly accepts assignments and completes them thoroughly and on time, stays informed about committee matters, prepares themselves well for meetings, and reviews and comments on minutes and reports, gets to know other committee members and builds a collegial working relationship that contributes to consensus, is an active participant in the committee’s annual evaluating and planning efforts, participates in fundraising for the organization.<br><br />
<br />
<br />
= How Meetings Operate =<br />
'''CALL TO ORDER'''<br />
<br />
The first order of business is for the chair to announce the call to order, along with the time. The secretary enters the time of the call to order in the minutes. After the meeting is called to order, the board chair may make welcoming remarks, ask for introductions, or read the organization’s mission and vision statements.<br />
<br />
'''CHANGES TO THE AGENDA'''<br />
<br />
The second order of business is for the chair to ask for changes to the agenda. Additions and deletions to the agenda will be made at this time. Having no changes, the agenda moves to approving the prior meeting’s minutes.<br />
<br />
<br />
'''APPROVAL OF MINUTES'''<br />
<br />
The third item on the agenda should list “Approval of Minutes” along with the date of the most recent meeting. In most cases, board members should have received a copy of the minutes prior to the meeting. If they have not contacted the secretary prior to the meeting with corrections or changes to the minutes, they have to opportunity to make them during this item on the agenda.<br />
<br />
Board members have an ethical and legal responsibility to make sure that the recording of the minutes accurately reflect the board’s business.<br />
<br />
'''REPORTS'''<br />
<br />
The fourth item on the agenda is the reports. This first report should be a report from the Executive Director. This report should include a review of operations and projects. The Executive Director should give board members on overview of the business outlook including positive and negative trends, major initiatives, business updates, and other aspects of the business.<br />
<br />
Following the Executive Director report, the Finance Director gives a report. Board members should make an effort to understand the financial reports so that they can identify potential financial threats. Understanding financial reports may also generate discussion about potential opportunities.<br />
<br />
Subsequent reports may be given by committee chairs.<br />
<br />
'''OLD BUSINESS'''<br />
<br />
Items should include past business items that are unresolved, need further discussion, or require a board vote. Items may be tabled or referred to committee for further exploration.<br />
<br />
'''NEW BUSINESS'''<br />
<br />
Board members should have a discussion about new business items and identify a plan to take action. This may include tabling them, delaying action to a future date, or referring them to a committee.<br />
<br />
'''COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS'''<br />
<br />
At this point in the agenda, members may make announcements, such as offering congratulations or condolences, or make other special announcements. Any other business may be brought up at this time, for example, items that may need to be added to the next meeting’s agenda.<br />
<br />
'''ADJOURNMENT'''<br />
<br />
This is a formal closing of the meeting by the board chair. He should state the time that the meeting closed, so that the secretary may including it in the board minutes. The date of the next meeting should follow the adjournment item, so that board members will be reminded to put it on their calendars.<br />
<br />
For more information about the Roberts Rules of Order see this [http://www.umecra.com/BylawsAndRules/Roberts%20Rules%20Handout.pdf CHEAT SHEET]<br />
<br />
= Voting History =<br />
<br />
=== Historical Votes on Motions ===<br />
The purpose of this is to track the position on each motion as presented and how the elected official voted on the motion. This is useful for the membership to review how elected officials voted on items that effect the organization and its [https://www.owasp.org/index.php/OWASP_Foundation_ByLaws bylaws]. A motion is a request for action (budget requests, policy changes, new partnerships etc.) they can be presented by ANYONE to the board such as a member of the public, a member of the OWASP Foundation but does require a sponsor on the Board. That sponsor will present the motion to the board at least (10) working days in advance so it can be read in advance of the meeting. If appropriate a motion can be presented based to take action on the motion as written. For a vote to be called and action to be taken a second board member is required to carry the business to vote. On completion of the discussion the chairman will call for a vote to the motion YES, NO, ABSTAIN. For more details on this process try this [http://www.umecra.com/BylawsAndRules/Roberts%20Rules%20Handout.pdf CHEAT SHEET]<br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_Votes Historical Board Votes]<br />
<br />
Note that if a motion is presented and is voted on and it is approved action will be taken to implement the motion. If the motion fails it can be resubmitted and the process starts again as if it is a new motion.<br />
<br />
=== Attendance Tracker===<br />
This is used to keep track that Board Members meet 75% attendance requirements as noted in section 3.03 of the organization bylaws. A meeting is logged as attended if the board member attends the entire meeting as scheduled from the call to order until it is adjourned, this includes executive session if applicable that is closed to the membership and general public for reasons related to human resources and legal issues that require it by law or for the good of the OWASP Foundation Inc. - <br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Meeting Attendance Tracker]<br />
<br />
= Historical Meeting Archive =<br />
== Archive 2019 ==<br />
* [[March 2019 |March 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=3&day=18&hour=18&min=0&sec=0&p1=16&p2=919&p3=78&p4=136&p5=137&p6=676 other time zones]<br />
* [[February 2019 |February 18, 2019]] 11 AM US Pacific - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=2&day=18&hour=19&min=0&sec=0&p1=16&p2=919& other time zones]<br />
* [[January 2019 |January 23rd, 2019]] - 3:00 PM to 4:00 PM PST([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2019&month=1&day=23&hour=23&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
<br />
== Archive 2018 ==<br />
* [[December 2018 |December 19th, 2018]] - 1:00 PM to 2:30 PM EST ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=12&day=19&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
* [[November 2018 |November 21, 2018]] - 12:00 PM to 1:30 PM EST ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=11&day=21&hour=17&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
* [[October 2018 |October 10, 2018]] - 3:00 to 4:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=10&day=10&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) at AppSec USA 2018 Conference<br />
* [[September 2018 |September 27, 2018]] - 2:00 PM to 3:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=9&day=19&hour=18&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) <br />
* [[August 2018 |August 15, 2018]] - 1:00 PM to 2:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=8&day=15&hour=17&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones]) <br />
* [[July 4th, 2018|July 4th, 2018]] - during AppSec EU 2018<br />
* [[June_19,_2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=6&day=19&hour=18&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 Click Here for Meeting Time in Your Timezone]<br />
* [[May 15, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=5&day=15&hour=19&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 Click Here for Meeting Time in Your Timezone]<br />
* [[April 4, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=4&day=4&hour=14&min=0&sec=0&p1=16&p2=78&p3=136&p4=179&p5=224&p6=102&p7=236&p8=152 TimeZone Converter]<br />
* [[March 7, 2018]] - 3:00pm - 4:00pm EST - [https://www.timeanddate.com/worldclock/converted.html?iso=20180307T21&p1=16&p2=16&p3=676&p4=136&p5=78&p6=179&p7=224&p8=240&p9=102 Time Converter]<br />
* [[February 7, 2018]] - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=2&day=7&hour=20&min=0&sec=0&p1=16&p2=179&p3=78&p4=102&p5=224&p6=136&p7=152&p8=676 TimeZone Converter]<br />
* [[January 24, 2018]], [https://www.timeanddate.com/worldclock/fixedtime.html?msg=OWASP+Board+Meeting%2C+January+24+2018&iso=20180124T19&p1=16&ah=1&am=30 TimeZone Converter]<br />
<br />
== Archive 2017 ==<br />
* [[December 6, 2017]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=12&day=06&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[November 8, 2017]], 07:00-08:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=11&day=8&hour=15&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[October 11, 2017]], 15:00 - 17:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=10&day=11&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[September 19, 2017]] 15:00-17:30 PDT, in Orlando at AppSecUSA - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=9&day=19&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[September 6, 2017]] 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=09&day=06&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] (Cancelled for interviews)<br />
*[[August 9, 2017]], 16:00-17:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=08&day=09&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[July 5, 2017]], 07:00-08:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=07&day=05&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[June 7, 2017]], 18:00-21:00 CEST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=06&day=07&hour=16&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[May 9, 2017]], 18:00-19:30 IST, in Belfast at AppSecEU - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=5&day=9&hour=17&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[April 12, 2017]], 16:00-17:00 PDT - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=04&day=12&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] ('''Cancelled''' [http://lists.owasp.org/pipermail/owasp-board/2017-April/017969.html Notice by Matt Konda])<br />
*[[March 22, 2017]] 06:00-07:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=3&day=22&hour=13&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] - *Special Meeting to approve the 2017 Budget*<br />
* [[March 8, 2017]], 06:00-07:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=03&day=08&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[February 8, 2017]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=02&day=08&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[January 11, 2017]], 14:00-15:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=1&day=10&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
<br />
== Archive for 2016 Meetings ==<br />
* [[December 14, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=12&day=14&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[November 8, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=11&day=09&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* CANCELLED - [[November 30, 2016]], 15:00-16:30 PST - placeholder only optional if needed - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=11&day=30&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[October 11, 2016]], at AppSecUSA 18:00 - 21:00 EDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=10&day=11&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[September 21, 2016]] 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=09&day=21&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[August 23, 2016]], 16:00-17:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=08&day=23&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[July 1, 2016]], 18:00-21:00 CEST, in Rome at AppSecEU - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=07&day=01&hour=16&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[July 27, 2016]], 07:00-08:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=07&day=27&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[May 18, 2016]], 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=05&day=18&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[April 20, 2016]], 16:00-17:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=04&day=20&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[March 16, 2016]], 16:00-17:00 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=03&day=16&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[February 17, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=02&day=17&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[January 13, 2016]], 16:00-17:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=01&day=14&hour=00&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
<br />
== Archive for 2015 Meetings ==<br />
* [[December 9, 2015]], 15:00-17:00 PST <br />
* [[November 18, 2015]], 14:00-15:30 PST<br />
* [[November 4, 2015]], 12:00-13:30 PST<br />
* [[October 14, 2015]], 14:00-15:00 PDT<br />
* [[September 25, 2015]] at AppSecUSA 18:00 - 20:00 PST<br />
* [[August 12, 2015]], 16:00-17:00 PST<br />
* [[July 22, 2015]], 14:00-15:00 PDT<br />
* [[June 24, 2015]], 14:00-15:00 PDT<br />
* [[May 22, 2015]], 18:00-20:00 CEST in Amsterdam @ AppSec-EU , 9:00am-11:00am PST;<br />
* [[April 29, 2015]], 12:00-13:00 PST<br />
* [[March 25, 2015]], 12:00-13:00 PST <br />
* [[February 11, 2015]], 16:00-17:00 PST<br />
* [[January 14, 2015]], 9am-10am PST<br />
<br />
<br />
== Archive for 2014 Meetings ==<br />
* [[December 10, 2014]], 9am-10am PST<br />
* [[November 12, 2014]], 9am - 10am PST<br />
* [[October 8, 2014]], 9am-10am PST<br />
* [[September 16, 2014]], 6pm - 9pm MST, In person at Appsec USA <br />
* [[August 13, 2014]], 9am-10am PST<br />
* [[July 9, 2014]], 9am-10am PST<br />
* [[June 27, 2014]], 8am - 4 pm BST, In person at AppSec Europe<br />
* [[April 30, 2014]],9am - 12pm PST<br />
* [[March 3, 2014]], 7am - 10am PST<br />
* [[February 24, 2014]], 8am - 10am PST<br />
<br />
== Archive for 2013 Meetings ==<br />
<br />
*[[December 9, 2013]]<br />
<br />
* December 2, 2013 - Special Board Meeting - [https://docs.google.com/spreadsheet/ccc?key=0ApZ9zE0hx0LNdGdJZ1BIaEZkc2V1QV81NmJ4dnI0R1E&usp=sharing 2014 Budget] walk through, Q & A (no meeting notes)<br />
<br />
*[[November 22, 2013]] - In person meeting at AppSec USA - New York, NY<br />
<br />
* November 11, 2013 - cancelled due to in person meeting on Nov. 22<br />
<br />
*[[October 14, 2013]]<br />
<br />
*[[September 9, 2013]]<br />
<br />
*[[In person meeting at AppSec EU - Hamburg, Germany; August 19-24]]<br />
<br />
* August 12, 2013 - canceled due to in person meeting on Aug 19<br />
<br />
*[[July 8, 2013]]<br />
<br />
*[[June 10, 2013]]<br />
<br />
*[[May 31, 2013]]<br />
<br />
*[[May 13, 2013]]<br />
<br />
*[[April 8, 2013]]<br />
<br />
*[[March 11, 2013]]<br />
<br />
*[[February 11, 2013]]<br />
<br />
*[[January 14, 2013]]<br />
<br />
== Archive for 2012 Meetings ==<br />
<br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Meeting Attendance Tracking]<br />
<br />
OWASP Foundation [https://www.owasp.org/images/a/ae/2012ByLawsFINAL.pdf ByLaws]<br />
<br />
[https://www.owasp.org/index.php/Global_Committee_Pages Global Committees] <br />
<br />
*[[January 9, 2012]]<br />
<br />
*[[February 6, 2012]]<br />
<br />
*[[February 15, 2012]] <br />
<br />
*[[March 12, 2012]]<br />
<br />
*[[April 5, 2012]]<br />
<br />
*[[May 14,2012]]<br />
<br />
*[[June 11, 2012]]<br />
<br />
*[[July 11, 2012]]<br />
<br />
*[[Aug 13, 2012]]<br />
<br />
*[[Sept 10, 2012]]<br />
<br />
*[[Oct 8, 2012]]<br />
<br />
*[[Oct 24, 2012]]<br />
<br />
*[[Nov 12, 2012]]<br />
<br />
*[[Nov 26, 2012]] - 2013 Budget Focused<br />
<br />
*[[Dec 10, 2012]]<br />
<br />
*[[Dec 27, 2012]] - 2013 Budget Focused<br />
<br />
== Archive for 2011 Meetings ==<br />
<br />
*[[January 3, 2011]]<br />
<br />
*[[March 7, 2011]]<br />
<br />
*[[April_4_2011]]<br />
<br />
*[[May_2_2011]]<br />
<br />
*[[June 6, 2011]]<br />
<br />
*[[July 11, 2011]]<br />
<br />
*[[August 8, 2011]] <br />
<br />
*[[September 6, 2011]]<br />
<br />
*[[September 20, 2011]]<br />
<br />
*[[September 22, 2011]]<br />
<br />
*[[October 10, 2011]]<br />
<br />
*[[November 14, 2011]]<br />
<br />
*[[December 5, 2011]]<br />
<br />
== Minutes for 2011 Meetings == <br />
<br />
<hr /><br />
<br />
* [https://www.owasp.org/index.php/OWASP_Board_Votes Board Votes Historical]<br />
<br />
<hr /><br />
<br />
*[[Minutes January 3, 2011]]<br />
<br />
*[[Minutes March 8, 2011]]<br />
<br />
*[[Minutes April 4, 2011]]<br />
<br />
*[[Minutes May 2, 2011]]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1VD9ZHEwht9tmM8FKEQ6DBrtmL_gTAhSSnQhiFXYkJ7I/edit?hl=en_US&authkey=CIavkP4B June 6 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1VMwYrP6owtZ-SchBxUcWTIF-ITvzUX8PjUkLPwr2ipg/edit?hl=en_US&authkey=CIGTx5sD July 11 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1CLu9aQpS7LdeX87rJ5N9cuJ-RGGVzDWf34l6gdMml7M/edit?hl=en_US&authkey=CI-U5qEP August 8, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1HM32VcvWb0hizD5_mhWMULLaouzuRgA3ZYjODRZwyAs/edit?hl=en_US September 6, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1Y-8tZisUZM5ZKP8AxJqvkiNtFanVFM0m--bMG2PZ3ww/edit October 10, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/13-aHX2pSUXjCP8ivsbls6u1VX1BVSYewyMUH8LI7zpQ/edit November 14, 2011]<br />
<br />
== Archive for 2010 Meetings ==<br />
*[[January 5, 2010]]<br />
<br />
*[[February 2, 2010]]<br />
<br />
*[[March 2, 2010]] <span style="color:blue">Postponed until March 9, 2010</span> <br />
<br />
*[[April 6, 2010]]<br />
<br />
*[[May 4, 2010]]<br />
<br />
*[[June 7, 2010]]<br />
<br />
*[[July 12, 2010]]<br />
<br />
*[[August 2, 2010]]<br />
<br />
*[[September 8, 2010]]<br />
<br />
*[[October 11, 2010]]<br />
<br />
*[[November 9, 2010]]<br />
<br />
*[[December_6_2010]]<br />
<br />
== Archive of 2010 Meetings ==<br />
<br />
*[[Jan 5, 2010]]<br />
<br />
*[[Feb 2, 2010]]<br />
<br />
*[[March 2, 2010]]<br />
<br />
*[[Minutes April 6, 2010]]<br />
<br />
*[[Minutes May 11, 2010]]<br />
<br />
*[[Minutes June 7, 2010]]<br />
<br />
*[[Minutes July 12, 2010]]<br />
<br />
*[[Minutes October 11, 2010]]<br />
<br />
*[[Minutes November 9, 2010]]<br />
<br />
*[[Minutes_December_6,_2010]]<br />
<br />
*[[OWASP Board Meetings January Agenda]]<br />
*[[OWASP Board Meetings February Agenda]]<br />
*[[OWASP Board Meetings March Agenda]]<br />
*[[OWASP Board Meetings April09 Agenda]]<br />
*[[OWASP Board Meetings May09 Agenda]]<br />
*[[OWASP Board Meetings June 09 Agenda]]<br />
*[[OWASP Board Meeting July 7, 2009 Agenda]]<br />
*[[OWASP Board Meeting August 4, 2009 Agenda]]<br />
*[[OWASP Board Meeting September 1, 2009 Agenda]] <br />
*[[OWASP Board Meeting October 6, 2009 Agenda]]<br />
*[[OWASP Board Meeting November 10, 2009 Agenda]]<br />
*[[OWASP Board Meeting December 1, 2009 Agenda]]<br />
<br />
== Archive of 2009 Meetings ==<br />
* [[OWASP Board Meetings 01-06-09]]<br />
* [[OWASP Board Meetings 02-03-09]]<br />
* [[OWASP Board Meetings 03-10-09]]<br />
* [[OWASP Board Meetings April 09]]<br />
* [[OWASP Board Meetings May 09]]<br />
* [[OWASP Board Meetings June 09]]<br />
* [[OWASP Board Meeting July 09]]<br />
* [[OWASP Board Meeting August 09]]<br />
* [[OWASP Board Meeting September 09]]<br />
* [[OWASP Board Meeting October 09]]<br />
* [[OWASP Board Meeting December 09]]<br />
<br />
== Archive for 2008 Meetings ==<br />
*[[OWASP Board Meetings March Agenda]]<br />
*[[OWASP Board Meetings April Agenda]]<br />
*[[OWASP Board Meetings May Agenda]]<br />
*[[OWASP Board Meetings June Agenda]]<br />
*[[OWASP Board Meetings July Agenda]]<br />
*[[OWASP Board Meetings August Agenda]]<br />
*[[OWASP Board Meetings September Agenda]]<br />
*[[OWASP Board Meetings October Agenda]]<br />
*[[OWASP Board Meetings December Agenda]]<br />
<br />
== Archive of 2008 Meetings ==<br />
* [[OWASP Board Meetings 2-7-08]]<br />
* [[OWASP Board Meetings 3-6-08]]<br />
* [[OWASP Board Meetings 5-6-08]]<br />
* [[OWASP Board Meetings 6-3-08]]<br />
* [[OWASP Board Meetings 8-14-08]]<br />
* [[OWASP Board Meetings 9-2-08]] <br />
* [[Owasp Board Meetings 10-07-08]]<br />
* [[Owasp Board Meetings 11-07-08]]<br />
* [[Owasp Board Meetings 12-02-08]]<br />
<br />
= Board Election Archive =<br />
<br />
All elected officers are required to [https://docs.google.com/document/d/10zBT6oY2Q3B6kr6r7DGl3Cc0f5rGmQ0Slc6RYvbxmus/edit review sign and return] the following document before starting their term in office to the then current board Secretary <br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_History OWASP Board History]<br />
<br />
===2017 Election===<br />
[https://www.owasp.org/index.php/2017_Global_Board_of_Directors_Election 2017 Board Election]<br />
=== 2016 Election ===<br />
[https://www.owasp.org/index.php/2016_Global_Board_of_Directors_Election 2016 Board Election]<br />
=== 2015 Election ===<br />
[https://www.owasp.org/index.php/2015_Global_Board_of_Directors_Election 2015 Board Election]<br />
=== 2014 Election ===<br />
[https://www.owasp.org/index.php/2014_Board_Elections 2014 Board Election]<br />
=== 2013 Election ===<br />
[https://www.owasp.org/index.php/2013_Board_Elections 2013 Board Election]<br />
=== 2012 Election ===<br />
[https://www.owasp.org/index.php/Membership/2012_Election 2012 Board Election]<br />
=== 2011 Election ===<br />
[https://www.owasp.org/index.php/Membership/2011Election 2011 Board Election]<br />
=== 2009 Election ===<br />
[https://www.owasp.org/index.php/Board_Election_2009 2009 Board Election]<br />
<br />
=== Past OWASP Boards ===<br />
<br />
[[Board-2018]]<br />
<br />
[[Board-2017]]<br />
<br />
[[Board-2016]]<br />
<br />
[[Board-2015]]<br />
<br />
[[Board-2014]]<br />
<br />
[[Board-2013]]<br />
<br />
[[Board-2012]]<br />
<br />
[[Board-2011]]<br />
<br />
= Misc. =<br />
<br />
* Teleconference Information: **CHECK MEETING INFORMATION**<br />
<br />
* [https://www.owasp.org/index.php/International_Toll_Free_Calling_Information International Toll Free Calling Info]<br />
<br />
* Meeting Template found [https://www.owasp.org/index.php/Board-Meeting-template here]<br />
<br />
<headertabs> </headertabs></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=249867Governance/OWASP Committees2019-04-09T14:26:31Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
[[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets five applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The minimum required roles for a committee board are: <br />
<br />
*Secretary <br />
* PR/Marketing <br />
* Web <br />
* Membership <br />
* Finance & Meetings/Conferences <br />
<br><br />
<br />
<br><br />
<br><br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=249866Governance/OWASP Committees2019-04-09T14:23:59Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets five applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The minimum required roles for a committee board are: <br />
*** Secretary <br />
*** PR/Marketing <br />
*** Web <br />
*** Membership <br />
*** Finance & Meetings/Conferences <br />
<br><br />
[[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
<br><br />
<br><br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=249865Governance/OWASP Committees2019-04-09T14:22:46Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets five applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The minimum required roles for a committee board are: [[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
*** Secretary <br />
*** PR/Marketing <br />
*** Web <br />
*** Membership <br />
*** Finance & Meetings/Conferences <br />
<br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=249864Governance/OWASP Committees2019-04-09T14:21:37Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets five applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The minimum required roles for a committee board are: <br />
*** Secretary <br />
*** PR/Marketing <br />
*** Web <br />
*** Membership <br />
*** Finance & Meetings/Conferences <br />
<br />
[[File:ProcessFlowCommittee2.0.png|thumb|Process Flow Committee 2.0]]<br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=File:ProcessFlowCommittee2.0.png&diff=249863File:ProcessFlowCommittee2.0.png2019-04-09T14:21:03Z<p>Owen Pendlebury: </p>
<hr />
<div>Image depicting the process flow</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=249861Governance/OWASP Committees2019-04-09T14:18:15Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
=== Summary ===<br />
<br />
If an OWASP member wants to create a new OWASP committee the process for that is as follows: <br />
<br />
1. The member must circulate the proposed committee, firstly through the OWASP mailing list. Optionally the member can use other mediums such as Slack so that more community members can lend support to the proposal. This proposal must state the rationale and the desired scope for the creation of the new committee. <br />
<br />
2. The proposal must get majority support from those who responded to any communications about it and no major arguments against it. <br />
<br />
3. If the previous requirement is met the OWASP Board of Directors will determine whether the committee and its scope is in line with OWASP’s goals and if any conflicts exist with other committees.<br />
<br />
4. If no conflict exists, the proposal will be discussed at the next Board of Directors meeting. This will involve community discussion and a vote on its formation. <br />
<br />
5. If a majority vote is established, the Board of Directors will put out a public call for any OWASP members interesting in committee membership, with a 4 week time period. <br />
<br />
6. If the committee gets five applications to join the new committee and creates a board to head up the new committee, then its proposal will be deemed successful and the committee is created. The minimum required roles for a committee board are: <br />
*** Secretary <br />
*** PR/Marketing <br />
*** Web <br />
*** Membership <br />
*** Finance & Meetings/Conferences <br />
<br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=249857Governance/OWASP Committees2019-04-09T13:24:01Z<p>Owen Pendlebury: </p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion, with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=247430Governance/OWASP Committees2019-02-13T16:42:10Z<p>Owen Pendlebury: formatting</p>
<hr />
<div>== '''OWASP Global Committees 2.0 Operational Model''' ==<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
== '''I. Introduction''' ==<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
== '''II. High-Level Proposal''' ==<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
== '''III. Committee Creation''' ==<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion , with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
* Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
== '''IV. Committee Scope''' ==<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
=== '''Conflict''' ===<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''V. Committee Membership''' ==<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
# Individual must be an OWASP member in good standing; or<br />
# Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
# Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
=== '''Lack of Participation''' ===<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
== '''VI. OWASP Staff Participation''' ==<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
== '''VII. OWASP Board Participation''' ==<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
== '''VIII. Committee Communication''' ==<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
== '''IX. Committee Organization''' ==<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
== '''X. Committee Removal''' ==<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
== '''XI. Empowerment''' ==<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
# The action is within the predetermined scope of the committee;<br />
# The action does not directly affect other OWASP functions such as projects<br />
# If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
# No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
# The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
# If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
== '''XII. Accountability''' ==<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
== '''XIII. Conclusion''' ==<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Governance/OWASP_Committees&diff=247429Governance/OWASP Committees2019-02-13T16:38:10Z<p>Owen Pendlebury: Updated to the latest version of the doc</p>
<hr />
<div>'''OWASP Global Committees 2.0 Operational Model'''<br />
<br />
Passed by a vote of the OWASP Board of Directors on December 19, 2018.<br />
<br />
'''I. Introduction'''<br />
<br />
The OWASP Global Committees empower members of the community to help shape OWASP and make the best decisions for the Foundation. The goal of the Global Committees 2.0 plan is to streamline the process for any member of the OWASP community who has an idea to improve the Foundation, to have a vehicle to act upon the idea and successfully implement it.<br />
<br />
'''II. High-Level Proposal'''<br />
<br />
OWASP’s committees participate in key aspects of our Foundation. This may include Chapters, Projects, Conferences, Governance, and other topics to be determined later. The key difference between the proposed committees and those of OWASP past will be in the empowerment to take action. OWASP believes that Committees should be empowered to vote on change , at any time, that is within the stated scope of the committee. If a committee wishes to change their scope, the committee should add the proposed change to the next BoD meeting for discussion. Once the BoD approves this change, the committee should bring the proposed change to the OWASP Community for feedback.<br />
<br />
'''III. Committee Creation'''<br />
<br />
At any point in time, a community member may propose a new committee via the OWASP mailing lists including other mediums such as slack to ensure greater community coverage,stating their rationale and the desired scope for creating a new committee. After this discussion , with majority support from those who responded on these communications and no major arguments against, the OWASP Board of Directors (BoD) will determine whether there is a conflict of interest with any existing committees and whether the formation of that committee and its desired scope is in line with OWASP’s goals.<br />
<br />
If no conflict is determined to exist, the Board, at the next BoD meeting will invite community discussion and vote on its formation. Once a majority vote is established, the BoD will initiate a public call for OWASP members interested in committee membership, via the OWASP Community mailing list, with a four-week time window. At this point, the committee will be formed once it receives at least five OWASP member applicants. These OWASP member applicants will be granted committee membership on successful completion of the proposed committee.<br />
<br />
A committee should have also a board with at least 5 members, each one having a specific role. Common roles:<br />
<br />
· Organization: Secretary, PR/Marketing, Web, Membership, Finance & Meetings/Conferences, although specific roles can be created at the discretion of the committee<br />
<br />
'''IV. Committee Scope'''<br />
<br />
The scope of an OWASP committee is established during the initial proposal for the new committee. This scope should be submitted as a draft to the BoD for discussion purposes prior to the committee formation. The Board will assess if this scope is in line with OWASP’s goals and may seek alterations where necessary.<br />
<br />
'''Conflict'''<br />
<br />
In the event that a community or staff member believes that a committee has taken actions outside of its scope, has abused the committee’s scope, or would like to adjust the scope of a committee, then they may state their rationale and desired response via the OWASP Leaders List. After a community discussion, the community or staff member will request that the OWASP Board of Directors establish the validity of the scope disagreement or proposed scope amendment. A majority vote of the Board is required to modify the scope of any OWASP committee.<br />
<br />
If there is a conflict within the committee, the conflict should be brought to the OWASP Compliance Committee who will rule on the conflict based on available evidence and where necessary interviews with the relevant personnel.<br />
<br />
Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
'''V. Committee Membership'''<br />
<br />
Any OWASP community member is welcome to participate in and provide feedback to an OWASP committee. Committee membership (voting privileges and leadership responsibilities), however, is limited to those who meet the following criteria:<br />
<br />
1) Individual must be an OWASP member in good standing; or<br />
<br />
2) Individual must have the written endorsement of either a current committee member or an OWASP Board member; or<br />
<br />
3) Individual must demonstrate a history of at least three months participation in the committee for which they are applying for membership.<br />
<br />
Any person who satisfies the above criteria may, by way of the public committee communication medium outlined in section VIII below, request to be granted membership to the committee. The committee will then conduct a vote on the applicant, via the same medium, and if the majority of members agree, they will be granted committee membership as well.<br />
<br />
Active committees are responsible for conducting a poll of members, at least every six months, by the committee staff liaison, asking each if they would like to continue to serve on the committee. Committee members who respond “No” or who do not respond at all during a two-week time window will be removed from membership by the committee.<br />
<br />
A member of a committee leadership team may have their membership removed for reasons of inactivity over a period of at least six months or misconduct as determined by a unanimous vote of the remaining members of the committee. If the committee feels that they do not have the required capability to deal with this misconduct, they may submit the case and all relevant documentation to the compliance committee for review.<br />
<br />
'''Lack of Participation'''<br />
<br />
If at any point in time, for any reason, committee membership is less than five people, then the committee leadership must initiate a public call for OWASP members interested in committee membership with a four-week time window. All qualified applicants must be accepted to join the committee as committee members. If there are not at least five committee members at the end of the four-week time window, the committee will lose its authoritative function, and will function only as in an advisory capacity. All related decision-making will automatically be re-assumed by the OWASP Board of Directors. Committee members are required to report any infractions of OWASP Foundation policies and procedures to the OWASP Board of Directors.<br />
<br />
'''VI. OWASP Staff Participation'''<br />
<br />
The OWASP Foundation will provide a designated staff member to support each active committee from an operational perspective. The staff member may participate in the committee as a community member, but will not serve as a voting member of the leadership team due to a potential conflict of interest. Participating staff are required to report any infractions of OWASP Foundation policies and procedures, by the committee, to the OWASP Board of Directors. The committee leadership team will be invited to provide feedback for the assessment of their assigned staff member by being invited to provide an annual evaluation of their committee related activities, capability and professionalism.<br />
<br />
'''VII. OWASP Board Participation'''<br />
<br />
Members of the OWASP Board of Directors are allowed to become committee members, but participate as normal committee members with no special powers either expressed or implied. While Board member participation in committees is encouraged, Board members must refrain from taking an active leadership role for the committee.<br />
<br />
'''VIII. Committee Communication'''<br />
<br />
All committees are required to hold their discussions in the open in order to enable participation by any member of the community. All committee discussions (written and verbal) must be archived in a publicly accessible location so that the community may observe committee actions at any point in time. Use of the OWASP Force Portal for Committees is strongly encouraged as it provides logical conversation grouping, an archive of conversations, document attachment capability, participation metrics, and more, but other technologies may be used as long as it is agreed upon by all committee members and all relevant information is linked from the respective Committee wiki page. Committees that wish to solicit assistance from outside participants for committee activities are strongly encouraged to do so using the OWASP Initiatives framework.<br />
<br />
Committees are required to notify the OWASP Community, via OWASP mailing lists including other mediums such as slack to ensure greater community coverage, in writing of any official votes and provide a written summary of actions taken on a minimum of a monthly basis or as necessary. Committee decisions are considered official once a record has been published to the community. The BoD is responsible for reviewing committee actions and ensuring that the committee is acting within its predefined scope and in accordance with the OWASP Foundation Bylaws as well as all other applicable policies and procedures.<br />
<br />
'''IX. Committee Organization'''<br />
<br />
All committees are responsible for being self-organized. This includes determining their own leadership structure, coordinating committee meeting schedules at least monthly, taking and publishing minutes of committee meetings, assembling monthly action summaries, culling inactive committee members, and ensuring compliance within the defined scope and various OWASP policies and procedures.<br />
<br />
'''X. Committee Removal'''<br />
<br />
If at any point in time an OWASP Leader believes that a committee is no longer necessary or that the scope of one committee conflicts with the scope of another, they may bring up this concern via the OWASP Leaders List. After a community discussion, the OWASP BoD will hold a vote on the committee removal. A ⅔ majority vote of the Board is required for the removal of a committee.<br />
<br />
'''XI. Empowerment'''<br />
<br />
As the goal of this proposal is to empower the community to make decisions for the betterment of the Foundation, no Board vote is necessary for any initiative, provided that the following is true:<br />
<br />
1) The action is within the predetermined scope of the committee;<br />
<br />
2) The action does not directly affect other OWASP functions such as projects<br />
<br />
3) If money is required, the action follows the guidelines set forth in the Community Engagement Funding document;<br />
<br />
4) No contracts are being executed by the committee on behalf of the OWASP Foundation; and<br />
<br />
5) The action is in line with the OWASP Foundation Code of Ethics and is pursuant to OWASP’s mission.<br />
<br />
If any of these is not true, then the OWASP BoD should be consulted for approval prior to the committee’s execution.<br />
<br />
'''XII. Accountability'''<br />
<br />
Because the committee is acting on behalf of the OWASP Foundation, but as a separate entity from the OWASP BoD, the committee members are expected to conduct their actions with regard to the OWASP Mission, the OWASP Code of Ethics, and the BoD’s annual strategic goals. The committee and it’s members will ultimately be held accountable for any actions that are not in line with these key principles or that are outside of the predetermined scope of the committee. Alleged violations should be brought to the attention of the OWASP Leaders List along with all substantiating evidence. After a community discussion, the Board may veto the actions of the committee by a majority vote of the BoD.<br />
<br />
'''XIII. Conclusion'''<br />
<br />
We believe that empowering our volunteers to take action is core to OWASP’s mission. With the above committee structure, we believe that the right pieces will be in place to provide the Foundation with effective governance as well as checks and balances to ensure unbiased operation. We hope that you will agree that executing on this is in the best interests of the future of the OWASP Foundation.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=December_2018&diff=246160December 20182018-12-19T17:58:12Z<p>Owen Pendlebury: /* Old Business */</p>
<hr />
<div><br />
Meeting Date: December 19, 2018<br />
<br />
Meeting Time: 1:00 PM to 2:30 PM EST ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=12&day=19&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
<br />
Meeting Location: Virtual<br />
<br />
Address: N/A<br />
<br />
Virtual: <nowiki>https://global.gotomeeting.com/join/844511053</nowiki> <s><nowiki>https://www3.gotomeeting.com/join/861328838</nowiki></s><br />
<br />
[[International_Toll_Free_Calling_Information |International Toll Free Calling Info]]<br />
<br />
AGENDA<br />
<br />
CALL TO ORDER<br />
<br />
CHANGES TO THE AGENDA<br />
<br />
APPROVAL OF MINUTES<br />
<br />
REPORTS<br />
<br />
OLD BUSINESS<br />
<br />
NEW BUSINESS<br />
<br />
COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS<br />
<br />
ADJOURNMENT<br />
<br />
<br />
=<nowiki>=</nowiki>=<br />
<br />
==Old Business==<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]<br />
<br />
Committee 2.0 update - https://docs.google.com/document/d/1yw8KQoQ0SVbvP9nRsW52yYGJUuu-qAgi5HlNktBScIo/edit?ts=5bfedf7d<br />
<br />
==New Business==<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]<br />
<br />
Proposed changes to End of Year Projects/Chapter budgets updates:<br />
* The creation of a general fund for all chapters/projects/committees<br />
* Request all chapters/projects/committees to state what any additional funds they need<br />
* The demand is then send to the larger projects/chapters (those with more than $5K in budget) - Request for a budget and any contributions to the general fund<br />
* Chapters can chose specifically which initiatives they want their funds to go to - OR it goes to the central fund for the foundation to provide financing to other chapters/projects/committees.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=October_2018&diff=244130October 20182018-10-10T19:37:31Z<p>Owen Pendlebury: </p>
<hr />
<div><br />
Meeting Date: October 10th, 2018<br />
<br />
Meeting Time: 3:00 to 4:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=10&day=10&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
<br />
Meeting Location: Physical Meeting at AppSec USA 2018 Conference + Virtual <br />
<br />
Address: N/A<br />
<br />
Virtual: https://www3.gotomeeting.com/join/861328838<br />
<br />
[[International_Toll_Free_Calling_Information |International Toll Free Calling Info]]<br />
<br />
AGENDA<br />
<br />
CALL TO ORDER<br />
<br />
CHANGES TO THE AGENDA<br />
<br />
APPROVAL OF MINUTES<br />
[https://docs.google.com/document/d/1768gHS7DxUx39yptFFngebOCwCAHQqsAWZWYEOH3Ea0/edit?usp=sharing Prior meeting minutes - September 27]<br />
REPORTS<br />
<br />
OLD BUSINESS<br />
[https://docs.google.com/document/d/1nb_K0vsCFN2Rc5EgxLBLJnvwkpSWLbKQn7lVV6g9cDA/edit?usp=sharing 2018 Strategic Goals]<br />
NEW BUSINESS<br />
<br />
COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS<br />
<br />
ADJOURNMENT<br />
<br />
<br />
=<nowiki>=</nowiki>=<br />
<br />
==Old Business==<br />
2019 Board Eligibility - https://docs.google.com/document/d/1a_adkVd5xL14Gg-Dwoeyg_bTDA3t8y2puy25AYyVQ8s/edit?usp=sharing Greg<br />
<br />
Compliance Committee Changes - https://docs.google.com/document/d/1OSm7Vu5iuE-Uu-iOTjD7XhEXQqwDN_ZJ7jOOYqoiCzo/edit?usp=sharing Greg<br />
<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]<br />
<br />
==New Business==<br />
Vote to change Treasurer position<br />
<br />
Vote to amend bylaws on face to face meeting requirements<br />
<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=October_2018&diff=244129October 20182018-10-10T18:14:53Z<p>Owen Pendlebury: </p>
<hr />
<div><br />
Meeting Date: October 10th, 2018<br />
<br />
Meeting Time: 3:00 to 4:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=10&day=10&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
<br />
Meeting Location: Physical Meeting at AppSec USA 2018 Conference + Virtual <br />
<br />
Address: N/A<br />
<br />
Virtual: https://www3.gotomeeting.com/join/861328838<br />
<br />
[[International_Toll_Free_Calling_Information |International Toll Free Calling Info]]<br />
<br />
AGENDA<br />
<br />
CALL TO ORDER<br />
<br />
CHANGES TO THE AGENDA<br />
<br />
APPROVAL OF MINUTES<br />
[https://docs.google.com/document/d/1768gHS7DxUx39yptFFngebOCwCAHQqsAWZWYEOH3Ea0/edit?usp=sharing Prior meeting minutes - September 27]<br />
REPORTS<br />
<br />
OLD BUSINESS<br />
[https://docs.google.com/document/d/1nb_K0vsCFN2Rc5EgxLBLJnvwkpSWLbKQn7lVV6g9cDA/edit?usp=sharing 2018 Strategic Goals]<br />
NEW BUSINESS<br />
<br />
COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS<br />
<br />
ADJOURNMENT<br />
<br />
<br />
=<nowiki>=</nowiki>=<br />
<br />
==Old Business==<br />
2019 Board Eligibility - https://docs.google.com/document/d/1a_adkVd5xL14Gg-Dwoeyg_bTDA3t8y2puy25AYyVQ8s/edit?usp=sharing Greg<br />
<br />
Compliance Committee Changes - https://docs.google.com/document/d/1OSm7Vu5iuE-Uu-iOTjD7XhEXQqwDN_ZJ7jOOYqoiCzo/edit?usp=sharing Greg<br />
<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]<br />
<br />
==New Business==<br />
Vote to change Treasurer position<br />
<br />
Vote to amend bylaws on face to face requirements<br />
<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=October_2018&diff=244128October 20182018-10-10T17:40:45Z<p>Owen Pendlebury: /* New Business */</p>
<hr />
<div><br />
Meeting Date: October 10th, 2018<br />
<br />
Meeting Time: 3:00 to 4:30 PM EDT ([https://www.timeanddate.com/worldclock/meetingdetails.html?year=2018&month=10&day=10&hour=19&min=0&sec=0&p1=179&p2=24&p3=16&p4=136&p5=224 time zones])<br />
<br />
Meeting Location: Physical Meeting at AppSec USA 2018 Conference + Virtual <br />
<br />
Address: N/A<br />
<br />
Virtual: https://www3.gotomeeting.com/join/861328838<br />
<br />
[[International_Toll_Free_Calling_Information |International Toll Free Calling Info]]<br />
<br />
AGENDA<br />
<br />
CALL TO ORDER<br />
<br />
CHANGES TO THE AGENDA<br />
<br />
APPROVAL OF MINUTES<br />
[https://docs.google.com/document/d/1768gHS7DxUx39yptFFngebOCwCAHQqsAWZWYEOH3Ea0/edit?usp=sharing Prior meeting minutes - September 27]<br />
REPORTS<br />
<br />
OLD BUSINESS<br />
[https://docs.google.com/document/d/1nb_K0vsCFN2Rc5EgxLBLJnvwkpSWLbKQn7lVV6g9cDA/edit?usp=sharing 2018 Strategic Goals]<br />
NEW BUSINESS<br />
<br />
COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS<br />
<br />
ADJOURNMENT<br />
<br />
<br />
=<nowiki>=</nowiki>=<br />
<br />
==Old Business==<br />
2019 Board Eligibility - https://docs.google.com/document/d/1a_adkVd5xL14Gg-Dwoeyg_bTDA3t8y2puy25AYyVQ8s/edit?usp=sharing Greg<br />
<br />
Compliance Committee Changes - https://docs.google.com/document/d/1OSm7Vu5iuE-Uu-iOTjD7XhEXQqwDN_ZJ7jOOYqoiCzo/edit?usp=sharing Greg<br />
<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]<br />
<br />
==New Business==<br />
Vote to change Treasurer position<br />
<br />
All active board proposals are listed [https://drive.google.com/folderview?id=0BxSfMVkfLvslVXdvUFV3NkxucWc&usp=sharing here]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Board&diff=236723Board2018-01-09T18:20:58Z<p>Owen Pendlebury: Updating the link to my profile</p>
<hr />
<div>__NOTOC__<br />
<br />
= Board Meetings =<br />
[https://www.owasp.org/index.php/About_OWASP#OWASP_Foundation_Bylaws Bylaws] are the most important legal document of any organization. Bylaws outline in writing the day-to-day rules for your organization and provide comprehensive guidelines to keep things running smoothly. If you want to understand the business of OWASP Foundation the best way to do that would be to examine the bylaws the the [https://www.owasp.org/index.php/About_OWASP#Form_990_Documents 990 forms filed with the United States Government as a non-profit annually.]<br />
<br />
[https://www.owasp.org/index.php/About_OWASP#OWASP_Foundation_Bylaws Global Bylaws]<br />
<br />
== Upcoming 2018 Meetings == '''PENDING'''<br />
<br />
<br />
All board meeting notes that include actions as a result will be tracked in a single document for all meetings [https://docs.google.com/a/owasp.org/document/d/1aPmftVZH3-G96J6-wrpynwwZhBHtREe5a7g8owVYUag/edit?usp=sharing click here]<br />
<br />
==2018 Elected by Membership, Global Board Members - '''BOARD POSITIONS TO FOLLOW''' == <br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Member, Meeting Attendance Tracking]<br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_History Historical Board Members by Year]<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[User:Knoblochmartin | Martin Knobloch]]: ====<br />
<br><br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
====[[User:Matt_Konda | Matt Konda]]====<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[User:vanderaj |Andrew van der Stock]]: ====<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== [[Chenxi_Wang,_Ph.D._(Forrester_Research) | Chenxi Wang, Ph.D.]]: ====<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
<br />
==== [https://www.owasp.org/index.php?title=User:Owen_Pendlebury Owen Pendlebury]:====<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
====[[Sherif Mansour ]]: ====<br />
<br><br />
<br><br />
<br><br />
[[Image:Owasp_logo_icon.jpg|120 px|left]]<br />
<br><br />
==== Greg Anderson: ====<br />
<br><br />
<br><br />
<br><br />
<br />
= How Meetings Operate =<br />
'''CALL TO ORDER'''<br />
<br />
The first order of business is for the chair to announce the call to order, along with the time. The secretary enters the time of the call to order in the minutes. After the meeting is called to order, the board chair may make welcoming remarks, ask for introductions, or read the organization’s mission and vision statements.<br />
<br />
'''CHANGES TO THE AGENDA'''<br />
<br />
The second order of business is for the chair to ask for changes to the agenda. Additions and deletions to the agenda will be made at this time. Having no changes, the agenda moves to approving the prior meeting’s minutes.<br />
<br />
<br />
'''APPROVAL OF MINUTES'''<br />
<br />
The third item on the agenda should list “Approval of Minutes” along with the date of the most recent meeting. In most cases, board members should have received a copy of the minutes prior to the meeting. If they have not contacted the secretary prior to the meeting with corrections or changes to the minutes, they have to opportunity to make them during this item on the agenda.<br />
<br />
Board members have an ethical and legal responsibility to make sure that the recording of the minutes accurately reflect the board’s business.<br />
<br />
'''REPORTS'''<br />
<br />
The fourth item on the agenda is the reports. This first report should be a report from the Executive Director. This report should include a review of operations and projects. The Executive Director should give board members on overview of the business outlook including positive and negative trends, major initiatives, business updates, and other aspects of the business.<br />
<br />
Following the Executive Director report, the Finance Director gives a report. Board members should make an effort to understand the financial reports so that they can identify potential financial threats. Understanding financial reports may also generate discussion about potential opportunities.<br />
<br />
Subsequent reports may be given by committee chairs.<br />
<br />
'''OLD BUSINESS'''<br />
<br />
Items should include past business items that are unresolved, need further discussion, or require a board vote. Items may be tabled or referred to committee for further exploration.<br />
<br />
'''NEW BUSINESS'''<br />
<br />
Board members should have a discussion about new business items and identify a plan to take action. This may include tabling them, delaying action to a future date, or referring them to a committee.<br />
<br />
'''COMMENTS, ANNOUNCEMENTS, AND OTHER BUSINESS'''<br />
<br />
At this point in the agenda, members may make announcements, such as offering congratulations or condolences, or make other special announcements. Any other business may be brought up at this time, for example, items that may need to be added to the next meeting’s agenda.<br />
<br />
'''ADJOURNMENT'''<br />
<br />
This is a formal closing of the meeting by the board chair. He should state the time that the meeting closed, so that the secretary may including it in the board minutes. The date of the next meeting should follow the adjournment item, so that board members will be reminded to put it on their calendars.<br />
<br />
For more information about the Roberts Rules of Order see this [http://www.umecra.com/BylawsAndRules/Roberts%20Rules%20Handout.pdf CHEAT SHEET]<br />
<br />
= Voting History =<br />
<br />
=== Historical Votes on Motions ===<br />
The purpose of this is to track the position on each motion as presented and how the elected official voted on the motion. This is useful for the membership to review how elected officials voted on items that effect the organization and its [https://www.owasp.org/index.php/OWASP_Foundation_ByLaws bylaws]. A motion is a request for action (budget requests, policy changes, new partnerships etc.) they can be presented by ANYONE to the board such as a member of the public, a member of the OWASP Foundation but does require a sponsor on the Board. That sponsor will present the motion to the board at least (10) working days in advance so it can be read in advance of the meeting. If appropriate a motion can be presented based to take action on the motion as written. For a vote to be called and action to be taken a second board member is required to carry the business to vote. On completion of the discussion the chairman will call for a vote to the motion YES, NO, ABSTAIN. For more details on this process try this [http://www.umecra.com/BylawsAndRules/Roberts%20Rules%20Handout.pdf CHEAT SHEET]<br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_Votes Historical Board Votes]<br />
<br />
Note that if a motion is presented and is voted on and it is approved action will be taken to implement the motion. If the motion fails it can be resubmitted and the process starts again as if it is a new motion.<br />
<br />
=== Attendance Tracker===<br />
This is used to keep track that Board Members meet 75% attendance requirements as noted in section 3.03 of the organization bylaws. A meeting is logged as attended if the board member attends the entire meeting as scheduled from the call to order until it is adjourned, this includes executive session if applicable that is closed to the membership and general public for reasons related to human resources and legal issues that require it by law or for the good of the OWASP Foundation Inc. - <br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Meeting Attendance Tracker]<br />
<br />
= Historical Meeting Archive =<br />
<br />
== Archive 2017 ==<br />
<br />
<br />
* [[December 6, 2017]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=12&day=06&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[November 8, 2017]], 07:00-08:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=11&day=8&hour=15&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[October 11, 2017]], 15:00 - 17:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=10&day=11&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[September 19, 2017]] 15:00-17:30 PDT, in Orlando at AppSecUSA - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=9&day=19&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[September 6, 2017]] 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=09&day=06&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] (Cancelled for interviews)<br />
*[[August 9, 2017]], 16:00-17:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=08&day=09&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[July 5, 2017]], 07:00-08:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=07&day=05&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[June 7, 2017]], 18:00-21:00 CEST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=06&day=07&hour=16&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[May 9, 2017]], 18:00-19:30 IST, in Belfast at AppSecEU - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=5&day=9&hour=17&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
*[[April 12, 2017]], 16:00-17:00 PDT - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=04&day=12&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] ('''Cancelled''' [http://lists.owasp.org/pipermail/owasp-board/2017-April/017969.html Notice by Matt Konda])<br />
*[[March 22, 2017]] 06:00-07:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=3&day=22&hour=13&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter] - *Special Meeting to approve the 2017 Budget*<br />
* [[March 8, 2017]], 06:00-07:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=03&day=08&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[February 8, 2017]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=02&day=08&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[January 11, 2017]], 14:00-15:30 PST - [https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=1&day=10&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
<br />
== Archive for 2016 Meetings ==<br />
* [[December 14, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=12&day=14&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[November 8, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=11&day=09&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* CANCELLED - [[November 30, 2016]], 15:00-16:30 PST - placeholder only optional if needed - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=11&day=30&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[October 11, 2016]], at AppSecUSA 18:00 - 21:00 EDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=10&day=11&hour=22&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[September 21, 2016]] 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=09&day=21&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[August 23, 2016]], 16:00-17:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=08&day=23&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[July 1, 2016]], 18:00-21:00 CEST, in Rome at AppSecEU - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=07&day=01&hour=16&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[July 27, 2016]], 07:00-08:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=07&day=27&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[May 18, 2016]], 07:00-08:30 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=05&day=18&hour=14&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[April 20, 2016]], 16:00-17:00 PDT - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=04&day=20&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[March 16, 2016]], 16:00-17:00 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=03&day=16&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[February 17, 2016]], 15:00-16:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=02&day=17&hour=23&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
* [[January 13, 2016]], 16:00-17:30 PST - [http://www.timeanddate.com/worldclock/meetingdetails.html?year=2016&month=01&day=14&hour=00&min=0&sec=0&p1=224&p2=24&p3=263&p4=78&p5=37&p6=102&p7=152 TimeZone Converter]<br />
<br />
== Archive for 2015 Meetings ==<br />
* [[December 9, 2015]], 15:00-17:00 PST <br />
* [[November 18, 2015]], 14:00-15:30 PST<br />
* [[November 4, 2015]], 12:00-13:30 PST<br />
* [[October 14, 2015]], 14:00-15:00 PDT<br />
* [[September 25, 2015]] at AppSecUSA 18:00 - 20:00 PST<br />
* [[August 12, 2015]], 16:00-17:00 PST<br />
* [[July 22, 2015]], 14:00-15:00 PDT<br />
* [[June 24, 2015]], 14:00-15:00 PDT<br />
* [[May 22, 2015]], 18:00-20:00 CEST in Amsterdam @ AppSec-EU , 9:00am-11:00am PST;<br />
* [[April 29, 2015]], 12:00-13:00 PST<br />
* [[March 25, 2015]], 12:00-13:00 PST <br />
* [[February 11, 2015]], 16:00-17:00 PST<br />
* [[January 14, 2015]], 9am-10am PST<br />
<br />
<br />
== Archive for 2014 Meetings ==<br />
* [[December 10, 2014]], 9am-10am PST<br />
* [[November 12, 2014]], 9am - 10am PST<br />
* [[October 8, 2014]], 9am-10am PST<br />
* [[September 16, 2014]], 6pm - 9pm MST, In person at Appsec USA <br />
* [[August 13, 2014]], 9am-10am PST<br />
* [[July 9, 2014]], 9am-10am PST<br />
* [[June 27, 2014]], 8am - 4 pm BST, In person at AppSec Europe<br />
* [[April 30, 2014]],9am - 12pm PST<br />
* [[March 3, 2014]], 7am - 10am PST<br />
* [[February 24, 2014]], 8am - 10am PST<br />
<br />
== Archive for 2013 Meetings ==<br />
<br />
*[[December 9, 2013]]<br />
<br />
* December 2, 2013 - Special Board Meeting - [https://docs.google.com/spreadsheet/ccc?key=0ApZ9zE0hx0LNdGdJZ1BIaEZkc2V1QV81NmJ4dnI0R1E&usp=sharing 2014 Budget] walk through, Q & A (no meeting notes)<br />
<br />
*[[November 22, 2013]] - In person meeting at AppSec USA - New York, NY<br />
<br />
* November 11, 2013 - cancelled due to in person meeting on Nov. 22<br />
<br />
*[[October 14, 2013]]<br />
<br />
*[[September 9, 2013]]<br />
<br />
*[[In person meeting at AppSec EU - Hamburg, Germany; August 19-24]]<br />
<br />
* August 12, 2013 - canceled due to in person meeting on Aug 19<br />
<br />
*[[July 8, 2013]]<br />
<br />
*[[June 10, 2013]]<br />
<br />
*[[May 31, 2013]]<br />
<br />
*[[May 13, 2013]]<br />
<br />
*[[April 8, 2013]]<br />
<br />
*[[March 11, 2013]]<br />
<br />
*[[February 11, 2013]]<br />
<br />
*[[January 14, 2013]]<br />
<br />
== Archive for 2012 Meetings ==<br />
<br />
[https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0ApZ9zE0hx0LNdG5uRzNYZE8ycDFabnBWNkU4SFpwREE Board Meeting Attendance Tracking]<br />
<br />
OWASP Foundation [https://www.owasp.org/images/a/ae/2012ByLawsFINAL.pdf ByLaws]<br />
<br />
[https://www.owasp.org/index.php/Global_Committee_Pages Global Committees] <br />
<br />
*[[January 9, 2012]]<br />
<br />
*[[February 6, 2012]]<br />
<br />
*[[February 15, 2012]] <br />
<br />
*[[March 12, 2012]]<br />
<br />
*[[April 5, 2012]]<br />
<br />
*[[May 14,2012]]<br />
<br />
*[[June 11, 2012]]<br />
<br />
*[[July 11, 2012]]<br />
<br />
*[[Aug 13, 2012]]<br />
<br />
*[[Sept 10, 2012]]<br />
<br />
*[[Oct 8, 2012]]<br />
<br />
*[[Oct 24, 2012]]<br />
<br />
*[[Nov 12, 2012]]<br />
<br />
*[[Nov 26, 2012]] - 2013 Budget Focused<br />
<br />
*[[Dec 10, 2012]]<br />
<br />
*[[Dec 27, 2012]] - 2013 Budget Focused<br />
<br />
== Archive for 2011 Meetings ==<br />
<br />
*[[January 3, 2011]]<br />
<br />
*[[March 7, 2011]]<br />
<br />
*[[April_4_2011]]<br />
<br />
*[[May_2_2011]]<br />
<br />
*[[June 6, 2011]]<br />
<br />
*[[July 11, 2011]]<br />
<br />
*[[August 8, 2011]] <br />
<br />
*[[September 6, 2011]]<br />
<br />
*[[September 20, 2011]]<br />
<br />
*[[September 22, 2011]]<br />
<br />
*[[October 10, 2011]]<br />
<br />
*[[November 14, 2011]]<br />
<br />
*[[December 5, 2011]]<br />
<br />
== Minutes for 2011 Meetings == <br />
<br />
<hr /><br />
<br />
* [https://www.owasp.org/index.php/OWASP_Board_Votes Board Votes Historical]<br />
<br />
<hr /><br />
<br />
*[[Minutes January 3, 2011]]<br />
<br />
*[[Minutes March 8, 2011]]<br />
<br />
*[[Minutes April 4, 2011]]<br />
<br />
*[[Minutes May 2, 2011]]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1VD9ZHEwht9tmM8FKEQ6DBrtmL_gTAhSSnQhiFXYkJ7I/edit?hl=en_US&authkey=CIavkP4B June 6 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1VMwYrP6owtZ-SchBxUcWTIF-ITvzUX8PjUkLPwr2ipg/edit?hl=en_US&authkey=CIGTx5sD July 11 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1CLu9aQpS7LdeX87rJ5N9cuJ-RGGVzDWf34l6gdMml7M/edit?hl=en_US&authkey=CI-U5qEP August 8, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1HM32VcvWb0hizD5_mhWMULLaouzuRgA3ZYjODRZwyAs/edit?hl=en_US September 6, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/1Y-8tZisUZM5ZKP8AxJqvkiNtFanVFM0m--bMG2PZ3ww/edit October 10, 2011]<br />
<br />
*[https://docs.google.com/a/owasp.org/document/d/13-aHX2pSUXjCP8ivsbls6u1VX1BVSYewyMUH8LI7zpQ/edit November 14, 2011]<br />
<br />
== Archive for 2010 Meetings ==<br />
*[[January 5, 2010]]<br />
<br />
*[[February 2, 2010]]<br />
<br />
*[[March 2, 2010]] <span style="color:blue">Postponed until March 9, 2010</span> <br />
<br />
*[[April 6, 2010]]<br />
<br />
*[[May 4, 2010]]<br />
<br />
*[[June 7, 2010]]<br />
<br />
*[[July 12, 2010]]<br />
<br />
*[[August 2, 2010]]<br />
<br />
*[[September 8, 2010]]<br />
<br />
*[[October 11, 2010]]<br />
<br />
*[[November 9, 2010]]<br />
<br />
*[[December_6_2010]]<br />
<br />
== Archive of 2010 Meetings ==<br />
<br />
*[[Jan 5, 2010]]<br />
<br />
*[[Feb 2, 2010]]<br />
<br />
*[[March 2, 2010]]<br />
<br />
*[[Minutes April 6, 2010]]<br />
<br />
*[[Minutes May 11, 2010]]<br />
<br />
*[[Minutes June 7, 2010]]<br />
<br />
*[[Minutes July 12, 2010]]<br />
<br />
*[[Minutes October 11, 2010]]<br />
<br />
*[[Minutes November 9, 2010]]<br />
<br />
*[[Minutes_December_6,_2010]]<br />
<br />
*[[OWASP Board Meetings January Agenda]]<br />
*[[OWASP Board Meetings February Agenda]]<br />
*[[OWASP Board Meetings March Agenda]]<br />
*[[OWASP Board Meetings April09 Agenda]]<br />
*[[OWASP Board Meetings May09 Agenda]]<br />
*[[OWASP Board Meetings June 09 Agenda]]<br />
*[[OWASP Board Meeting July 7, 2009 Agenda]]<br />
*[[OWASP Board Meeting August 4, 2009 Agenda]]<br />
*[[OWASP Board Meeting September 1, 2009 Agenda]] <br />
*[[OWASP Board Meeting October 6, 2009 Agenda]]<br />
*[[OWASP Board Meeting November 10, 2009 Agenda]]<br />
*[[OWASP Board Meeting December 1, 2009 Agenda]]<br />
<br />
== Archive of 2009 Meetings ==<br />
* [[OWASP Board Meetings 01-06-09]]<br />
* [[OWASP Board Meetings 02-03-09]]<br />
* [[OWASP Board Meetings 03-10-09]]<br />
* [[OWASP Board Meetings April 09]]<br />
* [[OWASP Board Meetings May 09]]<br />
* [[OWASP Board Meetings June 09]]<br />
* [[OWASP Board Meeting July 09]]<br />
* [[OWASP Board Meeting August 09]]<br />
* [[OWASP Board Meeting September 09]]<br />
* [[OWASP Board Meeting October 09]]<br />
* [[OWASP Board Meeting December 09]]<br />
<br />
== Archive for 2008 Meetings ==<br />
*[[OWASP Board Meetings March Agenda]]<br />
*[[OWASP Board Meetings April Agenda]]<br />
*[[OWASP Board Meetings May Agenda]]<br />
*[[OWASP Board Meetings June Agenda]]<br />
*[[OWASP Board Meetings July Agenda]]<br />
*[[OWASP Board Meetings August Agenda]]<br />
*[[OWASP Board Meetings September Agenda]]<br />
*[[OWASP Board Meetings October Agenda]]<br />
*[[OWASP Board Meetings December Agenda]]<br />
<br />
== Archive of 2008 Meetings ==<br />
* [[OWASP Board Meetings 2-7-08]]<br />
* [[OWASP Board Meetings 3-6-08]]<br />
* [[OWASP Board Meetings 5-6-08]]<br />
* [[OWASP Board Meetings 6-3-08]]<br />
* [[OWASP Board Meetings 8-14-08]]<br />
* [[OWASP Board Meetings 9-2-08]] <br />
* [[Owasp Board Meetings 10-07-08]]<br />
* [[Owasp Board Meetings 11-07-08]]<br />
* [[Owasp Board Meetings 12-02-08]]<br />
<br />
= Board Election Archive =<br />
<br />
All elected officers are required to [https://docs.google.com/document/d/10zBT6oY2Q3B6kr6r7DGl3Cc0f5rGmQ0Slc6RYvbxmus/edit review sign and return] the following document before starting their term in office to the then current board Secretary <br />
<br />
[https://www.owasp.org/index.php/OWASP_Board_History OWASP Board History]<br />
<br />
===2017 Election===<br />
[https://www.owasp.org/index.php/2017_Global_Board_of_Directors_Election 2017 Board Election]<br />
=== 2016 Election ===<br />
[https://www.owasp.org/index.php/2016_Global_Board_of_Directors_Election 2016 Board Election]<br />
=== 2015 Election ===<br />
[https://www.owasp.org/index.php/2015_Global_Board_of_Directors_Election 2015 Board Election]<br />
=== 2014 Election ===<br />
[https://www.owasp.org/index.php/2014_Board_Elections 2014 Board Election]<br />
=== 2013 Election ===<br />
[https://www.owasp.org/index.php/2013_Board_Elections 2013 Board Election]<br />
=== 2012 Election ===<br />
[https://www.owasp.org/index.php/Membership/2012_Election 2012 Board Election]<br />
=== 2011 Election ===<br />
[https://www.owasp.org/index.php/Membership/2011Election 2011 Board Election]<br />
=== 2009 Election ===<br />
[https://www.owasp.org/index.php/Board_Election_2009 2009 Board Election]<br />
<br />
=== Past OWASP Boards ===<br />
<br />
[[Board-2018]]<br />
<br />
[[Board-2017]]<br />
<br />
[[Board-2016]]<br />
<br />
[[Board-2015]]<br />
<br />
[[Board-2014]]<br />
<br />
[[Board-2013]]<br />
<br />
[[Board-2012]]<br />
<br />
[[Board-2011]]<br />
<br />
= Misc. =<br />
<br />
* Teleconference Information: **CHECK MEETING INFORMATION**<br />
<br />
* [https://www.owasp.org/index.php/International_Toll_Free_Calling_Information International Toll Free Calling Info]<br />
<br />
* Meeting Template found [https://www.owasp.org/index.php/Board-Meeting-template here]<br />
<br />
<headertabs></headertabs></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Owen_Pendlebury_2017_Bio_%26_Why_Me%3F&diff=232112Owen Pendlebury 2017 Bio & Why Me?2017-08-09T10:38:18Z<p>Owen Pendlebury: updated a small bit</p>
<hr />
<div>Owen Pendlebury<br />
<br />
'''About Owen:'''<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 7 years. Furthermore, Owen has been heavily involved in the OWASP Women in AppSec committee mentoring within the community. Some of the projects that Owen has been involved in include, AppSec EU 2016 Committee/ Training Committee, AppSec EU 2017 co-organisor/ training chair, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars and numerous security workshops. In 2016 Owen received a WASPY award for his contributions to OWASP and the community.<br />
<br />
Owen has over 7 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently penetration testing lead for Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
<br />
'''Why Me?'''<br />
I am extremely passionate about OWASP and the community. My main goal is to improve Europe’s/ global security capabilities and I feel I achieve this with a real can-do attitude. I would use my position on the board to ensure that Europe has an equal say and are aligned with OWASPs strategic goals. I would relish the opportunity to get involved at a global level.<br />
<br />
The main areas in which I feel I can aid in improving within OWASP globally are;<br />
<br />
Projects – focus on projects new, immature and mature aiding these projects to progress to flagship OWASP projects. I feel that there are a number of key projects that have been left in incubator status for way too long. We need work with these projects in order for OWASP to grow. Existing projects need to be encouraged to grow.<br />
<br />
Governance – Enable chapters and new OWASP members to flourish without the shadow of big names. OWASP is about the community and we need to focus on the community. Chapters need to be empowered to grow. We need to be transparent in all our actions.<br />
<br />
Education – I feel that OWASP can reach further in the community. Not only to security professionals but to students. Students both in college and at high school levels should be empowered to join OWASP and learn from our community. We should stimulate enough interest at Community level to cause student volunteers to engage & participate.<br />
<br />
Build relationships with industry, government, and educational institutions<br />
<br />
Support the overall OWASP community and its various activities<br />
<br />
Increasing the awareness of OWASP outside the security community</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=OWASP_Internet_of_Things_Project&diff=231856OWASP Internet of Things Project2017-07-26T10:00:52Z<p>Owen Pendlebury: /* Related Projects */ fixing typo</p>
<hr />
<div>= Main =<br />
<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
==OWASP Internet of Things (IoT) Project==<br />
<br />
Oxford defines the Internet of Things as: “A proposed development of the Internet in which everyday objects have network connectivity, allowing them to send and receive data.”<br />
<br />
''The OWASP Internet of Things Project is designed to help manufacturers, developers, and consumers better understand the security issues associated with the Internet of Things, and to enable users in any context to make better security decisions when building, deploying, or assessing IoT technologies''. <br />
<br />
The project looks to define a structure for various IoT sub-projects such as Attack Surface Areas, Testing Guides and Top Vulnerabilities.<br />
<br />
[[File:iot-project.png|400px|thumb|center]]<br />
<br />
==Licensing==<br />
The OWASP Internet of Things Project is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.<br />
<br />
{{Social Media Links}}<br />
<br />
| style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== What is the OWASP Internet of Things Project? ==<br />
<br />
The OWASP Internet of Things Project provides information on:<br />
<br />
* [https://www.owasp.org/index.php/IoT_Attack_Surface_Areas IoT Attack Surface Areas]<br />
* IoT Vulnerabilities<br />
* Firmware Analysis<br />
* ICS/SCADA Software Weaknesses<br />
* Community Information<br />
* [https://www.owasp.org/index.php/IoT_Testing_Guides IoT Testing Guides]<br />
* [https://www.owasp.org/index.php/IoT_Security_Guidance IoT Security Guidance]<br />
* [https://www.owasp.org/index.php/Principles_of_IoT_Security Principles of IoT Security]<br />
* [https://www.owasp.org/index.php/IoT_Framework_Assessment IoT Framework Assessment]<br />
* Developer, Consumer and Manufacturer Guidance<br />
* Design Principles<br />
<br />
== Project Leaders ==<br />
<br />
* Daniel Miessler<br />
* Craig Smith<br />
<br />
== Contributors ==<br />
* [https://www.owasp.org/index.php/User:Justin_C._Klein_Keane Justin Klein Keane]<br />
* Saša Zdjelar<br />
<br />
== Related Projects ==<br />
<br />
* [[OWASP_Project|OWASP Project Repository]]<br />
* [[OWASP_Mobile_Security_Project|OWASP Mobile Security]]<br />
* [[OWASP_Top_Ten_Project|OWASP Web Top 10]]<br />
* [[OWASP_.NET_Project|OWASP .NET]]<br />
* [[Java|OWASP Java and JVM]]<br />
* [[C/C++|OWASP C/C++]]<br />
<br />
| style="padding-left:25px;width:200px;" valign="top" |<br />
<br />
== Collaboration ==<br />
[https://owasp-iot-security.slack.com The Slack Channel]<br />
<br />
Hint: If you're new to Slack, [https://lists.owasp.org/pipermail/owasp-community/2015-July/000703.html join OWASP's slack channel first], then join #iot-security within OWASP's channel.<br />
<!-- Hey Guys - Andy Lewis here. I'm not great w/slack but when I browse to https://owasp-iot-security.slack.com/signup<br />
I'm getting "This team's administrator has not enabled email signups." and "Ask your administrator to send you an invitation."<br />
I'm adding this comment in hopes of being able to get in contact w/someone from the project after Blackhat/Defcon.<br />
If you're reading this, could you please reach out to me <br />
alewis@owasp.org<br />
or open up the slack channel to auto-OK @owasp.org addresses?<br />
Thanks<br />
Andy<br />
--><br />
<br />
== Quick Download ==<br />
[https://www.owasp.org/images/3/36/IoTTestingMethodology.pdf IoT Attack Surface Mapping DEFCON 23]<br />
<br />
[https://www.owasp.org/images/2/2d/Iot_testing_methodology.JPG IoT Testing Guidance Handout]<br />
<br />
[https://www.owasp.org/images/7/71/Internet_of_Things_Top_Ten_2014-OWASP.pdf OWASP IoT Top Ten PDF]<br />
<br />
[https://www.owasp.org/images/8/8e/Infographic-v1.jpg OWASP IoT Top Ten Infographic]<br />
<br />
[https://www.owasp.org/images/0/01/Internet_of_Things_Top_Ten_2014-OWASP-ppt.pptx OWASP IoT Top Ten PPT]<br />
<br />
[https://www.owasp.org/images/5/51/RSAC2015-OWASP-IoT-Miessler.pdf OWASP IoT Top Ten-RSA 2015]<br />
<br />
[https://www.owasp.org/images/b/bd/OWASP-IoT.pptx OWASP IoT Project Overview]<br />
<br />
== News and Events ==<br />
* Added a [https://owasp-iot-security.slack.com/ Slack channel]<br />
* Added a sub-project; [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Security_Policy_Project IoT Security Policy Project]<br />
* Daniel Miessler gave his [https://www.youtube.com/watch?v=RhxHHD790nw IoT talk at DEFCON 23]<br />
* Migrating the IoT Top Ten to be under the IoT Project<br />
* HP Study Reveals 70 Percent of Internet of Things Devices Vulnerable to Attack<br />
<br />
==Classifications==<br />
<br />
{| width="200" cellpadding="2"<br />
|-<br />
| rowspan="2" width="50%" valign="top" align="center" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]<br />
| width="50%" valign="top" align="center" | [[File:Owasp-builders-small.png|link=]] <br />
|-<br />
| width="50%" valign="top" align="center" | [[File:Owasp-defenders-small.png|link=]]<br />
|-<br />
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]<br />
|-<br />
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]<br />
|}<br />
<br />
|}<br />
<br />
= IoT Attack Surface Areas =<br />
<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== IoT Attack Surface Areas Project ==<br />
<br />
The OWASP IoT Attack Surface Areas (DRAFT) are as follows:<br />
<br />
{| class="wikitable" style="text-align: left" border="1"<br />
! Attack Surface<br />
! Vulnerability<br />
|- <br />
| '''Ecosystem (general)'''<br />
|<br />
* Interoperability standards<br />
* Data governance<br />
* System wide failure<br />
* Individual stakeholder risks<br />
* Implicit trust between components<br />
* Enrollment security<br />
* Decommissioning system<br />
* Lost access procedures<br />
|- <br />
| '''Device Memory'''<br />
|<br />
* Sensitive data<br />
** Cleartext usernames<br />
** Cleartext passwords<br />
** Third-party credentials<br />
** Encryption keys<br />
|- <br />
| '''Device Physical Interfaces'''<br />
|<br />
* Firmware extraction<br />
* User CLI<br />
* Admin CLI<br />
* Privilege escalation<br />
* Reset to insecure state<br />
* Removal of storage media<br />
* Tamper resistance<br />
* Debug port<br />
** UART (Serial)<br />
** JTAG / SWD<br />
* Device ID/Serial number exposure<br />
|-<br />
| '''Device Web Interface'''<br />
|<br />
* Standard set of web application vulnerabilities, see:<br />
** [[:Category:OWASP Top Ten Project|OWASP Web Top 10]]<br />
** [[:Category:OWASP Application Security Verification Standard Project|OWASP ASVS]]<br />
** [[:Category:OWASP Testing Project|OWASP Testing guide]]<br />
* Credential management vulnerabilities:<br />
** Username enumeration<br />
** Weak passwords<br />
** Account lockout<br />
** Known default credentials<br />
** Insecure password recovery mechanism<br />
|- <br />
| '''Device Firmware'''<br />
|<br />
* Sensitive data exposure ([[Top 10 2013-A6-Sensitive Data Exposure|See OWASP Top 10 - A6 Sensitive data exposure]]):<br />
** Backdoor accounts<br />
** Hardcoded credentials<br />
** Encryption keys<br />
** Encryption (Symmetric, Asymmetric)<br />
** Sensitive information<br />
** Sensitive URL disclosure<br />
* Firmware version display and/or last update date<br />
* Vulnerable services (web, ssh, tftp, etc.)<br />
** Verify for old sw versions and possible attacks (Heartbleed, Shellshock, old PHP versions etc)<br />
* Security related function API exposure<br />
* Firmware downgrade possibility<br />
|- <br />
| '''Device Network Services'''<br />
|<br />
* Information disclosure<br />
* User CLI<br />
* Administrative CLI<br />
* Injection<br />
* Denial of Service<br />
* Unencrypted Services<br />
* Poorly implemented encryption<br />
* Test/Development Services<br />
* Buffer Overflow<br />
* UPnP<br />
* Vulnerable UDP Services<br />
* DoS<br />
* Device Firmware OTA update block<br />
* Firmware loaded over insecure channel (no TLS)<br />
* Replay attack<br />
* Lack of payload verification<br />
* Lack of message integrity check<br />
* Credential management vulnerabilities:<br />
** Username enumeration<br />
** Weak passwords<br />
** Account lockout<br />
** Known default credentials<br />
** Insecure password recovery mechanism<br />
|- <br />
| '''Administrative Interface'''<br />
|<br />
* Standard set of web application vulnerabilities, see:<br />
** [[:Category:OWASP Top Ten Project|OWASP Web Top 10]]<br />
** [[:Category:OWASP Application Security Verification Standard Project|OWASP ASVS]]<br />
** [[:Category:OWASP Testing Project|OWASP Testing guide]]<br />
* Credential management vulnerabilities:<br />
** Username enumeration<br />
** Weak passwords<br />
** Account lockout<br />
** Known default credentials<br />
** Insecure password recovery mechanism<br />
* Security/encryption options<br />
* Logging options<br />
* Two-factor authentication<br />
* Check for insecure direct object references<br />
* Inability to wipe device<br />
|- <br />
| '''Local Data Storage'''<br />
|<br />
* Unencrypted data<br />
* Data encrypted with discovered keys<br />
* Lack of data integrity checks<br />
* Use of static same enc/dec key<br />
|- <br />
| '''Cloud Web Interface'''<br />
|<br />
<br />
* Standard set of web application vulnerabilities, see:<br />
** [[:Category:OWASP Top Ten Project|OWASP Web Top 10]]<br />
** [[:Category:OWASP Application Security Verification Standard Project|OWASP ASVS]]<br />
** [[:Category:OWASP Testing Project|OWASP Testing guide]]<br />
* Credential management vulnerabilities:<br />
** Username enumeration<br />
** Weak passwords<br />
** Account lockout<br />
** Known default credentials<br />
** Insecure password recovery mechanism<br />
* Transport encryption<br />
* Two-factor authentication<br />
|- <br />
| '''Third-party Backend APIs'''<br />
|<br />
* Unencrypted PII sent<br />
* Encrypted PII sent<br />
* Device information leaked<br />
* Location leaked<br />
|- <br />
| '''Update Mechanism'''<br />
|<br />
* Update sent without encryption<br />
* Updates not signed<br />
* Update location writable<br />
* Update verification<br />
* Update authentication<br />
* Malicious update<br />
* Missing update mechanism<br />
* No manual update mechanism<br />
|- <br />
| '''Mobile Application'''<br />
|<br />
* Implicitly trusted by device or cloud<br />
* Username enumeration<br />
* Account lockout<br />
* Known default credentials<br />
* Weak passwords<br />
* Insecure data storage<br />
* Transport encryption<br />
* Insecure password recovery mechanism<br />
* Two-factor authentication<br />
|- <br />
| '''Vendor Backend APIs'''<br />
|<br />
* Inherent trust of cloud or mobile application<br />
* Weak authentication<br />
* Weak access controls<br />
* Injection attacks<br />
* Hidden services<br />
|- <br />
| '''Ecosystem Communication'''<br />
|<br />
* Health checks<br />
* Heartbeats<br />
* Ecosystem commands<br />
* Deprovisioning<br />
* Pushing updates<br />
|- <br />
| '''Network Traffic'''<br />
|<br />
* LAN<br />
* LAN to Internet<br />
* Short range<br />
* Non-standard<br />
* Wireless (WiFi, Z-wave, XBee, Zigbee, Bluetooth, LoRA)<br />
* Protocol fuzzing<br />
|- <br />
| '''Authentication/Authorization'''<br />
|<br />
* Authentication/Authorization related values (session key, token, cookie, etc.) disclosure<br />
* Reusing of session key, token, etc.<br />
* Device to device authentication<br />
* Device to mobile Application authentication<br />
* Device to cloud system authentication<br />
* Mobile application to cloud system authentication<br />
* Web application to cloud system authentication<br />
* Lack of dynamic authentication<br />
|-<br />
| '''Privacy'''<br />
|<br />
* User data disclosure<br />
* User/device location disclosure<br />
* Differential privacy<br />
|-<br />
| '''Hardware (Sensors)'''<br />
|<br />
* Sensing Environment Manipulation<br />
* Tampering (Physically)<br />
* Damage (Physicall)<br />
<br />
|-<br />
|}<br />
<br />
{{Social Media Links}}<br />
<br />
| style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== What is the IoT Attack Surface Areas Project? ==<br />
<br />
The IoT Attack Surface Areas Project provides a list of attack surfaces that should be understood by manufacturers, developers, security researchers, and those looking to deploy or implement IoT technologies within their organizations.<br />
<br />
== Project Leaders ==<br />
<br />
* Daniel Miessler<br />
* Craig Smith<br />
<br />
== Related Projects ==<br />
<br />
* [https://www.owasp.org/index.php/OWASP_Mobile_Security_Project The OWASP Mobile Top 10 Project]<br />
* [https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project The OWASP Web Top 10 Project]<br />
<br />
== Collaboration ==<br />
[https://owasp-iot-security.slack.com The Slack Channel]<br />
<br />
== Quick Download ==<br />
* Coming Soon<br />
<br />
== News and Events ==<br />
* Coming Soon<br />
<br />
|}<br />
<br />
= IoT Vulnerabilities =<br />
<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== IoT Vulnerabilities Project ==<br />
<br />
{| class="wikitable" style="text-align: left" border="1"<br />
! Vulnerability<br />
! Attack Surface<br />
! Summary<br />
|-<br />
| '''Username Enumeration'''<br />
|<br />
* Administrative Interface<br />
* Device Web Interface<br />
* Cloud Interface<br />
* Mobile Application<br />
|<br />
* Ability to collect a set of valid usernames by interacting with the authentication mechanism<br />
|-<br />
| '''Weak Passwords'''<br />
|<br />
* Administrative Interface<br />
* Device Web Interface<br />
* Cloud Interface<br />
* Mobile Application<br />
|<br />
* Ability to set account passwords to '1234' or '123456' for example.<br />
* Usage of pre-programmed default passwords<br />
|-<br />
| '''Account Lockout'''<br />
|<br />
* Administrative Interface<br />
* Device Web Interface<br />
* Cloud Interface<br />
* Mobile Application<br />
|<br />
* Ability to continue sending authentication attempts after 3 - 5 failed login attempts<br />
|-<br />
| '''Unencrypted Services'''<br />
|<br />
* Device Network Services<br />
|<br />
* Network services are not properly encrypted to prevent eavesdropping or tampering by attackers<br />
|-<br />
| '''Two-factor Authentication'''<br />
|<br />
* Administrative Interface<br />
* Cloud Web Interface<br />
* Mobile Application<br />
|<br />
* Lack of two-factor authentication mechanisms such as a security token or fingerprint scanner<br />
|-<br />
| '''Poorly Implemented Encryption'''<br />
|<br />
* Device Network Services<br />
|<br />
* Encryption is implemented however it is improperly configured or is not being properly updated, e.g. using SSL v2 <br />
|-<br />
| '''Update Sent Without Encryption'''<br />
|<br />
* Update Mechanism<br />
|<br />
* Updates are transmitted over the network without using TLS or encrypting the update file itself<br />
|-<br />
| '''Update Location Writable'''<br />
|<br />
* Update Mechanism<br />
|<br />
* Storage location for update files is world writable potentially allowing firmware to be modified and distributed to all users<br />
|-<br />
| '''Denial of Service'''<br />
|<br />
* Device Network Services<br />
|<br />
* Service can be attacked in a way that denies service to that service or the entire device<br />
|-<br />
| '''Removal of Storage Media'''<br />
|<br />
* Device Physical Interfaces<br />
|<br />
* Ability to physically remove the storage media from the device<br />
|-<br />
| '''No Manual Update Mechanism'''<br />
|<br />
* Update Mechanism<br />
|<br />
* No ability to manually force an update check for the device<br />
|-<br />
| '''Missing Update Mechanism'''<br />
|<br />
* Update Mechanism<br />
|<br />
* No ability to update device<br />
|-<br />
| '''Firmware Version Display and/or Last Update Date'''<br />
|<br />
* Device Firmware<br />
|<br />
* Current firmware version is not displayed and/or the last update date is not displayed<br />
|-<br />
| '''Firmware and storage extraction'''<br />
|<br />
* JTAG / SWD interface<br />
* [https://www.flashrom.org/Flashrom In-Situ dumping]<br />
* Intercepting a OTA update<br />
* Downloading from the manufacturers web page<br />
* [https://www.exploitee.rs/index.php/Exploitee.rs_Low_Voltage_e-MMC_Adapter eMMC tapping]<br />
* Unsoldering the SPI Flash / eMMC chip and reading it in a adapter<br />
|<br />
* Firmware contains a lot of useful information, like source code and binaries of running services, pre-set passwords, ssh keys etc. <br />
|-<br />
| '''Manipulating the code execution flow of the device'''<br />
|<br />
* JTAG / SWD interface<br />
* [https://wiki.newae.com/Main_Page Side channel attacks like glitching]<br />
|<br />
* With the help of a JTAG adapter and gdb we can modify the execution of firmware in the device and bypass almost all software based security controls.<br />
* Side channel attacks can also modify the execution flow or can be used to leak interesting information from the device<br />
|-<br />
| '''Obtaining console access'''<br />
|<br />
* Serial interfaces (SPI / UART)<br />
|<br />
* By connecting to a serial interface, we will obtain full console access to a device<br />
* Usually security measures include custom bootloaders that prevent the attacker from entering single user mode, but that can also be bypassed.<br />
|-<br />
| '''Insecure 3rd party components'''<br />
|<br />
* Software<br />
|<br />
* Out of date versions of busybox, openssl, ssh, web servers, etc.<br />
|-<br />
<br />
|}<br />
<br />
{{Social Media Links}}<br />
<br />
| style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== What is the IoT Vulnerabilities Project? ==<br />
<br />
The IoT Vulnerabilities Project provides:<br />
<br />
* Information on the top IoT vulnerabilities<br />
* The attack surface associated with the vulnerability<br />
* A summary of the vulnerability<br />
<br />
== Project Leaders ==<br />
<br />
* Daniel Miessler<br />
* Craig Smith<br />
<br />
== Related Projects ==<br />
<br />
* [[OWASP_Mobile_Security_Project|OWASP Mobile Security]]<br />
* [[OWASP_Top_Ten_Project|OWASP Web Top 10]]<br />
<br />
== Collaboration ==<br />
[https://owasp-iot-security.slack.com The Slack Channel]<br />
<br />
== Resources ==<br />
* [https://www.owasp.org/index.php/Top_IoT_Vulnerabilities Top 10 IoT Vulnerabilities from 2014]<br />
<br />
== News and Events ==<br />
* Coming Soon<br />
<br />
|}<br />
<br />
= Medical Devices =<br />
<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== Medical Device Testing ==<br />
<br />
The Medical Device Testing project is intended to provide some basic attack surface considerations that should be evaluated before shipping Medical Device equipment.<br />
<br />
{| class="wikitable" style="text-align: left" border="1"<br />
! Attack Surface<br />
! Vulnerability<br />
|- <br />
| '''Ecosystem (general)'''<br />
|<br />
* Interoperability standards<br />
* Data governance<br />
* System wide failure<br />
* Individual stakeholder risks<br />
* Implicit trust between components<br />
* Enrollment security<br />
* Decommissioning system<br />
* Lost access procedures<br />
|- <br />
| '''HL7'''<br />
|<br />
* XML Parsing<br />
** XSS<br />
* Information Disclosure<br />
|- <br />
| '''Device Memory'''<br />
|<br />
* Sensitive data<br />
** Cleartext usernames<br />
** Cleartext passwords<br />
** Third-party credentials<br />
** Encryption keys<br />
|- <br />
| '''Device Physical Interfaces'''<br />
|<br />
* Firmware extraction<br />
* User CLI<br />
* Admin CLI<br />
* Privilege escalation<br />
* Reset to insecure state<br />
* Removal of storage media<br />
* Tamper resistance<br />
* Debug port<br />
* Device ID/Serial number exposure<br />
|-<br />
| '''Device Web Interface'''<br />
|<br />
* Standard set of web vulnerabilities:<br />
** SQL injection<br />
** Cross-site scripting<br />
** Cross-site Request Forgery<br />
** Username enumeration<br />
* Credential management vulnerabilities:<br />
** Username enumeration<br />
** Weak passwords<br />
** Account lockout<br />
** Known default credentials<br />
** Insecure password recovery mechanism<br />
|- <br />
| '''Device Firmware'''<br />
|<br />
* Sensitive data exposure:<br />
** Backdoor accounts<br />
** Hardcoded credentials<br />
** Encryption keys<br />
** Encryption (Symmetric, Asymmetric)<br />
** Sensitive information<br />
** Sensitive URL disclosure<br />
* Firmware version display and/or last update date<br />
* Vulnerable services (web, ssh, tftp, etc.)<br />
* Security related function API exposure<br />
* Firmware downgrade<br />
|- <br />
| '''Device Network Services'''<br />
|<br />
* Information disclosure<br />
* User CLI<br />
* Administrative CLI<br />
* Injection<br />
* Denial of Service<br />
* Unencrypted Services<br />
* Poorly implemented encryption<br />
* Test/Development Services<br />
* Buffer Overflow<br />
* UPnP<br />
* Vulnerable UDP Services<br />
* DoS<br />
* Device Firmware OTA update block<br />
* Replay attack<br />
* Lack of payload verification<br />
* Lack of message integrity check<br />
* Credential management vulnerabilities:<br />
** Username enumeration<br />
** Weak passwords<br />
** Account lockout<br />
** Known default credentials<br />
** Insecure password recovery mechanism<br />
|- <br />
| '''Administrative Interface'''<br />
|<br />
* Standard web vulnerabilities:<br />
** SQL injection<br />
** Cross-site scripting<br />
** Cross-site Request Forgery<br />
** Username enumeration<br />
* Credential management vulnerabilities:<br />
** Username enumeration<br />
** Weak passwords<br />
** Account lockout<br />
** Known default credentials<br />
** Insecure password recovery mechanism<br />
* Security/encryption options<br />
* Logging options<br />
* Two-factor authentication<br />
* Inability to wipe device<br />
|- <br />
| '''Local Data Storage'''<br />
|<br />
* Unencrypted data<br />
* Data encrypted with discovered keys<br />
* Lack of data integrity checks<br />
* Use of static same enc/dec key<br />
|- <br />
| '''Cloud Web Interface'''<br />
|<br />
* Standard set of web vulnerabilities:<br />
** SQL injection<br />
** Cross-site scripting<br />
** Cross-site Request Forgery<br />
* Credential management vulnerabilities:<br />
** Username enumeration<br />
** Weak passwords<br />
** Account lockout<br />
** Known default credentials<br />
** Insecure password recovery mechanism<br />
* Transport encryption<br />
* Two-factor authentication<br />
|- <br />
| '''Third-party Backend APIs'''<br />
|<br />
* Unencrypted PII sent<br />
* Encrypted PII sent<br />
* Device information leaked<br />
* Location leaked<br />
|- <br />
| '''Update Mechanism'''<br />
|<br />
* Update sent without encryption<br />
* Updates not signed<br />
* Update location writable<br />
* Update verification<br />
* Update authentication<br />
* Malicious update<br />
* Missing update mechanism<br />
* No manual update mechanism<br />
|- <br />
| '''Mobile Application'''<br />
|<br />
* Implicitly trusted by device or cloud<br />
* Username enumeration<br />
* Account lockout<br />
* Known default credentials<br />
* Weak passwords<br />
* Insecure data storage<br />
* Transport encryption<br />
* Insecure password recovery mechanism<br />
* Two-factor authentication<br />
|- <br />
| '''Vendor Backend APIs'''<br />
|<br />
* Inherent trust of cloud or mobile application<br />
* Weak authentication<br />
* Weak access controls<br />
* Injection attacks<br />
* Hidden services<br />
|- <br />
| '''Ecosystem Communication'''<br />
|<br />
* Health checks<br />
* Heartbeats<br />
* Ecosystem commands<br />
* Deprovisioning<br />
* Pushing updates<br />
|- <br />
| '''Network Traffic'''<br />
|<br />
* LAN<br />
* LAN to Internet<br />
* Short range<br />
* Non-standard<br />
* Wireless (WiFi, Z-wave, XBee, Zigbee, Bluetooth, LoRA)<br />
* Protocol fuzzing<br />
|- <br />
| '''Authentication/Authorization'''<br />
|<br />
* Authentication/Authorization related values (session key, token, cookie, etc.) disclosure<br />
* Reusing of session key, token, etc.<br />
* Device to device authentication<br />
* Device to mobile Application authentication<br />
* Device to cloud system authentication<br />
* Mobile application to cloud system authentication<br />
* Web application to cloud system authentication<br />
* Lack of dynamic authentication<br />
|-<br />
| '''Data Flow'''<br />
|<br />
* What data is being captured?<br />
* How does it move within the ecosystem?<br />
* How is it protected in transit?<br />
* How is it protected at rest?<br />
* Who is that data shared with?<br />
|-<br />
| '''Hardware (Sensors)'''<br />
|<br />
* Sensing Environment Manipulation<br />
* Tampering (Physically)<br />
* Damaging (Physically)<br />
* Failure state analysis<br />
|-<br />
|}<br />
<br />
{{Social Media Links}}<br />
<br />
| style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== What is the Medical Attack Surfaces project? ==<br />
<br />
The Medical Attack Surfaces project provides:<br />
<br />
* A simple way for testers, manufacturers, developers, and users to get an understanding of the complexity of a modern medical environment<br />
* Allows people to visualize the numerous attack surfaces that need to be defended within medical equipment ecosystems<br />
<br />
== Project Leaders ==<br />
<br />
* Daniel Miessler<br />
<br />
== Related Projects ==<br />
<br />
* [[OWASP_Mobile_Security_Project|OWASP Mobile Security]]<br />
* [[OWASP_Top_Ten_Project|OWASP Web Top 10]]<br />
<br />
== Collaboration ==<br />
[https://owasp-iot-security.slack.com The Slack Channel]<br />
<br />
== Resources ==<br />
* [https://www.owasp.org/index.php/IoT_Firmware_Analysis IoT Firmware Analysis Primer]<br />
* [https://otalliance.org/initiatives/internet-things Online Trust Alliance - Internet of Things]<br />
* [https://people.debian.org/~aurel32/qemu/ Pre-compiled QEMU images]<br />
* [https://code.google.com/archive/p/firmware-mod-kit/ Firmware Modification Kit]<br />
* [https://craigsmith.net/episode-11-1-firmware-extraction/ Short Firmware Extraction Video]<br />
* [https://craigsmith.net/episode-12-1-firmware-emulation-with-qemu/ Firmware Emulation with QEMU]<br />
* [https://craigsmith.net/episode-18-1-file-extraction-from-network-capture/ File Extraction from Network Capture]<br />
<br />
== News and Events ==<br />
* Daniel Miessler presented on using Adaptive Testing Methodologies to evaluate the security of medical devices at RSA 2017.<br />
<br />
|}<br />
<br />
= Firmware Analysis =<br />
<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== Firmware Analysis Project ==<br />
<br />
The Firmware Analysis Project is intended to provide security testing guidance for the IoT Attack Surface "Device Firmware":<br />
<br />
{| class="wikitable" style="text-align: left" border="1"<br />
! Section<br />
! <br />
|- <br />
|<br />
Device Firmware Vulnerabilities<br />
|<br />
* Out-of-date core components<br />
* Unsupported core components<br />
* Expired and/or self-signed certificates<br />
* Same certificate used on multiple devices<br />
* Admin web interface concerns<br />
* Hardcoded or easy to guess credentials<br />
* Sensitive information disclosure<br />
* Sensitive URL disclosure<br />
* Encryption key exposure<br />
* Backdoor accounts<br />
* Vulnerable services (web, ssh, tftp, etc.)<br />
|-<br />
|<br />
Manufacturer Recommendations<br />
|<br />
* Ensure that supported and up-to-date software is used by developers<br />
* Ensure that robust update mechanisms are in place for devices<br />
* Ensure that certificates are not duplicated across devices and product lines.<br />
* Ensure supported and up-to-date software is used by developers<br />
* Develop a mechanism to ensure a new certificate is installed when old ones expire<br />
* Disable deprecated SSL versions<br />
* Ensure developers do not code in easy to guess or common admin passwords<br />
* Ensure services such as SSH have a secure password created<br />
* Develop a mechanism that requires the user to create a secure admin password during initial device setup<br />
* Ensure developers do not hard code passwords or hashes<br />
* Have source code reviewed by a third party before releasing device to production<br />
* Ensure industry standard encryption or strong hashing is used<br />
|-<br />
|<br />
Device Firmware Guidance and Instruction<br />
|<br />
* Firmware file analysis<br />
* Firmware extraction<br />
* Dynamic binary analysis<br />
* Static binary analysis<br />
* Static code analysis<br />
* Firmware emulation<br />
* File system analysis<br />
|-<br />
|<br />
Device Firmware Tools<br />
|<br />
* [https://github.com/craigz28/firmwalker Firmwalker] <br />
* [https://code.google.com/archive/p/firmware-mod-kit/ Firmware Modification Kit]<br />
* [https://github.com/angr/angr Angr binary analysis framework]<br />
* [http://binwalk.org/ Binwalk firmware analysis tool]<br />
* [http://www.binaryanalysis.org/en/home Binary Analysis Tool]<br />
* [https://github.com/firmadyne/firmadyne Firmadyne]<br />
|-<br />
|<br />
Vulnerable Firmware<br />
|<br />
* [https://github.com/praetorian-inc/DVRF Damn Vulnerable Router Firmware]<br />
|-<br />
|}<br />
<br />
{{Social Media Links}}<br />
<br />
| style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== What is the Firmware Analysis Project? ==<br />
<br />
The Firmware Analysis Project provides:<br />
<br />
* Security testing guidance for vulnerabilities in the "Device Firmware" attack surface<br />
* Steps for extracting file systems from various firmware files<br />
* Guidance on searching a file systems for sensitive of interesting data<br />
* Information on static analysis of firmware contents<br />
* Information on dynamic analysis of emulated services (e.g. web admin interface)<br />
* Testing tool links<br />
* A site for pulling together existing information on firmware analysis<br />
<br />
== Project Leaders ==<br />
<br />
* Craig Smith<br />
<br />
== Related Projects ==<br />
<br />
* [[OWASP_Mobile_Security_Project|OWASP Mobile Security]]<br />
* [[OWASP_Top_Ten_Project|OWASP Web Top 10]]<br />
<br />
== Collaboration ==<br />
[https://owasp-iot-security.slack.com The Slack Channel]<br />
<br />
== Resources ==<br />
* [https://www.owasp.org/index.php/IoT_Firmware_Analysis IoT Firmware Analysis Primer]<br />
* [https://otalliance.org/initiatives/internet-things Online Trust Alliance - Internet of Things]<br />
* [https://people.debian.org/~aurel32/qemu/ Pre-compiled QEMU images]<br />
* [https://code.google.com/archive/p/firmware-mod-kit/ Firmware Modification Kit]<br />
* [https://craigsmith.net/episode-11-1-firmware-extraction/ Short Firmware Extraction Video]<br />
* [https://craigsmith.net/episode-12-1-firmware-emulation-with-qemu/ Firmware Emulation with QEMU]<br />
* [https://craigsmith.net/episode-18-1-file-extraction-from-network-capture/ File Extraction from Network Capture]<br />
<br />
== News and Events ==<br />
* Coming Soon<br />
<br />
|}<br />
<br />
= IoT Event Logging Project=<br />
<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File: OWASP_Project_Header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== IoT Logging Events==<br />
<br />
This is a working draft of the recommended minimum IoT Device logging events. This includes many different types of devices, including consumer IoT, enterprise IoT, and ICS/SCADA type devices.<br />
<br />
{| class="wikitable" style="text-align: left" border="1"<br />
! Event Category<br />
! Events<br />
|-<br />
| '''Request Exceptions'''<br />
|<br />
* Attempt to Invoke Unsupported HTTP Method<br />
* Unexpected Quantity of Characters in Parameter<br />
* Unexpected Type of Characters in Parameter<br />
|-<br />
| '''Authentication Exceptions'''<br />
|<br />
* Multiple Failed Passwords<br />
* High Rate of Login Attempts<br />
* Additional POST Variable<br />
* Deviation from Normal GEO Location<br />
|-<br />
| '''Session Exceptions'''<br />
|<br />
* Modifying the Existing Cookie<br />
* Substituting Another User's Valid SessionID or Cookie<br />
* Source Location Changes During Session<br />
|-<br />
| '''Access Control Exceptions'''<br />
|<br />
* Modifying URL Argument Within a GET for Direct Object Access Attempt<br />
* Modifying Parameter Within a POST for Direct Object Access Attempt<br />
* Forced Browsing Attempt<br />
|-<br />
| '''Ecosystem Membership Exceptions'''<br />
|<br />
* Traffic Seen from Disenrolled System<br />
* Traffic Seen from Unenrolled System<br />
* Failed Attempt to Enroll in Ecosystem<br />
* Multiple Attempts to Enroll in Ecosystem<br />
|-<br />
| '''Device Access Events'''<br />
|<br />
* Device Case Tampering Detected<br />
* Device Logic Board Tampering Detected<br />
|-<br />
| '''Administrative Mode Events'''<br />
|<br />
* Device Entered Administrative Mode<br />
* Device Accessed Using Default Administrative Credentials<br />
|-<br />
| '''Input Exceptions'''<br />
|<br />
* Double Encoded Character<br />
* Unexpected Encoding Used<br />
|-<br />
| '''Command Injection Exceptions'''<br />
|<br />
* Blacklist Inspection for Common SQL Injection Values<br />
* Abnormal Quantity of Returned Records<br />
|-<br />
| '''Honey Trap Exceptions'''<br />
|<br />
* Honey Trap Resource Requested<br />
* Honey Trap Data Used<br />
|-<br />
| '''Reputation Exceptions'''<br />
|<br />
* Suspicious or Disallowed User Source Location<br />
<br />
|-<br />
|}<br />
<br />
{{Social Media Links}}<br />
<br />
| style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right: 25px;" valign="top" |<br />
<br />
== What is the IoT Security Logging Project? ==<br />
<br />
The IoT Secure Logging Project provides a list of core events that should be logged in any IoT-related system. The project exists because IoT systems in general are not logging nearly enough events to constitute input for a solid detection and response program around IoT devices, and for companies that want to do this there are not many good resources for what should be logged.<br />
<br />
== Project Leaders ==<br />
<br />
* Daniel Miessler<br />
<br />
== Related Projects ==<br />
<br />
* [https://www.owasp.org/index.php/OWASP_AppSensor_Project The OWASP AppSensor Project]<br />
<br />
== Collaboration ==<br />
[https://owasp-iot-security.slack.com The Slack Channel]<br />
<br />
== Quick Download ==<br />
* Coming Soon<br />
<br />
== News and Events ==<br />
* Coming Soon<br />
<br />
|}<br />
<br />
= ICS/SCADA =<br />
<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== ICS/SCADA Project ==<br />
<br />
The OWASP ICS/SCADA Top 10 software weaknesses are as follows:<br />
<br />
{| class="wikitable" style="text-align: left" border="1"<br />
! Rank and ID<br />
! Title<br />
|- <br />
| '''1 - CWE-119'''<br />
|<br />
* Improper Restriction of Operations within the Bounds of a Memory Buffer<br />
|- <br />
| '''2 - CWE-20'''<br />
|<br />
* Improper Input Validation<br />
|- <br />
| '''3 - CWE-22'''<br />
|<br />
* Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')<br />
|-<br />
| '''4 - CWE-264'''<br />
|<br />
* Permissions, Privileges, and Access Controls<br />
|- <br />
| '''5 - CWE-200'''<br />
|<br />
* Information Exposure<br />
|- <br />
| '''6 - CWE-255'''<br />
|<br />
* Credentials Management<br />
|- <br />
| '''7 - CWE-287'''<br />
|<br />
* Improper Authentication<br />
|- <br />
| '''8 - CWE-399'''<br />
|<br />
* Resource Management Errors<br />
|- <br />
| '''9 - CWE-79'''<br />
|<br />
* Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')<br />
|- <br />
| '''10 - CWE-189'''<br />
|<br />
* Numeric Errors<br />
|- <br />
|}<br />
<br />
{{Social Media Links}}<br />
<br />
| style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== What is the ICS/SCADA Project? ==<br />
<br />
The ICS/SCADA Project provides:<br />
<br />
* A list of the Top 10 most dangerous software weaknesses<br />
<br />
== Project Leaders ==<br />
<br />
* NJ Ouchn<br />
<br />
== Related Projects ==<br />
<br />
* [[OWASP_Mobile_Security_Project|OWASP Mobile Security]]<br />
* [[OWASP_Top_Ten_Project|OWASP Web Top 10]]<br />
<br />
== Collaboration ==<br />
[https://owasp-iot-security.slack.com The Slack Channel]<br />
<br />
== Quick Download ==<br />
* Coming Soon<br />
<br />
== News and Events ==<br />
* Coming Soon<br />
<br />
|}<br />
<br />
= IoT Security Policy Project =<br />
<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== IoT Security Policy Project ==<br />
<br />
The OWASP IoT Security Policy Project provides:<br />
<br />
{{Social Media Links}}<br />
<br />
| style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |<br />
<br />
== What is the IoT Security Policies Project? ==<br />
<br />
The IoT Security Policy Project provides:<br />
<br />
== Project Leaders ==<br />
<br />
* Saša Zdjelar<br />
<br />
== Related Projects ==<br />
<br />
== Collaboration ==<br />
[https://owasp-iot-security.slack.com The Slack Channel]<br />
<br />
== Quick Download ==<br />
* Coming Soon<br />
<br />
== News and Events ==<br />
* Coming Soon<br />
<br />
|}<br />
<br />
= Community =<br />
<br />
[https://www.iamthecavalry.org/ I Am The Cavalry] <br />
<br />
A global grassroots organization that is focused on issues where computer security intersects public safety and human life.<br />
<br />
Their areas of focus include:<br />
* Medical devices<br />
* Automobiles<br />
* Home Electronics<br />
* Public Infrastructure<br />
<br />
[https://otalliance.org Online Trust Alliance]<br />
<br />
Formed as an informal industry working group in 2005, today OTA is an Internal Revenue Service (IRS) approved 501c3 charitable organization with the mission to enhance online trust and empower users, while promoting innovation and the vitality of the internet. OTA is global organization supported by over 100 organizations headquartered in Bellevue, Washington with offices in Washington DC.<br />
<br />
Addressing the mounting concerns, in January 2015 the Online Trust Alliance, established the [https://otalliance.org/initiatives/internet-things IoT Trustworthy Working Group (ITWG)], a multi-stakeholder initiative. The group recognizes “security and privacy by design” must be a priority from the onset of product development and be addressed holistically. The framework focuses on privacy, security sustainability. The sustainability pillar is critical as it looks at the life-cycle issues related to long- term supportability and transfers of ownership of devices and the data collected.<br />
<br />
[https://allseenalliance.org/framework AllSeen Alliance]<br />
<br />
The AllSeen Alliance is a Linux Foundation collaborative project. They're a cross-industry consortium dedicated to enabling the interoperability of billions of devices, services and apps that comprise the Internet of Things. The Alliance supports the AllJoyn Framework, an open source software framework that makes it easy for devices and apps to discover and communicate with each other. Developers can write applications for interoperability regardless of transport layer, manufacturer, and without the need for Internet access. The software has been and will continue to be openly available for developers to download, and runs on popular platforms such as Linux and Linux-based Android, iOS, and Windows, including many other lightweight real-time operating systems.<br />
<br />
[http://www.iiconsortium.org/ The Industrial Internet Consortium (IIC)]<br />
<br />
The Industrial Internet Consortium is the open membership, international not-for-profit consortium that is setting the architectural framework and direction for the Industrial Internet. Founded by AT&T, Cisco, GE, IBM and Intel in March 2014, the consortium’s mission is to coordinate vast ecosystem initiatives to connect and integrate objects with people, processes and data using common architectures, interoperability and open standards.<br />
<br />
[http://securingsmartcities.org/ Securing Smart Cities]<br />
<br />
Securing Smart Cities is a not-for-profit global initiative that aims to solve the existing and future cybersecurity problems of smart cities through collaboration between companies, governments, media outlets, other not-for-profit initiatives and individuals across the world.<br />
<br />
===Talks===<br />
<br />
RSA Conference San Francisco <br> <br />
[https://www.owasp.org/images/5/51/RSAC2015-OWASP-IoT-Miessler.pdf Securing the Internet of Things: Mapping IoT Attack Surface Areas with the OWASP IoT Top 10 Project] <br><br />
Daniel Miessler, Practice Principal <br><br />
April 21, 2015 <br><br />
--- <br><br />
Defcon 23 <br><br />
[https://www.owasp.org/images/3/36/IoTTestingMethodology.pdf IoT Attack Surface Mapping] <br><br />
Daniel Miessler <br><br />
August 6-9, 2015<br />
<br />
===Podcasts===<br />
<br />
* [http://iotpodcast.com/ The Internet of Things Podcast]<br />
* [http://www.iot-inc.com/ IoT Inc]<br />
* [https://craigsmith.net/iot-this-week/ IoT This Week]<br />
* [http://farstuff.com/ Farstuff: The Internet of Things Podcast]<br />
<br />
===IoT Conferences===<br />
<br />
* [http://www.iotevents.org Internet of Things Events]<br />
<br />
Conference Call for Papers<br />
* [http://www.wikicfp.com/cfp/servlet/tool.search?q=internet+of+things&year=t WikiCFP - Internet of Things]<br />
* [http://www.wikicfp.com/cfp/servlet/tool.search?q=iot&year=t WikiCFP - IoT]<br />
<br />
<br />
<br />
<br />
=Project About=<br />
<br />
{{Template:Project About<br />
| project_name =OWASP Internet of Things Project<br />
| project_description = <br />
| project_license =CC-BY 3.0 for documentation and GPLv3 for code. <br />
| leader_name1 = Daniel Miessler<br />
| leader_email1 = <br />
| leader_username1 = <br />
| leader_name2 =Craig Smith<br />
| leader_email2 = <br />
| leader_username2 = <br />
| contributor_name1 = Justin Klein Keane]<br />
| contributor_email1 = <br />
| contributor_username1 = Justin_C._Klein_Keane<br />
| contributor_name2 = Yunsoul<br />
| contributor_email2 = <br />
| contributor_username2 = Yunsoul<br />
| mailing_list_name = <br />
| links_url1 = <br />
| links_name1 =<br />
}} <br />
<br />
<br />
<br />
<br />
__NOTOC__ <headertabs></headertabs><br />
<br />
[[Category:OWASP_Project]] <br />
[[Category:OWASP_Document]] <br />
[[Category:OWASP_Download]] <br />
[[Category:OWASP_Release_Quality_Document]]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=WASPY_Awards_2017&diff=231360WASPY Awards 20172017-07-06T09:17:26Z<p>Owen Pendlebury: adding my profile</p>
<hr />
<div>[[File:WASPY 2017 Banner.jpg]]<br />
<br />
==Purpose of the Awards==<br />
<br />
Each year there are many individuals who do amazing work, dedicating countless hours to share, improve, and strengthen the OWASP mission. Some of these individuals are well known to the community while others are not. <br />
<br />
'''The purpose of these awards is to bring recognition to those who "FLY UNDER THE RADAR". These are the individuals who are passionate about OWASP, who contribute hours of their own free time to the organization to help improve the cyber-security world, yet seem to go unrecognized.''' <br />
<br />
==Timeline==<br />
Call for Nominees Opens June 7, 2017 <br />
<br />
Call for Nominees Closes June 30, 2017 - CLOSED <br />
<br />
Announcement of Nominees per Category July 5, 2017 - DONE <br />
<br />
Deadline for Nominee Profile Picture and Bio to be created and added to the Nominees section July 10, 2017 <br />
<br />
Voting for Board & Staff Members Opens July 17, 2017 <br />
<br />
Voting for Board & Staff Members Closes July 24, 2017 <br />
<br />
Winners are Notified July 25, 2017 <br />
<br />
Announcement of Winners to the Community July 25, 2017 <br />
<br />
Award Ceremony at AppSecUSA 2017 in Orlando, FL September 21-22, 2017 <br />
<br />
==Categories==<br />
The WASPYs celebrate the actors in our community who grow OWASP and drive innovation to the safety and security of the world’s software. This year we are excited to offer three categories.<br />
<br><br />
<br />
'''Best Community Supporter''' - The WASPY for COMMUNITY honors members who create dynamic INTERACTION and LEARNING opportunities for the OWASP Community. Nominees to the Community WASPY Award create collaborative and inclusive environments and grow the OWASP Community. WASPYs focus on the unsung heros of the OWASP community. Chapter Leaders and Community Members should especially consider leaders and volunteers who bring something extra to the environment, help the chapter reach out to new attendees, or carry out the tedious and repetitive tasks that make growing an OWASP Chapter possible.<br />
<br><br />
<br />
'''Best Mission Outreach''' - The WASPY for Mission Outreach honors community members who help the community GROW. Growth can happen inside the larger OWASP community or outside it in the broader AppSec and development communities. Leaders and Members should especially consider volunteers who pushed the boundaries of the audience and reach of OWASP to provide new exposure for OWASP’s projects and chapters. New leaders and volunteers who help bring more people to your chapter, project, or actively represent OWASP at non-OWASP events, gatherings, and activities to build an active OWASP community are ideal candidates for the Mission Outreach WASPY award.<br />
<br><br />
<br />
'''Best Innovator''' - The WASPY for Innovation is given to a community member who has contributed to the TECHNICAL advancement of OWASP in the past year. This advancement is usually through an [[:Category:OWASP Project|OWASP Project]] and can be in the form of code, an application, or anything that materially makes the AppSec community better in a unique way. WASPYs focus on the unsung heros of the OWASP community who quietly go about making the world a bit better for their work. Project Leaders and Community Members should especially consider nominating new projects, projects that have recently graduated, and project contributors for this WASPY.<br />
<br />
==Rules==<br />
'''Remember the purpose of these awards is to recognize the UNSUNG HEROS out there, that are barely recognized for their contributions to the OWASP Foundation.''' <br />
<br />
1. [https://www.owasp.org/index.php/About_OWASP#2015_Global_Board_Members Board members] may not be nominated <br />
<br />
2. [https://www.owasp.org/index.php/About_OWASP#Employees_and_Contractors_of_the_OWASP_Foundation Employees & Contractors] may not be nominated <br />
<br />
3. All nominees will remain anonymous until July 3, 2017<br />
<br />
4. Anyone can nominate an "unsung hero" who has contributed in some way to OWASP who they feel best fits each category <br />
<br />
5. You may only nominate one person per category <br />
<br />
=='''And the Nominees Are...'''==<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" |Name<br />
! scope="col" align="center" width="800" |Category & Citation<br />
|-<br />
| align="center" |Aatral Arasu<br />
|'''''Best Community Supporter''''' <br />
"A great leader always there to help responds to emails quickly loves his work works very hard every day very supportive never loses focus strong willed very technical and willing to do things himself to get the job done when asked for something he will get it to you ASAP constant learner open to suggestions and ideas on how to be better respectful honest caring and I am certain HRC will make it big very soon :)"<br />
|-<br />
|Sean Auriti<br />
|'''''Best Community Supporter'''''<br />
"Sean has not only worked as a volunteer in the local chapter building community, his code projects are useful to the mission and his outreach efforts have included funding requests for OWASP Foundation to grow its mission. Sean is a great example of a community member."<br />
|-<br />
|Nicole Becher<br />
|<nowiki/>'''''Best Community Supporter'''''<br />
<br />
"Nicole has been an amazing chapter leader. She brings knowledge and experience teaching cybersecurity to the Mentor Initiative, WIA Committee, and projects."<br />
|-<br />
|Ken Belva<br />
|<nowiki/>'''''Best Community Supporter'''''<br />
<br />
"Ken is a long time chapter leader of the NYC chapter and a former chapter leader of the Brooklyn Chapter. Ken is always willing to step in and volunteer to help with OWASP initiatives and is a frequent participant in OWASP events as both a volunteer and speaker. Ken has spoken at AppSec USA on XSS techniques (<nowiki>https://www.youtube.com/watch?v=G539NwvpL3I</nowiki>) and is the project lead for the Basic Expression and Lexicon Variation Algorithms project (<nowiki>https://www.owasp.org/index.php/OWASP_Basic_Expression_%26_Lexicon_Variation_Algorithms_(BELVA)_Project)</nowiki>."<br />
|-<br />
|Tony Clarke<br />
|<nowiki/>'''''Best Community Supporter'''''<br />
"Tony has selflessly brought the OWASP dublin chapter to great nights. He has nurtured the chapter to be inclusive and open whilst growing the average attendee count to hundreds. He has spread the word across both security industry and developer industry and has also managed to get various organisations to work together such as ISACA, IISF, ISSA and ISC2. He is a great leader and despite detractors has built the chapter and awareness of software security issues in a strong vendor neutral manner to a great place. Tony is a great example of OWASP and industry leadership."<br />
|-<br />
|Dinis Cruz<br />
|<nowiki/>'''''Best Community Supporter'''''<br />
"Diniz is a fantastic innovator and motivator. As the mastermind and organizer behind the OWASP Summit he has managed to re-energize the OWASP community - many interesting projects would not have happened (or at least, not been that successful) without his passionate work. Besides organizing the event, he also consistently supported project leaders with his experience and ideas."<br />
<br />
'''2nd Citation:''' Dinis put ridiculous effort (<nowiki>https://github.com/OWASP/owasp-summit-2017/commits?author=DinisCruz</nowiki>) into the OWASP Summit 2017 and didn't tire promoting this event!<br />
|-<br />
|Christian Folini<br />
|'''''Best Community Supporter'''''<br />
<br />
"Christian Folini is very active in the Core Rule Set project community. He responds to a ton of questions submitted by newcomers when they are stuck and he answers expert level questions with stunning detail. He joined Chaim and Walter when they revived the project in 2016 and I heard he had the idea for the famous CRS3 release poster <nowiki>https://modsecurity.org/crs/poster</nowiki> that was shared all over the net. I think it's people like him that give OWASP a human face."<br />
|-<br />
|Joaquin Fuentes<br />
|'''''Best Community Supporter'''''<br />
"In 2015, Joaquin took it upon himself to revive the OWASP Phoenix Chapter. He created a meet-up group to gain broader visibility. Since 2015, the meeting attendance has grown from an average of 15 attendees to over 60! Joaquin dedicates a lot of time and effort into scheduling an impressive variety of presentation topics including safe hacking, vulnerability scanner deep dives, hands on web exploitation CTF, video game hacking and more. I learn something new and cool at every event.<br />
<br />
More importantly, Joaquin works hard to foster a friendly, inclusive environment. During our hands-on web exploitation session, Joaquin recruited co-works to assist participants with the Security Shephard challenges so no one felt overwhelmed or impossibly stuck. He always takes the time meet and welcome new members. For example, my 17-year-old son attends meetings with me. He looks up to Joaquin as a mentor for a future information security career because Joaquin encourages his learning and offers career guidance.<br />
<br />
I highly recommend Joaquin for a WASPY award!! He is a kind, soft spoken person with a passion for sharing information security and helping others!"<br />
<br />
'''2nd Citation:''' "He resurrected the Phoenix chapter and has kept it going with great content."<br />
<br />
'''3rd Citation:''' "For all he has done to build up the Phoenix OWASP community. Prior to Joaquin taking point the community in Phoenix was dead. Meetings weren't happening on a regular basis. The prior leaders had done a great job but I think they had burnt out. Joaquin started the community back up and got corporate support from his employer to facilitate not only regular meetings but great meetings with great content. He also implemented MeetUp. I'm not a consistent attendee because of my work/life schedule but I always know when the meetings are happening and what the subject matter will be because of Joaquin utilizing MeetUp."<br />
<br />
'''4th Citation:''' "Put simply, due to the efforts of Joaquin Fuentes, the Phoenix chapter has risen from the ashes (some pun intended). Before Joaquin took over the chapter there were consistently between 5-10 persons in attendance, Joaquin himself being one of them, and the chapter only met about every 3 months or so. Since Joaquin took over the chapter, we have had fantastic presenters each month, paid for dinners, along with a collaborative, comfortable, and engaging environment to meet in. Even more impressive the attendance has grown to 60+ consistently. Joaquin isn't even done yet! He is more great ideas and plans for the chapter that will undoubtedly contribute to the continued growth and over all quality of this once fallen chapter. When he speaks of where this chapter has come from and his plans for the future, it is undeniable to all that he does so with the passion that a leader must possess to accomplish that which Joaquin has."<br />
<br />
'''5th Citation:''' "I am sure someone else will write in with Joaquin's email, but I felt the need to second his name on the list. The events he puts together are top notch, have excellent speakers, always have things to eat, and are generally excellent. I almost never miss them. He is actually so gracious about the entire chapter that I am sure he does not get the credit he deserves... the whole show is put on by just him, I think. Yay Joaquin!"<br />
<br />
'''6th Citation:''' "A few years ago, the Phoenix (AZ) OWASP group was basically defunct. As the leader of the Phoenix OWASP group, not only has Joaquin helped to resurrect the group, but we've had great presentations on reverse engineering, secure coding, a hands-on CTF contest with Security Shepherd, etc. Joaquin is a very visible member of the security community being an employee at Early Warning, which not only hosts the OWASP meetings, but also is a sponsor and makes a strong showing at CactusCon every year, the biggest security conference in Arizona.<br />
<br />
Our local OWASP group is not strong, going from being non-existent a few years ago to now getting a regular attendance of 40-80 people. I've gotten to know Joaquin through OWASP meetings and other security events in the area I have crossed paths with him, and he is a fine representative and evangelist for the OWASP organization."<br />
<br />
'''7th Citation:''' "Joaquin is the Phoenix OWASP Chapter leader and regularly plans amazing talks with great speakers for the Phoenix Community. Frequently, the Phoenix OWASP talks will have over 50 attendees which Joaquin manages without a problem! Joaquin also pushes for candidates he is interviewing to be familiar with OWASP before their interview."<br />
<br />
'''8th Citation:''' "Joaquin is the leader for the Phoenix OWASP, and it is clear that through his leadership the Phoenix OWASP thrives. Joaquin organizes all the meetings, and is constantly working with folks to create an excellent sense of community in the Phoenix area."<br />
<br />
'''9th Citation:''' "Joaquin has taken the Phoenix OWASP chapter that had not been managed for years and brought it back to life. We consistently see 50+ members coming to our Meetups to talk about AppSec related topics. Joaquin is well connected to the InfoSec groups and has had great success in pulling in new speakers, we have already had a few speakers who are prepping their BlackHat and DefCon talks by giving their presentations to our local chapter. Finally Joaquin does a great job by reaching out to the local colleges and supporting CTF activities to garner interest in pen-testing and the OWASP community. He is a true community supporter and fully deserves a WASPY for his efforts..."<br />
<br />
'''10th Citation:''' "Joaquin has been leading the OWASP Phoenix chapter and due to his initiative, has placed Phoenix on the map as a hub for application security. I would like to nominate him because he is always bringing in new and interesting speakers that provide great content. The most recent OWASP chapter meeting had over 60 attendees!"<br />
<br />
'''11th Citation:''' "As a leader of Phoenix OWASP chapter, Joaquin strives to organize talks and trainings to make people in the valley learn InfoSec and AppSec from experienced individuals. He has always gone a step ahead to conduct OWASP meetings that are informative and hands on. Right from giving Arizona State University (ASU) students an overview of basic InfoSec and career opportunities to organizing a hands on hacking workshop for people in the community, Joaquin has always demonstrated passion and determination to take Phoenix to a better place in the field of Cyber Security."<br />
<br />
'''12th Citation:''' "I've attended and participated in three OWASP meetings lead by Joaquin. They are always well organized, offer a great learning experience and considerably contribute to the community. His continuous interest and dedication to the Phoenix chapter do not go unnoticed and are appreciated by all who attend."<br />
<br />
'''13th Citation:''' "Joaquin restarted the OWASP chapter in Phoenix/Scottsdale. Chapter meetings have grown significantly to where there were about 65 attendees at the most recent meeting with hundreds more on the mailing list (I was at the meeting, but I've only heard about the mailing list). As someone who works with him, I know how dedicated he is to the work of IT security and he's been able to attract top-notch speakers for OWASP meetings.'<br />
<br />
'''14th Citation:''' "Joaquin had successfully revived the Phoenix OWASP Chapter. Since, the chapter has excelled from zero to filled audience bringing security talent from all around to speak and educate to security professionals on the many facets of security domains.<br />
<br />
Additionally, this has provided a great forum to network with the many security professionals around the community and share their knowledge and strengthen the security community. <br />
<br />
Joaquin has provided his unselfish time as an OWASP Chapter leader, and has breathed new life into the Chapter."<br />
<br />
'''15th Citation:''' "Joaquin does a bang up job of running the Phoenix OWASP chapter. He does a great job of raising awareness and bringing folks from the infosec community into the fold."<br />
<br />
'''16th Citation:''' "Joaquin Fuentes has had a big impact in raising attendance at the Phoenix meetings to more than 100 people monthly. The quality has gotten significantly better under his leadership. He has organized many speakers, including recruiting speakers from out of the area that have significantly developed the knowledge base of the community. Joaquin is a pen testing manager at Early Warning and he shares his professional knowledge to help us all become better in the practice of information security."<br />
<br />
'''17th Citation:''' No citation was submitted<br />
|-<br />
|Brendan Gormley<br />
|'''''Best Community Supporter'''''<br />
"Throughout the Brendan has not only assisted in making the dublin chapter events happen but taken a lead role. Brendan has organised venues and speakers for these events often going above and beyond to ensure success. Brendan has also been involved in some of the outreach programs the Dublin chapter had been involved in. No task is too big or too small for Brendan and without him I don't believe the Dublin chapter would be what it is."<br />
|-<br />
|Tanya Janca<br />
|'''''Best Community Supporter'''''<br />
"Tanya Janca has been performing “outreach” and “recruitment of women” as her main chapter leader responsibilities for the Ottawa chapter since 2015. The chapter has not only grown by over 500% in that time, but female membership has grown from 2 female members to over 70 (the chapter has grown for many reasons, some of which are her promotional efforts). Activities include starting a mentoring program that matches senior AppSec members of the community with juniors or people who are hoping to get into Application Security; attending all sorts of technology meetups (but especially female-centric ones) to talk about OWASP and personally invite them to attend; bringing OWASP products, concepts and resources to the Canadian Government (and is currently attempting to sway policy to be more application security focused as we speak); as well as performing over 40 public speaking engagements that describe OWASP as “Your new BFF” as part of the application security lesson she has taught. She has also begun speaking at conferences semi-regularly, singing OWASP’s praises as part of every presentation. She also forms female groups to attend events together, to make them more accessible, such as her all-female team for the Ottawa iHack CTP and “Learn by Breaking things” event in June 2017 and her all female CTF team for OWASP Ottawa’s first CTF in 2015. Her claim of being an “application security evangelist” certainly seems fitting."<br />
|-<br />
|Jeremy Long<br />
|'''''Best Community Supporter'''''<br />
"Jeremy is a dedicated security engineer who contributes to the community as a developer, mentor, contributor and leader. He's one of the smartest people I know - and one of the few who has patience with "the rest of us". He is generous with his time and knowledge, helping not only to contribute apps and resources, but to build up the community itself."<br />
|-<br />
|Akash Mahajan<br />
|'''''Best Community Supporter'''''<br />
"Akash has been backbone of OWASP bangalore chapter he has done lot of work for evangelizing OWASP. For more than 7 years now he has been working with the chapter and mentored lot of folks. No wonder he is called "the web app security guy"."<br />
|-<br />
|Dhiraj Mishra<br />
|'''''Best Community Supporter'''''<br />
"Dhiraj Mishra - has been contributed and volunteered to, OWASP Mumbai Student chapter and Mumbai local chapter.<br />
<br />
He has endorse students to be part of multiple open community, however been an Sudent Chapter leader for OWASP he has discussed and shared multiple Information Security topics start from the scratch and spreading the idea's and awareness via chapter Meets, he has taken multiple session in NULL as well which runs with OWASP local chapter Mumbai, recently he invited Mozilla Club Mumbai to student chapter so that students can go to their area of interest, he always pushup/boost women in infosec. Apart from this he has taken various sessions in different colleges and have shared knowledge about Cyber Security."<br />
|-<br />
|Denise Murtagh-Dunne<br />
|'''''Best Community Supporter'''''<br />
"Denise has been a hugely active member of the Dublin chapter and has been involved in all chapter meeting throughout the year and is ever keen to role up her sleeves and get stuck into work that others shy away from. This includes everything from setting up the meeting tools, organising venues, working with sponsors, getting speakers and assisting speakers in the run up and during events. She's been a very positively influence on the community and chapter and has encouraged other people to get involved. She's constantly updating and posting content on our social media accounts and making sure our members get relevant and interesting content. While in full time employment, Denise gives up family time to contribute to the chapter and ensure OWASP Dublin remains a vibrant and relevant group that engages the developer and security community locally."<br />
|-<br />
|[[User:Owen_Pendlebury|Owen Pendlebury]]<br />
|'''''Best Community Supporter'''''<br />
"Owen Pendlebury has been a key local OWASP volunteer over the last number of years. From being on the local Dublin chapter board to leading the Dublin chapter he regularly hosted and spoke at numerous collaborative and insightful security meetups.<br />
<br />
He has also been involved in organising AppSec EU in Rome and more recently co-organised the Belfast conference which was the biggest ever EU conference. As part of organising the conference in Belfast he negotiated that all chapters within Ireland would benefit financially getting a percentage of the conference profits to allow the chapters to bring bigger, better and more collaborative meetings to the Irish OWASP community and grow the communities across the country. <br />
<br />
I don’t know where he has found the time but has also been part of the Women in AppSec committee mentoring a number of individuals throughout the year. He took part in the Women in AppSec events in Belfast giving some insightful opinions into how improve attendees career. Owen is an asset that helps to improve Ireland's security community’s capabilities with a real can-do attitude."<br />
|-<br />
|Mick Ryan<br />
|'''''Best Community Supporter'''''<br />
"Mick always assists with chapter meetings and works to ensure we give the community good quality sessions. Mick assists will all areas including reaching out to potential speakers, getting info and bios from them, arranging dates and venues, posting on social media and the logistics of the meetings and ensuring speakers have the right cables, meetings run to time, that speakers are happy with everything, taking photos to promote the chapter on social media, encouraging people to speak, printing the chapter and getting people to events! Thanks Mick for your contribution in 2017!"<br />
|-<br />
|[https://www.owasp.org/index.php/Sriram Sriram]<br />
|'''''Best Community Supporter'''''<br />
"[https://www.owasp.org/index.php/Sriram Sriram] has been conducting awareness program to the college students. Sriram has created awareness among 12000 Students without the support of anyone. Sriram has been tremendously supporting the OWASP Chapter by giving trainings to various college student, corporates and various chapters.."<br />
|-<br />
|Michelle Simpson<br />
|'''''Best Community Supporter'''''<br />
"Michelle has done an amazing job with the Belfast chapter and works tirelessly to improve the OWASP community and advocate strong app sec practices. This is very evident from the people attending the chapter events, organisations participating and the very successful AppSecEU conference that was held in Belfast in 2017. Michelle put a huge amount of work and effort into planning and preparation for AppSecEU to ensure the conference was of a high calibre. This was a sustained commitment over the majority of 2017 on top of local chapter commitments. I'd like to nominate Michelle for all the hard work and effort she puts into the chapter. Thanks Michelle!"<br />
|-<br />
|Steve Springett<br />
|'''''Best Community Supporter'''''<br />
<br />
"Steve has been a tremendous supporter of the OWASP dependency-check project and leader on the related dependency-track platform. He is quick to respond to community question, answering with insightful and accurate responses assisting the community in their use of the dependency-check suite of tools."<br />
|-<br />
|John Vargas<br />
|'''''Best Community Supporter'''''<br />
<br />
"During the last 9 years John, together with a very small group of volunteers, has been making efforts to keep the chapter of Lima, Peru. Performing activities such as monthly meetings, internal trainings and participating actively in the OWASP Latam Tour. For the chapters in Latin America to keep afloat these activities with few resources is something very complicated and deserves recognition."<br />
|-<br />
|Tara Williams<br />
|'''''Best Community Supporter'''''<br />
<br />
"Tara cares about integrity, inclusion and transparency, she is passionate about making OWASP a better place for all members of the community. With her talents in communications, she is getting the word out about OWASP's benefits to community members and attracting new members to chapter meetings, especially identifying successful pathways to transition meetup members to full members."<br />
|-<br />
|Aatral Arasu<br />
|'''''Best Mission Outreach'''''<br />
'''"'''A great leader always there to help responds to emails quickly loves his work works very hard every day very supportive never loses focus strong willed very technical and willing to do things himself to get the job done when asked for something he will get it to you ASAP constant learner open to suggestions and ideas on how to be better respectful honest caring and I am certain HRC will make it big very soon :)"<br />
|-<br />
|Sean Auriti<br />
|'''''Best Mission Outreach'''''<br />
"Sean mentors, is a speaker, leads projects, is an active chapter leader and chapter Treasurer, participating in meetup events and a great representative at global, regional and external events."<br />
|-<br />
|Tony Clarke<br />
|'''''Best Mission Outreach'''''<br />
"Tony has grown the chapter over the last year to a point where hundreds of people are attending meetings. The meetings are organised in advance now and have a theme. There were some really interesting people speaking at the chapter meetings including Simon Singh, James Lyne, Brian Honan and Jane Franklin. He has also engaged support from local companies with a lot more attending and sponsoring the chapter. There is a real buzz at chapter meetings and they're not just death by PowerPoint which they had been in the past."<br />
|-<br />
|Christopher Frenz<br />
|'''''Best Mission Outreach'''''<br />
<br />
'''"'''Christopher Frenz should be nominated for the Best Mission Outreach WASPY for his work as the Project Lead for the OWASP Anti-Ransomware Guide Project and the OWASP Secure Medical Device Deployment Standard Project. In the wake of WannaCry, anti-ransomware guidance has become more pertinent than ever and the project is regularly updated to keep abreast of the latest ransomware adaptations. Chris regularly shares his anti-ransomware knowledge with the security and healthcare communities and is an advocate for organizations conducting mock ransomware incidents. Chris has shared his knowledge of ransomware protections and of pertinent OWASP resources in numerous venues including articles (<nowiki>https://iapp.org/news/a/why-the-wannacry-outbreak-should-be-a-wake-up-call/</nowiki>) and conference presentations at both the local and international level (<nowiki>https://iapp.org/conference/iapp-canada-privacy-symposium/sessions/?id=a191a000000zrqPAAQ</nowiki>). A Spanish version of the guidance is also available. In addition, he has worked to call attention to the need for healthcare facilities to improve the security of their medical device implementations and is responsible for authoring version 1 of the OWASP Secure Medical Device Deployment Standard. The project has really worked to raise awareness of these issues and has been covered by CSO magazine (<nowiki>http://www.csoonline.com/article/3188230/security/how-to-securely-deploy-medical-devices.html</nowiki>) and other news sources. Chris has given interviews on medical device security for the Cloud Security Alliance and others and will be speaking on medical device security at the Defcon BioHacking Village. Chris is always willing to share his knowledge with all who ask and is an active member of the NYC and Brooklyn OWASP chapters."<br />
|-<br />
|Joaquin Fuentes<br />
|'''''Best Mission Outreach'''''<br />
"For all he has done to build up the Phoenix OWASP community. Prior to Joaquin taking point the community in Phoenix was dead. Meetings weren't happening on a regular basis. The prior leaders had done a great job but I think they had burnt out. Joaquin started the community back up and got corporate support from his employer to facilitate not only regular meetings but great meetings with great content. He also implemented MeetUp. I'm not a consistent attendee because of my work/life schedule but I always know when the meetings are happening and what the subject matter will be because of Joaquin utilizing MeetUp."<br />
<br />
'''2nd Citation:''' "Joaquin has been leading the OWASP Phoenix chapter and due to his initiative, has placed Phoenix on the map as a hub for application security. I would like to nominate him because he is always bringing in new and interesting speakers that provide great content. The most recent OWASP chapter meeting had over 60 attendees!"<br />
<br />
'''3rd Citation''': "Joaquin Fuentes has had a big impact in raising attendance at the Phoenix meetings to more than 100 people monthly. The quality has gotten significantly better under his leadership. He has organized many speakers, including recruiting speakers from out of the area that have significantly developed the knowledge base of the community. Joaquin is a pen testing manager at Early Warning and he shares his professional knowledge to help us all become better in the practice of information security."<br />
<br />
'''4th Citation''': "My job takes me to many different OWASP Chapters, along with ISSA, CSA, ISACA, etc.<br />
The Phoenix OWASP Chapter was DEAD before Joaquin volunteered to lead the Chapter a few years ago.<br />
It is now consistently one of the BEST ITSec community gatherings, and I go out of my way to be in Phoenix for their meetings.<br />
To put it a different way, at my first Phoenix OWASP meeting there were less than 12 attendees, including myself and the speaker. Last week it was standing room only (75+) *and* there would have been more if Interstate 17 hadn't been closed in both directions at the start of rush-hour.<br />
Part of the reason Joaquin deserves this award is that he is EXTREMELY knowledgeable about AppSec and many other aspects of data security and he is ALWAYS friendly and willing to share. His day-job is no picnic, but he finds the time to put together great meetings and do it in a way that everybody has a good time."<br />
|-<br />
|Tanya Janca<br />
|'''''Best Mission Outreach'''''<br />
"Tanya has been instrumental in outreach in the Ottawa Ontario Canada region building membership and participation in the local OWASP chapter, as well as building bridges with other local organizations (Python user group, Ruby Rails user group, WIA, etc.). Tanya has also been a driver in getting a mentoring program setup via the Ottawa chapter. She has also encouraged participation in local CTF events, presented at local conferences (BSides, etc). Tanya's enthusiasm, support, and interaction is often contagious (in a good way :) ). Lastly, Tanya is a strong advocate or evangelist for OWASP projects, promoting such as appropriate per audience/presentation (including, but not limited to: ZAP, Top 10, SKF)."<br />
<br />
'''2nd Citation:''' "Tanya Janca is an excellent ambassador for OWASP. Since her entry into the lead team of the OWASP Ottawa chapter, she has doubled the size of the chapter and developed the chapter into a meeting place for dozens of women interested in Application Security.<br />
Tanya Janca is an energetic speaker who held a fantastic presentation at AppSecEU in Belfast. <nowiki>https://www.youtube.com/watch?v=mPTmuaC2lOI</nowiki> She was subsequently invited to the Swiss Cyberstorm Conference where her addition to the rooster was explained in an admiring blogpost <nowiki>https://swisscyberstorm.com/2017/05/23/Introducing_Tany_Janca.html</nowiki><br />
Tanya Janca has the ability to talk security to techies and management alike. She is pushing for the adoption of OWASP practices and project by the government of Canada her employer. Having received the Government of Canada’s CIO Award for “Excellent in Security” in 2016 she refused to move into the private sector, but continues to support the security community inside the public sector, where her excellent know-how is very important."<br />
<br />
'''3rd Citation:''' "Tanya Janca has been performing “outreach” and “recruitment of women” as her main chapter leader responsibilities for the Ottawa chapter since 2015. The chapter has not only grown by over 500% in that time, but female membership has grown from 2 female members to over 70 (the chapter has grown for many reasons, some of which are her promotional efforts). Activities include starting a mentoring program that matches senior AppSec members of the community with juniors or people who are hoping to get into Application Security; attending all sorts of technology meetups (but especially female-centric ones) to talk about OWASP and personally invite them to attend; bringing OWASP products, concepts and resources to the Canadian Government (and is currently attempting to sway policy to be more application security focused as we speak); as well as performing over 40 public speaking engagements that describe OWASP as “Your new BFF” as part of the application security lesson she has taught. She has also begun speaking at conferences semi-regularly, singing OWASP’s praises as part of every presentation. She also forms female groups to attend events together, to make them more accessible, such as her all-female team for the Ottawa iHack CTP and “Learn by Breaking things” event in June 2017 and her all female CTF team for OWASP Ottawa’s first CTF in 2015. Her claim of being an “application security evangelist” certainly seems fitting."<br />
|-<br />
|Kitisak Jirawannakool<br />
|'''''Best Mission Outreach'''''<br />
<br />
"Web security is notoriously bad in Thailand, so an actives security community is sorely needed. Kitisak is a central figure in that community. He has worked on establishing the OWASP Bangkok chapter for the past six years, organizing meetups, community outreach and engaging with security experts internationally. His work has played a pivotal role in creating IT security awareness in the fast-growing South-East-Asian country."<br />
|-<br />
|James Manico<br />
|'''''Best Mission Outreach'''''<br />
"Jim's influence on OWASP materials (and therefore on application security) is amazing - he's cited on nearly every cheat sheet on OWASP Top 10 document. His name is synonymous with application security."<br />
<br />
'''2nd Citation: "'''While Jim may not be the "unsung hero" - he is the first and foremost cheerleader/champion of OWASP. His efforts and contributions are innumerable. As anyone who knows Jim - he is not a reserved individual when touting the resources available via OWASP. He has likely done more then anyone else working with OWASP to bring together, motivate, and get individuals to contribute to OWASP. From the immensely popular checklists to motivating individuals to contribute. OWASP would not be nearly as successful as it has been without Jim." <br />
|-<br />
|Mateo Martinez<br />
|'''''Best Mission Outreach'''''<br />
"Mateo is one of the leaders in Latin America more recognized, during the last years his efforts to join the chapters chapter along with other leaders of Latam made that the community grew and that today the Latam Tour 2017 has more than 15 participating countries. He also managed to spread the spirit of owasp and help establish new chapters in the region.<br />
The effort to maintain more communication between OWASP GLobal and local communities is reflected in each activity that encourages other leaders to ensure that they strive every day to spread Owasp projects and to grow the community."<br />
|-<br />
|Mark Miller<br />
|'''''Best Mission Outreach'''''<br />
<br />
"The OWASP Podcast is a effort that is in line with the mission of OWASP raising visability for software security. This is a VERY powerful voice in the community globally and Mark Miller should be applauded for his efforts on this<br />
<nowiki>https://www.owasp.org/index.php/OWASP_Podcast</nowiki>"<br />
|-<br />
|Dhiraj Mishra<br />
|'''''Best Mission Outreach'''''<br />
<br />
"Dhiraj was nominated for WASPY 2016, his contribution to the community is from past one 'n half year in various areas, start from the projects, local volunteering and what not, he was also listed in OWASP Hall Of Fame."<br />
|-<br />
|[[User:Owen_Pendlebury|Owen Pendlebury]]<br />
|'''''Best Mission Outreach'''''<br />
"Owen is an active participator in OWASP meetings and has been a great inspiration to me.<br />
He has shown himself to be a great leader and OWASP advocate.<br />
Owen has recommended other AppSec communities in which I have become involved in since moving to Dublin. He is an evangelist for women in technology and I have witnessed this first hand.<br />
I don't hesitate to recommend Owen for this award."<br />
<br />
'''2nd Citation:''' "Owen has introduced me to the OWASP Community in Ireland and EU. Help me to get involve with Women in AppSec and participate in the AppSec EU event in Belfast. He is a great leader, who enjoys talking about OWASP and the great community behind it.<br />
I've moved to Ireland a couple of months ago, and getting to know Owen and the OWASP community has completely changed my life, both professionally and personally. <br />
So, yes, I would like to nominate Owen Pendlebury because he the proof that Women in AppSec is not just a women matter. :)"<br />
|-<br />
|[https://www.owasp.org/index.php/Sriram Sriram Shyam]<br />
|'''''Best Mission Outreach'''''<br />
"Sriram has been conducting awareness program to the college students. Sriram has created awareness among 12000 Students without the support of anyone."<br />
|-<br />
|Noreen Whysell<br />
|'''''Best Mission Outreach'''''<br />
<br />
"Noreen is helping each day to improve OWASP members' experiences bringing her expertise and knowledge as a mentor and projects as a Chapter Leader, one member at a time. She understands what members want, how to improve member benefits and is applying that knowledge to improving local and global member experiences from the ground up. Her efforts are multiplied by her sharing of knowledge and grassroots approach creating a membership groundswell."<br />
|-<br />
|Aatral Arasu<br />
|'''''Best Innovator''''' <br />
"A great leader always there to help responds to emails quickly loves his work works very hard every day very supportive never loses focus strong willed very technical and willing to do things himself to get the job done when asked for something he will get it to you ASAP constant learner open to suggestions and ideas on how to be better respectful honest caring and I am certain HRC will make it big very soon :)"<br />
|-<br />
|Sean Auriti<br />
|'''''Best Innovator''''' <br />
"Sean leads the BLT Project and is a Team Leader for the Learning Gateway project. He has helped improve the quality of web experiences, including OWASP.org ."<br />
|-<br />
|Glenn & Riccardo ten Cate<br />
|'''''Best Innovator'''''<br />
"I am hereby nominating the brothers Glenn & Riccardo ten Cate from the Netherlands for the WASPY award in this category. They are known for their work on the open-source project SKF (Security Knowledge Framework). These are two guys who are dedicated to spreading security knowledge trough the means OWASP has to offer. You might have encountered them talking at seminars, promoting their project and OWASP, or different companies where they teach development teams how to integrate the OWASP core principles in their workflow using their project. Not only professional development teams but also students of security can only be amazed at the sheer knowledge they gathered and contribute to the global OWASP community trough open source. The sheer effort they put in this project teaches, guides, structures and shows by example how to test and write secure applications by design. There is no other software out there that does this. And that is why they deserve this nomination for best innovator 2017."<br />
|-<br />
|Mark Deenihan<br />
|'''''Best Innovator''''' <br />
"Mark for his constant devotion and work on the OWASP security shepherd project and continuing to develop it and teach people globally about app sec."<br />
|-<br />
|Seba Deleersnyder<br />
|'''''Best Innovator''''' <br />
"One of the main projects to date is SAMM. Seba with the support of project colliders has made this a flagship project of OWASP. The level of maturity and the number of improvements obtained indicates that this project is one of the most mature and a great projection to the future."<br />
|-<br />
|Christopher Frenz<br />
|'''''Best Innovator''''' <br />
"Chris' projects are opening doors for OWASP in the standards development and getting the word out about important IoT with his Medical Device Deployment Standard: <nowiki>https://www.owasp.org/index.php/OWASP_Secure_Medical_Device_Deployment_Standard</nowiki> which already has a Turkish translation and attracted attention from the Turkish public health department. He has delivered presentations at meetups, and presenting to the IDESG, www.idesg.org in July. He has a "soup label" tool that gives simple guidance for the implementation of the OSMDDS. This is not Chris' first project but it is surely one of the best OWASP innovations of the year."<br />
|-<br />
|Joaquin Fuentes<br />
|'''''Best Innovator''''' <br />
"Joaquin has been leading the OWASP Phoenix chapter and due to his initiative, has placed Phoenix on the map as a hub for application security. I would like to nominate him because he is always bringing in new and interesting speakers that provide great content. The most recent OWASP chapter meeting had over 60 attendees!"<br />
<br />
'''2nd Citation:''' "Joaquin Fuentes has had a big impact in raising attendance at the Phoenix meetings to more than 100 people monthly. The quality has gotten significantly better under his leadership. He has organized many speakers, including recruiting speakers from out of the area that have significantly developed the knowledge base of the community. Joaquin is a pen testing manager at Early Warning and he shares his professional knowledge to help us all become better in the practice of information security."<br />
|-<br />
|Brian Glas<br />
|'''''Best Innovator''''' <br />
"Brian has been paramount in 2 very strategic initiatives for OWASP. He is not only a Project Leader for the OWASP SAMM project but he has been instrumental in revamping the call for data and reorganizing the flagship OWASP Top Ten. Brian continues to support and speak about the benefits of supporting OWASP especially projects and participating in the Summit. Please consider Brian Glas as the Best Community Supporter for this year."<br />
|-<br />
|Evin Hernandez<br />
|'''''Best Innovator''''' <br />
"Evins focus on the core of the information security platform with Virtual Village has provided the global community with a place to experiment and leverage for testing... <nowiki>https://www.owasp.org/index.php/OWASP_Virtual_Village_Project</nowiki>"<br />
|-<br />
|Jeremy Long<br />
|'''''Best Innovator''''' <br />
"Considering how often projects have a great start and plateau, we should recognize the ongoing effort and dedication given to one of the Flagship projects in our community.<br />
Jeremy Long has continued to not only maintain the Dependency Check project but develop and improve it each year.<br />
This year he added Improvements in the core dependency-check platform in terms of code quality, achieved 100% for the CII Best Practices for dependency-check, continued to develop the ODC community with several contributors submitting PRs, and over the last several months he's been working on platform maturity and will be releasing 2.0.0 in the first half of July 2017.<br />
After 2.0 is released he has planned work on Python support and expanding the tool by integrating additional data-sources such as Artifactory, Redhat Victim's, OSS-Index, etc."<br />
<br />
'''2nd Citation:''' "Jeremy has been an avid contributor/leader for the OWASP dependency-check project. Under his leadership the project has garnered substantial community support in terms of pull requests, improved code quality via Sonarcloud, Coverity, Codacy, and CII Best Practices. While the last six months have been primarily around code quality and bug fixes; these improvements are setting the dependency-check project up for major enhancements over the coming months!"<br />
|-<br />
|Daniel Miessler<br />
|'''''Best Innovator'''''<br />
"Daniel seems to be everywhere at once - despite have a full-time job, he is leading or co-leading several OWASP projects, has created ideas for groups out of thin air, and has performed work in much needed areas.<br />
This year, Daniel has lead or co-lead the Internet of Things security project, completed an IoT: Medical Devices attack surface overview, and created the Game Security project."<br />
|-<br />
|Dhiraj Mishra<br />
|'''''Best Innovator'''''<br />
<br />
"Dhiraj is one of the top contributor in OWASP Cheat Sheet Project, which have security guidance in an easy read format, his contribution for SQL Injection WAF Bypass and XSS Evasion - OWASP, was mostly recommended and used by Cyber Security professional, dhiraj has contributed to Benchmark project by contributing SQLi/XSS fuzz vectors as initial contribution towards adding support for WAF/RASP scoring and many such projects."<br />
|-<br />
|Bernhard Mueller<br />
|'''''Best Innovator'''''<br />
"During the last 18 months Bernhard has been spearheading the OWASP Mobile Testing Guide Project. He has invested several man-months of writing, editing, reviewing, rallying authors, and pushing the project into new directions. This also resulted in the novel agile book writing process and book production pipeline which enables OWASP to produce a professional tech book. The project has produced a security standard and early-release ebook, and is on track become one of OWASP's main flagship projects."<br />
|-<br />
|Steve Springett<br />
|'''''Best Innovator'''''<br />
"Steve's work on dependency-track is fantastic - he's moved forward to address the next round of issues, with an innovative solution all companies can leverage."<br />
|-<br />
|thc202<br />
|'''''Best Innovator'''''<br />
"Simon Bennets "wingman" in the ZAP project, by now even the top committer in the project! (<nowiki>https://github.com/zaproxy/zaproxy/graphs/contributors</nowiki>) So "unsung of" that I do not even know his real name!"<br />
|}<br />
<br />
==Results==<br />
Coming July 25, 2017<br />
<br />
==Sponsorship Opportunities==<br />
The support from our sponsors, is what makes these awards truly successful!<br />
<br />
Sponsorships coming soon!<br />
<br />
==Communication==<br />
# June 7, 2017 Email to the Leaders & Community list. Posted to the OWASP [https://owasp.blogspot.com/2017/06/nominations-are-now-being-accepted-for.html Blog]<br />
# June 30, 2017 Email to the Leaders & Community list.<br />
# July 5, 2017 Email to the Nominees<br />
# July 5, 2017 Email to the Leaders & Community list, and Blog post announcing the nominees have been announced.<br />
<br />
=='''Past WASPY Awards'''==<br />
[https://www.owasp.org/index.php/WASPY_Awards_2016 2016]<br><br />
[https://www.owasp.org/index.php/WASPY_Awards_2015 2015] <br><br />
[https://www.owasp.org/index.php/WASPY_Awards_2014 2014] <br><br />
[https://www.owasp.org/index.php/WASPY_Awards_2013 2013] <br><br />
[https://www.owasp.org/index.php/WASPY_Awards_2012 2012] <br></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=231359User:Owen Pendlebury2017-07-06T09:15:46Z<p>Owen Pendlebury: </p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
<br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 7 years. Some of the projects that Owen has been involved in include, AppSec EU 2016/2017 Committee/ Training Committee chair , DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, Cyber Security Summer Camp for school kids and OWASP Women in AppSec Committee/ mentoring. <br />
<br />
Owen has over 7 years’ penetration testing experience, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
<br />
Owen has also performed numerous web application, network, mobile, specialised technologies (ATM), device penetration tests for major organisations in the financial services, banking and pharmaceutical sectors, consisting of ‘black-box’, ‘white-box’ and ‘grey-box’ testing. <br />
<br />
'''References'''<br />
<br />
'''John Doherty Msc Security & Forensic Computing'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
<br />
'''Mark Denihan OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
'''Fabio Cerullo Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
'''Jason flood CTO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Women_In_AppSec&diff=230911Women In AppSec2017-06-22T19:48:58Z<p>Owen Pendlebury: </p>
<hr />
<div>=WELCOME=<br />
<br />
==Women in Application Security Committee==<br />
<br />
The purpose of Women in AppSec (WIA) Committee is to develop leadership, promote active membership and participation, and contributions by women in application security professional communities, globally and locally.<br />
<br />
The Women in AppSec program is for anyone who believes that diversity is important to the success of the organization, as well as for women looking to learn more about AppSec or who want to make career connections with like-minded colleagues. This includes female undergraduate and graduate students, instructors, and professionals who are dedicated to information security or application development. <br />
<br />
=FIND US=<br />
<br />
==Email List==<br />
<br />
[https://lists.owasp.org/mailman/listinfo/appsec_usa_women_in_security WIA List and Archive]<br />
<br />
==Twitter==<br />
<br />
[https://twitter.com/owaspwia @OWASPWIA]<br />
<br />
==Slack Channel==<br />
<br />
[https://owasp.slack.com/messages/C2NUH1J5B/ WIA Slack Channel]<br />
<br />
You can get an OWASP Slack invite here: [https://owasp.herokuapp.com/ OWASP Slack Invite]<br />
<br />
=WIA PURPOSE AND SCOPE=<br />
<br />
==Purpose==<br />
<br />
The purpose of Women in AppSec (WIA) Committee is to develop leadership, promote active membership and participation, and contributions by women in application security professional communities, globally and locally. <br />
<br />
==Scope==<br />
<br />
The scope for OWASP WIA Committee falls into the following areas:<br />
<br />
# Attract women to OWASP, as active members, contributors and leaders.<br />
# Offer opportunities for women to become engaged in AppSec and related professional communities.<br />
# Provide inclusive targeted application security programs for all women learners.<br />
# Provide inclusive training and mentorship for all interested OWASP women.<br />
# Provide financial support to OWASP women members through scholarships, sponsorships, and grant making.<br />
# Pursue fundraising, advancement and development to secure financial support for OWASP WIA activities..<br />
# Integrate WIA track and related activities into OWASP events at all levels.<br />
# Cultivate women for community leadership, speakers for conferences, thought leadership, learning leaders, and local chapter events.<br />
# Collaborate with other committees and initiatives as needs present.<br />
# Collaborate with local OWASP Chapters and Global OWASP leadership, including but not limited to offering advisory support to local and global OWASP leadership for WIA advancement and collaboratively building pro-WIA OWASP communities.<br />
# Develop other special projects and events designed to further the purpose of WIA.<br />
<br />
=MEMBERSHIP=<br />
<br />
==Membership Types==<br />
<br />
===Voting===<br />
<br />
Voting Members are members of OWASP who have formally joined the WIA Committee. Voting Members are allowed to vote on Committee business and are allowed to serve in one of the five officer positions of the Committee.<br />
<br />
In order to become a Voting Member, you must first become a Participating Member and participate for three months, become an OWASP member in good standing, and obtain a written endorsement from a current Voting Member or an OWASP Board of Director. Once all three criteria are met, you must formally request to join as a Voting Member to the WIA List. The Voting Members then vote via the WIA list, and if you receive a majority affirmative vote, you are then made a Voting Member. <br />
<br />
Voting Members have an obligation to maintain participation and to reaffirm their commitment every six months (the Secretary will send an email every six months to affirm commitment, replying "no" or not replying will result in removal).<br />
<br />
===Participating===<br />
<br />
Participating Members are anyone that is interested in volunteering time to the WIA Committee or sub-committees. Participating Members are able to participate in all activities, with the exception of voting and serving in one of the five Committee officer roles.<br />
<br />
In order to become a Participating member, you must express your volunteering commitment to the Secretary, who will then add you to the Membership List. Participating Members can withdraw their commitment at any time by notifying the Secretary. Participating Members do not need to be OWASP members.<br />
<br />
==Membership List==<br />
<br />
[https://docs.google.com/spreadsheets/d/1T7I0FJwfrI-h3XY-iL5URNNeZ-A0wxPTV0nfQHrSZVs/edit?usp=sharing Membership List]<br />
<br />
=GOVERNANCE=<br />
<br />
==Operating Model==<br />
<br />
WIA is a formal Committee of OWASP. WIA is governed by the rules set forth in the [https://www.owasp.org/index.php/Governance/OWASP_Committees OWASP Committees 2.0 Operational Model].<br />
<br />
==Committee Officers==<br />
<br />
#Chair<br />
##TBD for 2017 Term<br />
##Duties<br />
###Open/run the meetings<br />
###Put items to vote and announce the result<br />
###Oversee progress of committee activities<br />
###Participates in fundraising activities/sponsorship acquisition<br />
#Vice-Chair<br />
##TBD for 2017 Term<br />
##Duties<br />
###Serve in place of the chair when the chair is not available, temporarily or permanently<br />
###Confirm and validate results of votes<br />
###Help the chair oversee progress of committee activities<br />
###Participates in fundraising activities/sponsorship acquisition<br />
###Run doodles for upcoming meetings <br />
###Send out meeting invites<br />
#Secretary<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain the WIA membership list and associated bookkeeping<br />
###Take attendance/minutes at meetings<br />
###Create an agenda for each meeting, put out a call to members for agenda items<br />
###Post agendas and meetings<br />
###Edit/update committee Wiki page<br />
#Treasurer<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain budget<br />
###Track income and expenses for all committee activities<br />
###Report at each meeting the expenditures and incoming revenue for the month and the balance of the fund<br />
###Check the balance of the WIA budget with the OWASP accountant quarterly<br />
###Participates in fundraising activities/sponsorship acquisition<br />
<br />
Note: Only Voting Members may serve as Committee Officers<br />
<br />
==Sub-Committee Coordinators==<br />
<br />
#Volunteer Coordinator<br />
##TBD for 2017 Term<br />
##Duties<br />
###Recruit new members for WIA/volunteers for specific events<br />
###Schedule/train volunteers as needed<br />
###Provides direction and coordination for volunteers<br />
###Plan for retention and replacement<br />
###Support in fundraising activities/sponsorship acquisition<br />
###Connect with other local active groups in security to create volunteer networking<br />
###Maintain lessons learned in the volunteer recruiting for the different events to improve the recruiting process<br />
###Keep informal/formal contacts with all the volunteer to be able to reach them in case of new needs<br />
#Media Relations Coordinator<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain list of media contacts<br />
###Maintain list of media articles mentioning WIA<br />
###Promote WIA to media<br />
###Prepare talking points, messaging strategy<br />
###Work with OWASP Global to issue press releases<br />
<br />
Note: All Committee Members may serve as Sub-Committee Coordinators<br />
<br />
=2017 ELECTIONS=<br />
<br />
==Timeline==<br />
* June 23, 2017 (Friday) - Call for Candidates closes<br />
* June 24, 2017 (Saturday) - Election emails send to voting members<br />
* July 2, 2017 (Sunday) - Election closes<br />
* July 3, 2017 (Monday) - Election results announced on WIA list<br />
<br />
==Candidates==<br />
===Committee Officers===<br />
<br />
''Positions can only be filled by Voting Members.''<br />
<br />
====Chair====<br />
* Bev Corwin<br />
<br />
====Vice Chair====<br />
* Loredana Mancini <br />
* Cathy Hall<br />
<br />
====Secretary====<br />
* Cathy Hall <br />
<br />
====Treasurer====<br />
* Cathy Hall<br />
<br />
===Sub-Committee Coordinators===<br />
<br />
''Positions can be filled by Voting and Participating Members.''<br />
<br />
====Volunteer Coordinator====<br />
*Wendy Istvanick<br />
*Loredana Mancini<br />
<br />
====Media Relations Coordinator====<br />
* None<br />
<br />
<br />
=PREVIOUS WIA ACTIVITIES=<br />
<br />
<br />
== AppSec EU 2017 ==<br />
Women in AppSec is kicking it up a notch at AppSec EU 2017 and we want YOU to join us! Make sure you stop by during the week to check out our events and to learn more about the group.<br />
<br />
Events are free to attend and do not require a conference ticket.<br />
<br />
Monday, May 8, 2017 6:00-9:00 pm Networking Session<br />
<br />
On Monday 8th May at 6:00 pm in the Waterfront Conference Centre, we will have a group of mentors each give a brief talk about their experience followed by an "unconference" event. During the "unconference" event, we will break into groups to discuss popular technical topics. This will be a fantastic opportunity to engage in mentoring relationships and hear from women in the field. You can sign up for this free event on Meetup.com here: <nowiki>https://www.meetup.com/OWASP-Belfast/events/238434511/</nowiki><br />
<br />
Thursday, May 11, 2017 7:30-8:45 a.m. Mentoring Breakfast<br />
<br />
Join us at our pre-conference WiA breakfast in the Waterfront Conference Centre at 7.30 am on Thursday 11th May. A light breakfast will be provided for table discussions on various topics. This will also be a second opportunity to chat with anyone you didn't get to during the Monday evening event. Details to register for this event will be available soon, it will also be free to attend.<br />
<br />
=== Wondering what to expect? ===<br />
Organisers Michelle and Claire discuss what you can expect here:<br />
<br />
<nowiki>https://drive.google.com/open?id=0B3mw0mZ4CcgtbG5FUDJxbzVqX28</nowiki><br />
<br />
=== Interested in being a Mentor? ===<br />
We’re looking for mentors to participate in both events. Both men and women are invited to contribute as mentors. This is the commitment we’re asking for:<br />
* A picture and bio for the website<br />
* A time commitment of two hours between the two events<br />
** 30+ minutes at the networking event<br />
** 1½ hours at the mentoring breakfast<br />
Let us know if you’re interested in joining us!<br />
<br />
<nowiki>https://docs.google.com/forms/d/e/1FAIpQLSfy0qx9hnkJiCiceeUDmaq78i9aYXeGsHNv9B95Z_ZeN5Z_KA/viewform</nowiki><br />
<br />
Not sure if you’re interested yet? Provide your email address for updates as they become available.<br />
<br />
<nowiki>https://docs.google.com/forms/d/e/1FAIpQLSc2DYBKcGzESX6U8-Syohqvm_g7bLLyTBPaw5E7sUj5KO3O4A/viewform</nowiki><br />
<br />
'''We look forward to seeing you at AppSec EU 2017!'''<br />
<br />
=== Meet the EU WIA planning team ===<br />
* === Michelle Simpson === Security Consultant at NCC Group<br />
* === Claire Burn === Field Applications Engineer at Titan-IC<br />
* === Cathy Hall === Principal Consultant at Sila Solutions Group<br />
* === Owen Pendelbury === Manager Cyber Risk Services - Penetration Testing @ Deloitte<br />
* === Zoe Braiterman === Business Studies graduate from Drew University<br />
* === Wendy Istvanick === Object Tactician at ThoughtWorks<br />
* === Fiona Collins === IT Security Engineer, Staff at Qualcomm<br />
* === Bev Corwin === Director of Technology at DDC<br />
* === Loredana Mancini === Chief Operation Officer at ITWAY<br />
* === Emily Verwee === Online Project Manager at The Arc of the United States<br />
* === Tiffany Long === Community Manager at OWASP<br />
<br />
== AppSec USA 2015 ==<br />
<br />
'''AppSec USA 2015'''<br><br />
The Women in AppSec (WIA) program is for all OWASP members who believe that diversity is important to the success of an organization, as well as for women who want to make career connections with like-minded colleagues. We encourage you to attend our session on Thursday at 3:30pm in Room F, featuring the founders of InfoSec Girls, Apoorva Giri and Shruthi Kamath.<br><br><br />
We also invite you to join us for our networking and “Birds of a Feather” sessions on on Thursday in WIA meeting room . Stop by anytime between 10:00am and 3:30pm to meet other members and learn more about the WIA program. You can also suggest a discussion topic on the sign-up at the room entrance. <br><br><br />
Sponsorship opportunities for commercial organizations and OWASP chapters are also available.<br />
<br />
'''AppSec USA 2015'''<br><br />
Currently, there is an effort to plan activities for AppSec USA 2015. Volunteers are eagerly sought to support the program at AppSec USA! We are especially excited to invite the founders of the '''InfoSec Girls''' initiative to the AppSec USA 2015 conference. To bring InfoSec Girls to AppSec USA, we need to raise $7500. We are very close to our goal and know that with the support of the OWASP community, we can easily get there! Donations above and beyond our goal will be used for future WIA programs around the world. <BR><br>'''Donate now:'''<br><br />
<br />
== AppSec EU 2015 ==<br />
During AppSec EU there was a panel discussion and workshop supported by the Women in AppSec initiative. Through these sessions we hoped to encourage women to pursue a career in AppSec and help them realize it is an option for them. These sessions was be open to all so we can help build support for the women around us. Learn more here: [http://2015.appsec.eu/women-in-application-security/ http://2015.appsec.eu/women-in-application-security]<br><br />
<br />
'''Panel: "Women in AppSec - Making it Happen"'''<br><br />
During this panel session we discussed what can be done to Make it Happen for Women in AppSec going forward. What have those currently working in the field done to Make it Happen for themselves and other women; what tips and advice do they have to help you do to make a career for yourself or encourage those around you (sister, friend, daughter, etc…) to pursue a career in AppSec? What can we as professionals can do to help encourage girls to go for a career in AppSec?<br />
<br />
'''Workshop'''<br><br />
During the workshop we introduced female attendees of the conference to what a career in App Sec can involve. We discussed application security and the many career paths available. We hope to build relationships that may lead to a mentoring program for these women.<br />
<br />
== AppSec USA 2013 ==<br />
Learn more about the program here: http://2013.appsecusa.org/2013/activities/owasp-women-in-application-security-appsec-program/index.html <br />
<br />
==Previous Women in AppSec Winners==<br />
Following their experience at AppSec, winners are encouraged to write a short piece about their experience at the conference and their participation in the Women in AppSec program. Here, they outline their experience with the Women in AppSec Program in their own words. <br />
<br />
'''Carrie Schaper, 2013 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Carrie Schaper Small.jpg|100px]]<br />
| align="justify" |"OWASP Appsec proved to be a great experience for me, uniting and interacting with friends, professionals, and colleagues from the Information Security space from across the US and Internationally whom were in attendance. The huge space and well organized functions such as the: trainings, expert talks, panels, bug-bounty, lock-picking village and social events all enhanced the conference experience. Participating on the Women in IT panel was a wonderful experience, as many women were in attendance and participated in collaborative discussions. OWASP Appsec held in NY this year, was a premier NY conference not to be missed. Thank you to OWASP, its attendees and organizers."<br />
|}<br />
<br><br />
<br />
'''Nancy Lornston, 2013 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Nancy Lorntson Small.jpg|100px]]<br />
| align="justify" |"AppSec 2013 was an awesome experience! Nowhere in the world can you find the top security experts all in one place at one time (and participate in a marriage proposal!). The conference presentations were well organized and the speakers were prepared to share pros, cons, successes and failures of their work in order to advance the application security domain. The variety of vendors was terrific as well.<br />
<br />
The Women in AppSec panel was an opportunity to advance women's position in the community. Each speaker shared some very candid remarks about their personal experiences and by the end, it was clear that while more work needs to be done, there is a sincere interest by companies, universities and the industry in general to work on doing the things needed to attract more women to the profession.<br />
<br />
The training course I attended (Open source tools) lived up to it's billing and I came away with several invaluable tips and strategies to improve our program.<br />
<br />
A huge thank you to the Women in App Sec Panel and OWASP in general for this opportunity to attend the premier Application Security Conference in the world."<br />
|}<br />
<br><br />
<br />
'''Tara Wilson, 2011 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Tara wilson.jpg|100px]]<br />
| align="justify" |“Being fortunate enough to receive the Women in AppSec sponsorhsip is a unique and valuable experience. It is a great opportunity for women to have a chance to bolster their skills and dive deep into the world of application security. I found that attending the conference was not only a great way to experience what the OWASP community has to offer, but it also gives students a chance to network with a great group of people who are passionate about their field and willing to share a wealth of information.” <br />
|}<br />
<br><br />
<br />
'''Chandni Bhowmik, 2011 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Chandni_bhowmik.jpg|100px]]<br />
| align="justify" |Chandni Bhowmik is currently completing an M.S. in Computer Security and Information Assurance at the Rochester Institute of Technology (RIT). Her first introduction to OWASP was through the project WebScarab during an application security lab last spring at RIT and her interest in OWASP grew ever since. Over the summer, she started programming open source web applications using built-in security features of Django and Python. She is interested in becoming an information security researcher, and hopes to leverage learning at OWASP AppSec USA 2011 in ad-hoc architecture, mobile platforms and over-all concepts of web application security. Besides secure programming, Chandni enjoys her current research involving digital image forensics and machine learning. In addition to attending school, she has interned in IT security and compliance at Paychex, a Rochester based payroll processing company, and gained industrial experience working an assistant systems engineer for Tata Consultancy Services, a global IT firm. <br />
|}<br />
<br><br />
<br />
<headertabs></headertabs></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Women_In_AppSec&diff=230910Women In AppSec2017-06-22T19:47:33Z<p>Owen Pendlebury: </p>
<hr />
<div>=WELCOME=<br />
<br />
==Women in Application Security Committee==<br />
<br />
The purpose of Women in AppSec (WIA) Committee is to develop leadership, promote active membership and participation, and contributions by women in application security professional communities, globally and locally.<br />
<br />
The Women in AppSec program is for anyone who believes that diversity is important to the success of the organization, as well as for women looking to learn more about AppSec or who want to make career connections with like-minded colleagues. This includes female undergraduate and graduate students, instructors, and professionals who are dedicated to information security or application development. <br />
<br />
=FIND US=<br />
<br />
==Email List==<br />
<br />
[https://lists.owasp.org/mailman/listinfo/appsec_usa_women_in_security WIA List and Archive]<br />
<br />
==Twitter==<br />
<br />
[https://twitter.com/owaspwia @OWASPWIA]<br />
<br />
==Slack Channel==<br />
<br />
[https://owasp.slack.com/messages/C2NUH1J5B/ WIA Slack Channel]<br />
<br />
You can get an OWASP Slack invite here: [https://owasp.herokuapp.com/ OWASP Slack Invite]<br />
<br />
=WIA PURPOSE AND SCOPE=<br />
<br />
==Purpose==<br />
<br />
The purpose of Women in AppSec (WIA) Committee is to develop leadership, promote active membership and participation, and contributions by women in application security professional communities, globally and locally. <br />
<br />
==Scope==<br />
<br />
The scope for OWASP WIA Committee falls into the following areas:<br />
<br />
# Attract women to OWASP, as active members, contributors and leaders.<br />
# Offer opportunities for women to become engaged in AppSec and related professional communities.<br />
# Provide inclusive targeted application security programs for all women learners.<br />
# Provide inclusive training and mentorship for all interested OWASP women.<br />
# Provide financial support to OWASP women members through scholarships, sponsorships, and grant making.<br />
# Pursue fundraising, advancement and development to secure financial support for OWASP WIA activities..<br />
# Integrate WIA track and related activities into OWASP events at all levels.<br />
# Cultivate women for community leadership, speakers for conferences, thought leadership, learning leaders, and local chapter events.<br />
# Collaborate with other committees and initiatives as needs present.<br />
# Collaborate with local OWASP Chapters and Global OWASP leadership, including but not limited to offering advisory support to local and global OWASP leadership for WIA advancement and collaboratively building pro-WIA OWASP communities.<br />
# Develop other special projects and events designed to further the purpose of WIA.<br />
<br />
=MEMBERSHIP=<br />
<br />
==Membership Types==<br />
<br />
===Voting===<br />
<br />
Voting Members are members of OWASP who have formally joined the WIA Committee. Voting Members are allowed to vote on Committee business and are allowed to serve in one of the five officer positions of the Committee.<br />
<br />
In order to become a Voting Member, you must first become a Participating Member and participate for three months, become an OWASP member in good standing, and obtain a written endorsement from a current Voting Member or an OWASP Board of Director. Once all three criteria are met, you must formally request to join as a Voting Member to the WIA List. The Voting Members then vote via the WIA list, and if you receive a majority affirmative vote, you are then made a Voting Member. <br />
<br />
Voting Members have an obligation to maintain participation and to reaffirm their commitment every six months (the Secretary will send an email every six months to affirm commitment, replying "no" or not replying will result in removal).<br />
<br />
===Participating===<br />
<br />
Participating Members are anyone that is interested in volunteering time to the WIA Committee or sub-committees. Participating Members are able to participate in all activities, with the exception of voting and serving in one of the five Committee officer roles.<br />
<br />
In order to become a Participating member, you must express your volunteering commitment to the Secretary, who will then add you to the Membership List. Participating Members can withdraw their commitment at any time by notifying the Secretary. Participating Members do not need to be OWASP members.<br />
<br />
==Membership List==<br />
<br />
[https://docs.google.com/spreadsheets/d/1T7I0FJwfrI-h3XY-iL5URNNeZ-A0wxPTV0nfQHrSZVs/edit?usp=sharing Membership List]<br />
<br />
=GOVERNANCE=<br />
<br />
==Operating Model==<br />
<br />
WIA is a formal Committee of OWASP. WIA is governed by the rules set forth in the [https://www.owasp.org/index.php/Governance/OWASP_Committees OWASP Committees 2.0 Operational Model].<br />
<br />
==Committee Officers==<br />
<br />
#Chair<br />
##TBD for 2017 Term<br />
##Duties<br />
###Open/run the meetings<br />
###Put items to vote and announce the result<br />
###Oversee progress of committee activities<br />
###Participates in fundraising activities/sponsorship acquisition<br />
#Vice-Chair<br />
##TBD for 2017 Term<br />
##Duties<br />
###Serve in place of the chair when the chair is not available, temporarily or permanently<br />
###Confirm and validate results of votes<br />
###Help the chair oversee progress of committee activities<br />
###Participates in fundraising activities/sponsorship acquisition<br />
###Run doodles for upcoming meetings <br />
###Send out meeting invites<br />
#Secretary<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain the WIA membership list and associated bookkeeping<br />
###Take attendance/minutes at meetings<br />
###Create an agenda for each meeting, put out a call to members for agenda items<br />
###Post agendas and meetings<br />
###Edit/update committee Wiki page<br />
#Treasurer<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain budget<br />
###Track income and expenses for all committee activities<br />
###Report at each meeting the expenditures and incoming revenue for the month and the balance of the fund<br />
###Check the balance of the WIA budget with the OWASP accountant quarterly<br />
###Participates in fundraising activities/sponsorship acquisition<br />
<br />
Note: Only Voting Members may serve as Committee Officers<br />
<br />
==Sub-Committee Coordinators==<br />
<br />
#Volunteer Coordinator<br />
##TBD for 2017 Term<br />
##Duties<br />
###Recruit new members for WIA/volunteers for specific events<br />
###Schedule/train volunteers as needed<br />
###Provides direction and coordination for volunteers<br />
###Plan for retention and replacement<br />
###Support in fundraising activities/sponsorship acquisition<br />
###Connect with other local active groups in security to create volunteer networking<br />
###Maintain lessons learned in the volunteer recruiting for the different events to improve the recruiting process<br />
###Keep informal/formal contacts with all the volunteer to be able to reach them in case of new needs<br />
#Media Relations Coordinator<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain list of media contacts<br />
###Maintain list of media articles mentioning WIA<br />
###Promote WIA to media<br />
###Prepare talking points, messaging strategy<br />
###Work with OWASP Global to issue press releases<br />
<br />
Note: All Committee Members may serve as Sub-Committee Coordinators<br />
<br />
=2017 ELECTIONS=<br />
<br />
==Timeline==<br />
* June 23, 2017 (Friday) - Call for Candidates closes<br />
* June 24, 2017 (Saturday) - Election emails send to voting members<br />
* July 2, 2017 (Sunday) - Election closes<br />
* July 3, 2017 (Monday) - Election results announced on WIA list<br />
<br />
==Candidates==<br />
===Committee Officers===<br />
<br />
''Positions can only be filled by Voting Members.''<br />
<br />
====Chair====<br />
* Bev Corwin<br />
<br />
====Vice Chair====<br />
* Loredana Mancini <br />
* Cathy Hall<br />
<br />
====Secretary====<br />
* Cathy Hall <br />
<br />
====Treasurer====<br />
* Cathy Hall<br />
<br />
===Sub-Committee Coordinators===<br />
<br />
''Positions can be filled by Voting and Participating Members.''<br />
<br />
====Volunteer Coordinator====<br />
*Wendy Istvanick<br />
*Loredana Mancini<br />
<br />
====Media Relations Coordinator====<br />
* None<br />
<br />
<br />
=PREVIOUS WIA ACTIVITIES=<br />
<br />
<br />
== AppSec EU 2017 ==<br />
Women in AppSec is kicking it up a notch at AppSec EU 2017 and we want YOU to join us! Make sure you stop by during the week to check out our events and to learn more about the group.<br />
<br />
Events are free to attend and do not require a conference ticket.<br />
<br />
Monday, May 8, 2017 6:00-9:00 pm Networking Session<br />
<br />
On Monday 8th May at 6:00 pm in the Waterfront Conference Centre, we will have a group of mentors each give a brief talk about their experience followed by an "unconference" event. During the "unconference" event, we will break into groups to discuss popular technical topics. This will be a fantastic opportunity to engage in mentoring relationships and hear from women in the field. You can sign up for this free event on Meetup.com here: <nowiki>https://www.meetup.com/OWASP-Belfast/events/238434511/</nowiki><br />
<br />
Thursday, May 11, 2017 7:30-8:45 a.m. Mentoring Breakfast<br />
<br />
Join us at our pre-conference WiA breakfast in the Waterfront Conference Centre at 7.30 am on Thursday 11th May. A light breakfast will be provided for table discussions on various topics. This will also be a second opportunity to chat with anyone you didn't get to during the Monday evening event. Details to register for this event will be available soon, it will also be free to attend.<br />
<br />
== Wondering what to expect? ==<br />
Organisers Michelle and Claire discuss what you can expect here:<br />
<br />
<nowiki>https://drive.google.com/open?id=0B3mw0mZ4CcgtbG5FUDJxbzVqX28</nowiki><br />
<br />
== Interested in being a Mentor? ==<br />
We’re looking for mentors to participate in both events. Both men and women are invited to contribute as mentors. This is the commitment we’re asking for:<br />
* A picture and bio for the website<br />
* A time commitment of two hours between the two events<br />
** 30+ minutes at the networking event<br />
** 1½ hours at the mentoring breakfast<br />
Let us know if you’re interested in joining us!<br />
<br />
<nowiki>https://docs.google.com/forms/d/e/1FAIpQLSfy0qx9hnkJiCiceeUDmaq78i9aYXeGsHNv9B95Z_ZeN5Z_KA/viewform</nowiki><br />
<br />
Not sure if you’re interested yet? Provide your email address for updates as they become available.<br />
<br />
<nowiki>https://docs.google.com/forms/d/e/1FAIpQLSc2DYBKcGzESX6U8-Syohqvm_g7bLLyTBPaw5E7sUj5KO3O4A/viewform</nowiki><br />
<br />
'''We look forward to seeing you at AppSec EU 2017!'''<br />
<br />
== Meet the EU WIA planning team ==<br />
* === Michelle Simpson === Security Consultant at NCC Group<br />
* === Claire Burn === Field Applications Engineer at Titan-IC<br />
* === Cathy Hall === Principal Consultant at Sila Solutions Group<br />
* === Owen Pendelbury === Manager Cyber Risk Services - Penetration Testing @ Deloitte<br />
* === Zoe Braiterman === Business Studies graduate from Drew University<br />
* === Wendy Istvanick === Object Tactician at ThoughtWorks<br />
* === Fiona Collins === IT Security Engineer, Staff at Qualcomm<br />
* === Bev Corwin === Director of Technology at DDC<br />
* === Loredana Mancini === Chief Operation Officer at ITWAY<br />
* === Emily Verwee === Online Project Manager at The Arc of the United States<br />
* === Tiffany Long === Community Manager at OWASP<br />
<br />
== AppSec USA 2015 ==<br />
<br />
'''AppSec USA 2015'''<br><br />
The Women in AppSec (WIA) program is for all OWASP members who believe that diversity is important to the success of an organization, as well as for women who want to make career connections with like-minded colleagues. We encourage you to attend our session on Thursday at 3:30pm in Room F, featuring the founders of InfoSec Girls, Apoorva Giri and Shruthi Kamath.<br><br><br />
We also invite you to join us for our networking and “Birds of a Feather” sessions on on Thursday in WIA meeting room . Stop by anytime between 10:00am and 3:30pm to meet other members and learn more about the WIA program. You can also suggest a discussion topic on the sign-up at the room entrance. <br><br><br />
Sponsorship opportunities for commercial organizations and OWASP chapters are also available.<br />
<br />
'''AppSec USA 2015'''<br><br />
Currently, there is an effort to plan activities for AppSec USA 2015. Volunteers are eagerly sought to support the program at AppSec USA! We are especially excited to invite the founders of the '''InfoSec Girls''' initiative to the AppSec USA 2015 conference. To bring InfoSec Girls to AppSec USA, we need to raise $7500. We are very close to our goal and know that with the support of the OWASP community, we can easily get there! Donations above and beyond our goal will be used for future WIA programs around the world. <BR><br>'''Donate now:'''<br><br />
<br />
== AppSec EU 2015 ==<br />
During AppSec EU there was a panel discussion and workshop supported by the Women in AppSec initiative. Through these sessions we hoped to encourage women to pursue a career in AppSec and help them realize it is an option for them. These sessions was be open to all so we can help build support for the women around us. Learn more here: [http://2015.appsec.eu/women-in-application-security/ http://2015.appsec.eu/women-in-application-security]<br><br />
<br />
'''Panel: "Women in AppSec - Making it Happen"'''<br><br />
During this panel session we discussed what can be done to Make it Happen for Women in AppSec going forward. What have those currently working in the field done to Make it Happen for themselves and other women; what tips and advice do they have to help you do to make a career for yourself or encourage those around you (sister, friend, daughter, etc…) to pursue a career in AppSec? What can we as professionals can do to help encourage girls to go for a career in AppSec?<br />
<br />
'''Workshop'''<br><br />
During the workshop we introduced female attendees of the conference to what a career in App Sec can involve. We discussed application security and the many career paths available. We hope to build relationships that may lead to a mentoring program for these women.<br />
<br />
== AppSec USA 2013 ==<br />
Learn more about the program here: http://2013.appsecusa.org/2013/activities/owasp-women-in-application-security-appsec-program/index.html <br />
<br />
==Previous Women in AppSec Winners==<br />
Following their experience at AppSec, winners are encouraged to write a short piece about their experience at the conference and their participation in the Women in AppSec program. Here, they outline their experience with the Women in AppSec Program in their own words. <br />
<br />
'''Carrie Schaper, 2013 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Carrie Schaper Small.jpg|100px]]<br />
| align="justify" |"OWASP Appsec proved to be a great experience for me, uniting and interacting with friends, professionals, and colleagues from the Information Security space from across the US and Internationally whom were in attendance. The huge space and well organized functions such as the: trainings, expert talks, panels, bug-bounty, lock-picking village and social events all enhanced the conference experience. Participating on the Women in IT panel was a wonderful experience, as many women were in attendance and participated in collaborative discussions. OWASP Appsec held in NY this year, was a premier NY conference not to be missed. Thank you to OWASP, its attendees and organizers."<br />
|}<br />
<br><br />
<br />
'''Nancy Lornston, 2013 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Nancy Lorntson Small.jpg|100px]]<br />
| align="justify" |"AppSec 2013 was an awesome experience! Nowhere in the world can you find the top security experts all in one place at one time (and participate in a marriage proposal!). The conference presentations were well organized and the speakers were prepared to share pros, cons, successes and failures of their work in order to advance the application security domain. The variety of vendors was terrific as well.<br />
<br />
The Women in AppSec panel was an opportunity to advance women's position in the community. Each speaker shared some very candid remarks about their personal experiences and by the end, it was clear that while more work needs to be done, there is a sincere interest by companies, universities and the industry in general to work on doing the things needed to attract more women to the profession.<br />
<br />
The training course I attended (Open source tools) lived up to it's billing and I came away with several invaluable tips and strategies to improve our program.<br />
<br />
A huge thank you to the Women in App Sec Panel and OWASP in general for this opportunity to attend the premier Application Security Conference in the world."<br />
|}<br />
<br><br />
<br />
'''Tara Wilson, 2011 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Tara wilson.jpg|100px]]<br />
| align="justify" |“Being fortunate enough to receive the Women in AppSec sponsorhsip is a unique and valuable experience. It is a great opportunity for women to have a chance to bolster their skills and dive deep into the world of application security. I found that attending the conference was not only a great way to experience what the OWASP community has to offer, but it also gives students a chance to network with a great group of people who are passionate about their field and willing to share a wealth of information.” <br />
|}<br />
<br><br />
<br />
'''Chandni Bhowmik, 2011 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Chandni_bhowmik.jpg|100px]]<br />
| align="justify" |Chandni Bhowmik is currently completing an M.S. in Computer Security and Information Assurance at the Rochester Institute of Technology (RIT). Her first introduction to OWASP was through the project WebScarab during an application security lab last spring at RIT and her interest in OWASP grew ever since. Over the summer, she started programming open source web applications using built-in security features of Django and Python. She is interested in becoming an information security researcher, and hopes to leverage learning at OWASP AppSec USA 2011 in ad-hoc architecture, mobile platforms and over-all concepts of web application security. Besides secure programming, Chandni enjoys her current research involving digital image forensics and machine learning. In addition to attending school, she has interned in IT security and compliance at Paychex, a Rochester based payroll processing company, and gained industrial experience working an assistant systems engineer for Tata Consultancy Services, a global IT firm. <br />
|}<br />
<br><br />
<br />
<headertabs></headertabs></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Women_In_AppSec&diff=230909Women In AppSec2017-06-22T19:45:14Z<p>Owen Pendlebury: added EU 2017</p>
<hr />
<div>=WELCOME=<br />
<br />
==Women in Application Security Committee==<br />
<br />
The purpose of Women in AppSec (WIA) Committee is to develop leadership, promote active membership and participation, and contributions by women in application security professional communities, globally and locally.<br />
<br />
The Women in AppSec program is for anyone who believes that diversity is important to the success of the organization, as well as for women looking to learn more about AppSec or who want to make career connections with like-minded colleagues. This includes female undergraduate and graduate students, instructors, and professionals who are dedicated to information security or application development. <br />
<br />
=FIND US=<br />
<br />
==Email List==<br />
<br />
[https://lists.owasp.org/mailman/listinfo/appsec_usa_women_in_security WIA List and Archive]<br />
<br />
==Twitter==<br />
<br />
[https://twitter.com/owaspwia @OWASPWIA]<br />
<br />
==Slack Channel==<br />
<br />
[https://owasp.slack.com/messages/C2NUH1J5B/ WIA Slack Channel]<br />
<br />
You can get an OWASP Slack invite here: [https://owasp.herokuapp.com/ OWASP Slack Invite]<br />
<br />
=WIA PURPOSE AND SCOPE=<br />
<br />
==Purpose==<br />
<br />
The purpose of Women in AppSec (WIA) Committee is to develop leadership, promote active membership and participation, and contributions by women in application security professional communities, globally and locally. <br />
<br />
==Scope==<br />
<br />
The scope for OWASP WIA Committee falls into the following areas:<br />
<br />
# Attract women to OWASP, as active members, contributors and leaders.<br />
# Offer opportunities for women to become engaged in AppSec and related professional communities.<br />
# Provide inclusive targeted application security programs for all women learners.<br />
# Provide inclusive training and mentorship for all interested OWASP women.<br />
# Provide financial support to OWASP women members through scholarships, sponsorships, and grant making.<br />
# Pursue fundraising, advancement and development to secure financial support for OWASP WIA activities..<br />
# Integrate WIA track and related activities into OWASP events at all levels.<br />
# Cultivate women for community leadership, speakers for conferences, thought leadership, learning leaders, and local chapter events.<br />
# Collaborate with other committees and initiatives as needs present.<br />
# Collaborate with local OWASP Chapters and Global OWASP leadership, including but not limited to offering advisory support to local and global OWASP leadership for WIA advancement and collaboratively building pro-WIA OWASP communities.<br />
# Develop other special projects and events designed to further the purpose of WIA.<br />
<br />
=MEMBERSHIP=<br />
<br />
==Membership Types==<br />
<br />
===Voting===<br />
<br />
Voting Members are members of OWASP who have formally joined the WIA Committee. Voting Members are allowed to vote on Committee business and are allowed to serve in one of the five officer positions of the Committee.<br />
<br />
In order to become a Voting Member, you must first become a Participating Member and participate for three months, become an OWASP member in good standing, and obtain a written endorsement from a current Voting Member or an OWASP Board of Director. Once all three criteria are met, you must formally request to join as a Voting Member to the WIA List. The Voting Members then vote via the WIA list, and if you receive a majority affirmative vote, you are then made a Voting Member. <br />
<br />
Voting Members have an obligation to maintain participation and to reaffirm their commitment every six months (the Secretary will send an email every six months to affirm commitment, replying "no" or not replying will result in removal).<br />
<br />
===Participating===<br />
<br />
Participating Members are anyone that is interested in volunteering time to the WIA Committee or sub-committees. Participating Members are able to participate in all activities, with the exception of voting and serving in one of the five Committee officer roles.<br />
<br />
In order to become a Participating member, you must express your volunteering commitment to the Secretary, who will then add you to the Membership List. Participating Members can withdraw their commitment at any time by notifying the Secretary. Participating Members do not need to be OWASP members.<br />
<br />
==Membership List==<br />
<br />
[https://docs.google.com/spreadsheets/d/1T7I0FJwfrI-h3XY-iL5URNNeZ-A0wxPTV0nfQHrSZVs/edit?usp=sharing Membership List]<br />
<br />
=GOVERNANCE=<br />
<br />
==Operating Model==<br />
<br />
WIA is a formal Committee of OWASP. WIA is governed by the rules set forth in the [https://www.owasp.org/index.php/Governance/OWASP_Committees OWASP Committees 2.0 Operational Model].<br />
<br />
==Committee Officers==<br />
<br />
#Chair<br />
##TBD for 2017 Term<br />
##Duties<br />
###Open/run the meetings<br />
###Put items to vote and announce the result<br />
###Oversee progress of committee activities<br />
###Participates in fundraising activities/sponsorship acquisition<br />
#Vice-Chair<br />
##TBD for 2017 Term<br />
##Duties<br />
###Serve in place of the chair when the chair is not available, temporarily or permanently<br />
###Confirm and validate results of votes<br />
###Help the chair oversee progress of committee activities<br />
###Participates in fundraising activities/sponsorship acquisition<br />
###Run doodles for upcoming meetings <br />
###Send out meeting invites<br />
#Secretary<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain the WIA membership list and associated bookkeeping<br />
###Take attendance/minutes at meetings<br />
###Create an agenda for each meeting, put out a call to members for agenda items<br />
###Post agendas and meetings<br />
###Edit/update committee Wiki page<br />
#Treasurer<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain budget<br />
###Track income and expenses for all committee activities<br />
###Report at each meeting the expenditures and incoming revenue for the month and the balance of the fund<br />
###Check the balance of the WIA budget with the OWASP accountant quarterly<br />
###Participates in fundraising activities/sponsorship acquisition<br />
<br />
Note: Only Voting Members may serve as Committee Officers<br />
<br />
==Sub-Committee Coordinators==<br />
<br />
#Volunteer Coordinator<br />
##TBD for 2017 Term<br />
##Duties<br />
###Recruit new members for WIA/volunteers for specific events<br />
###Schedule/train volunteers as needed<br />
###Provides direction and coordination for volunteers<br />
###Plan for retention and replacement<br />
###Support in fundraising activities/sponsorship acquisition<br />
###Connect with other local active groups in security to create volunteer networking<br />
###Maintain lessons learned in the volunteer recruiting for the different events to improve the recruiting process<br />
###Keep informal/formal contacts with all the volunteer to be able to reach them in case of new needs<br />
#Media Relations Coordinator<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain list of media contacts<br />
###Maintain list of media articles mentioning WIA<br />
###Promote WIA to media<br />
###Prepare talking points, messaging strategy<br />
###Work with OWASP Global to issue press releases<br />
<br />
Note: All Committee Members may serve as Sub-Committee Coordinators<br />
<br />
=2017 ELECTIONS=<br />
<br />
==Timeline==<br />
* June 23, 2017 (Friday) - Call for Candidates closes<br />
* June 24, 2017 (Saturday) - Election emails send to voting members<br />
* July 2, 2017 (Sunday) - Election closes<br />
* July 3, 2017 (Monday) - Election results announced on WIA list<br />
<br />
==Candidates==<br />
===Committee Officers===<br />
<br />
''Positions can only be filled by Voting Members.''<br />
<br />
====Chair====<br />
* Bev Corwin<br />
<br />
====Vice Chair====<br />
* Loredana Mancini <br />
* Cathy Hall<br />
<br />
====Secretary====<br />
* Cathy Hall <br />
<br />
====Treasurer====<br />
* Cathy Hall<br />
<br />
===Sub-Committee Coordinators===<br />
<br />
''Positions can be filled by Voting and Participating Members.''<br />
<br />
====Volunteer Coordinator====<br />
*Wendy Istvanick<br />
*Loredana Mancini<br />
<br />
====Media Relations Coordinator====<br />
* None<br />
<br />
<br />
=PREVIOUS WIA ACTIVITIES=<br />
<br />
== AppSec EU 2017 ==<br />
Women in AppSec is kicking it up a notch at AppSec EU 2017 and we want YOU to join us! Make sure you stop by during the week to check out our events and to learn more about the group.<br />
<br />
Events are free to attend and do not require a conference ticket.<br />
<br />
Monday, May 8, 2017<br />
<br />
6:00-9:00 pm<br />
<br />
Networking Session<br />
<br />
On Monday 8th May at 6:00 pm in the Waterfront Conference Centre, we will have a group of mentors each give a brief talk about their experience followed by an "unconference" event. During the "unconference" event, we will break into groups to discuss popular technical topics. This will be a fantastic opportunity to engage in mentoring relationships and hear from women in the field. You can sign up for this free event on Meetup.com here: <nowiki>https://www.meetup.com/OWASP-Belfast/events/238434511/</nowiki><br />
<br />
Thursday, May 11, 2017<br />
<br />
7:30-8:45 a.m.<br />
<br />
Mentoring Breakfast<br />
<br />
Join us at our pre-conference WiA breakfast in the Waterfront Conference Centre at 7.30 am on Thursday 11th May. A light breakfast will be provided for table discussions on various topics. This will also be a second opportunity to chat with anyone you didn't get to during the Monday evening event. Details to register for this event will be available soon, it will also be free to attend.<br />
<br />
== Wondering what to expect? ==<br />
Organisers Michelle and Claire discuss what you can expect here:<br />
<br />
<nowiki>https://drive.google.com/open?id=0B3mw0mZ4CcgtbG5FUDJxbzVqX28</nowiki><br />
<br />
== Interested in being a Mentor? ==<br />
We’re looking for mentors to participate in both events. Both men and women are invited to contribute as mentors. This is the commitment we’re asking for:<br />
* A picture and bio for the website<br />
* A time commitment of two hours between the two events<br />
** 30+ minutes at the networking event<br />
** 1½ hours at the mentoring breakfast<br />
Let us know if you’re interested in joining us!<br />
<br />
<nowiki>https://docs.google.com/forms/d/e/1FAIpQLSfy0qx9hnkJiCiceeUDmaq78i9aYXeGsHNv9B95Z_ZeN5Z_KA/viewform</nowiki><br />
<br />
Not sure if you’re interested yet? Provide your email address for updates as they become available.<br />
<br />
<nowiki>https://docs.google.com/forms/d/e/1FAIpQLSc2DYBKcGzESX6U8-Syohqvm_g7bLLyTBPaw5E7sUj5KO3O4A/viewform</nowiki><br />
<br />
'''We look forward to seeing you at AppSec EU 2017!'''<br />
<br />
== Meet the EU WIA planning team ==<br />
* === Michelle Simpson === Security Consultant at NCC Group<br />
* === Claire Burn === Field Applications Engineer at Titan-IC<br />
* === Cathy Hall === Principal Consultant at Sila Solutions Group<br />
* === Owen Pendelbury === Manager Cyber Risk Services - Penetration Testing @ Deloitte<br />
* === Zoe Braiterman === Business Studies graduate from Drew University<br />
* === Wendy Istvanick === Object Tactician at ThoughtWorks<br />
* === Fiona Collins === IT Security Engineer, Staff at Qualcomm<br />
* === Bev Corwin === Director of Technology at DDC<br />
* === Loredana Mancini === Chief Operation Officer at ITWAY<br />
* === Emily Verwee === Online Project Manager at The Arc of the United States<br />
* === Tiffany Long === Community Manager at OWASP<br />
<br />
== AppSec USA 2015 ==<br />
<br />
'''AppSec USA 2015'''<br><br />
The Women in AppSec (WIA) program is for all OWASP members who believe that diversity is important to the success of an organization, as well as for women who want to make career connections with like-minded colleagues. We encourage you to attend our session on Thursday at 3:30pm in Room F, featuring the founders of InfoSec Girls, Apoorva Giri and Shruthi Kamath.<br><br><br />
We also invite you to join us for our networking and “Birds of a Feather” sessions on on Thursday in WIA meeting room . Stop by anytime between 10:00am and 3:30pm to meet other members and learn more about the WIA program. You can also suggest a discussion topic on the sign-up at the room entrance. <br><br><br />
Sponsorship opportunities for commercial organizations and OWASP chapters are also available.<br />
<br />
'''AppSec USA 2015'''<br><br />
Currently, there is an effort to plan activities for AppSec USA 2015. Volunteers are eagerly sought to support the program at AppSec USA! We are especially excited to invite the founders of the '''InfoSec Girls''' initiative to the AppSec USA 2015 conference. To bring InfoSec Girls to AppSec USA, we need to raise $7500. We are very close to our goal and know that with the support of the OWASP community, we can easily get there! Donations above and beyond our goal will be used for future WIA programs around the world. <BR><br>'''Donate now:'''<br><br />
<br />
== AppSec EU 2015 ==<br />
During AppSec EU there was a panel discussion and workshop supported by the Women in AppSec initiative. Through these sessions we hoped to encourage women to pursue a career in AppSec and help them realize it is an option for them. These sessions was be open to all so we can help build support for the women around us. Learn more here: [http://2015.appsec.eu/women-in-application-security/ http://2015.appsec.eu/women-in-application-security]<br><br />
<br />
'''Panel: "Women in AppSec - Making it Happen"'''<br><br />
During this panel session we discussed what can be done to Make it Happen for Women in AppSec going forward. What have those currently working in the field done to Make it Happen for themselves and other women; what tips and advice do they have to help you do to make a career for yourself or encourage those around you (sister, friend, daughter, etc…) to pursue a career in AppSec? What can we as professionals can do to help encourage girls to go for a career in AppSec?<br />
<br />
'''Workshop'''<br><br />
During the workshop we introduced female attendees of the conference to what a career in App Sec can involve. We discussed application security and the many career paths available. We hope to build relationships that may lead to a mentoring program for these women.<br />
<br />
== AppSec USA 2013 ==<br />
Learn more about the program here: http://2013.appsecusa.org/2013/activities/owasp-women-in-application-security-appsec-program/index.html <br />
<br />
==Previous Women in AppSec Winners==<br />
Following their experience at AppSec, winners are encouraged to write a short piece about their experience at the conference and their participation in the Women in AppSec program. Here, they outline their experience with the Women in AppSec Program in their own words. <br />
<br />
'''Carrie Schaper, 2013 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Carrie Schaper Small.jpg|100px]]<br />
| align="justify" |"OWASP Appsec proved to be a great experience for me, uniting and interacting with friends, professionals, and colleagues from the Information Security space from across the US and Internationally whom were in attendance. The huge space and well organized functions such as the: trainings, expert talks, panels, bug-bounty, lock-picking village and social events all enhanced the conference experience. Participating on the Women in IT panel was a wonderful experience, as many women were in attendance and participated in collaborative discussions. OWASP Appsec held in NY this year, was a premier NY conference not to be missed. Thank you to OWASP, its attendees and organizers."<br />
|}<br />
<br><br />
<br />
'''Nancy Lornston, 2013 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Nancy Lorntson Small.jpg|100px]]<br />
| align="justify" |"AppSec 2013 was an awesome experience! Nowhere in the world can you find the top security experts all in one place at one time (and participate in a marriage proposal!). The conference presentations were well organized and the speakers were prepared to share pros, cons, successes and failures of their work in order to advance the application security domain. The variety of vendors was terrific as well.<br />
<br />
The Women in AppSec panel was an opportunity to advance women's position in the community. Each speaker shared some very candid remarks about their personal experiences and by the end, it was clear that while more work needs to be done, there is a sincere interest by companies, universities and the industry in general to work on doing the things needed to attract more women to the profession.<br />
<br />
The training course I attended (Open source tools) lived up to it's billing and I came away with several invaluable tips and strategies to improve our program.<br />
<br />
A huge thank you to the Women in App Sec Panel and OWASP in general for this opportunity to attend the premier Application Security Conference in the world."<br />
|}<br />
<br><br />
<br />
'''Tara Wilson, 2011 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Tara wilson.jpg|100px]]<br />
| align="justify" |“Being fortunate enough to receive the Women in AppSec sponsorhsip is a unique and valuable experience. It is a great opportunity for women to have a chance to bolster their skills and dive deep into the world of application security. I found that attending the conference was not only a great way to experience what the OWASP community has to offer, but it also gives students a chance to network with a great group of people who are passionate about their field and willing to share a wealth of information.” <br />
|}<br />
<br><br />
<br />
'''Chandni Bhowmik, 2011 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Chandni_bhowmik.jpg|100px]]<br />
| align="justify" |Chandni Bhowmik is currently completing an M.S. in Computer Security and Information Assurance at the Rochester Institute of Technology (RIT). Her first introduction to OWASP was through the project WebScarab during an application security lab last spring at RIT and her interest in OWASP grew ever since. Over the summer, she started programming open source web applications using built-in security features of Django and Python. She is interested in becoming an information security researcher, and hopes to leverage learning at OWASP AppSec USA 2011 in ad-hoc architecture, mobile platforms and over-all concepts of web application security. Besides secure programming, Chandni enjoys her current research involving digital image forensics and machine learning. In addition to attending school, she has interned in IT security and compliance at Paychex, a Rochester based payroll processing company, and gained industrial experience working an assistant systems engineer for Tata Consultancy Services, a global IT firm. <br />
|}<br />
<br><br />
<br />
<headertabs></headertabs></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Women_In_AppSec&diff=230908Women In AppSec2017-06-22T19:13:29Z<p>Owen Pendlebury: </p>
<hr />
<div>=WELCOME=<br />
<br />
==Women in Application Security Committee==<br />
<br />
The purpose of Women in AppSec (WIA) Committee is to develop leadership, promote active membership and participation, and contributions by women in application security professional communities, globally and locally.<br />
<br />
The Women in AppSec program is for anyone who believes that diversity is important to the success of the organization, as well as for women looking to learn more about AppSec or who want to make career connections with like-minded colleagues. This includes female undergraduate and graduate students, instructors, and professionals who are dedicated to information security or application development. <br />
<br />
=FIND US=<br />
<br />
==Email List==<br />
<br />
[https://lists.owasp.org/mailman/listinfo/appsec_usa_women_in_security WIA List and Archive]<br />
<br />
==Twitter==<br />
<br />
[https://twitter.com/owaspwia @OWASPWIA]<br />
<br />
==Slack Channel==<br />
<br />
[https://owasp.slack.com/messages/C2NUH1J5B/ WIA Slack Channel]<br />
<br />
You can get an OWASP Slack invite here: [https://owasp.herokuapp.com/ OWASP Slack Invite]<br />
<br />
=WIA PURPOSE AND SCOPE=<br />
<br />
==Purpose==<br />
<br />
The purpose of Women in AppSec (WIA) Committee is to develop leadership, promote active membership and participation, and contributions by women in application security professional communities, globally and locally. <br />
<br />
==Scope==<br />
<br />
The scope for OWASP WIA Committee falls into the following areas:<br />
<br />
# Attract women to OWASP, as active members, contributors and leaders.<br />
# Offer opportunities for women to become engaged in AppSec and related professional communities.<br />
# Provide inclusive targeted application security programs for all women learners.<br />
# Provide inclusive training and mentorship for all interested OWASP women.<br />
# Provide financial support to OWASP women members through scholarships, sponsorships, and grant making.<br />
# Pursue fundraising, advancement and development to secure financial support for OWASP WIA activities..<br />
# Integrate WIA track and related activities into OWASP events at all levels.<br />
# Cultivate women for community leadership, speakers for conferences, thought leadership, learning leaders, and local chapter events.<br />
# Collaborate with other committees and initiatives as needs present.<br />
# Collaborate with local OWASP Chapters and Global OWASP leadership, including but not limited to offering advisory support to local and global OWASP leadership for WIA advancement and collaboratively building pro-WIA OWASP communities.<br />
# Develop other special projects and events designed to further the purpose of WIA.<br />
<br />
=MEMBERSHIP=<br />
<br />
==Membership Types==<br />
<br />
===Voting===<br />
<br />
Voting Members are members of OWASP who have formally joined the WIA Committee. Voting Members are allowed to vote on Committee business and are allowed to serve in one of the five officer positions of the Committee.<br />
<br />
In order to become a Voting Member, you must first become a Participating Member and participate for three months, become an OWASP member in good standing, and obtain a written endorsement from a current Voting Member or an OWASP Board of Director. Once all three criteria are met, you must formally request to join as a Voting Member to the WIA List. The Voting Members then vote via the WIA list, and if you receive a majority affirmative vote, you are then made a Voting Member. <br />
<br />
Voting Members have an obligation to maintain participation and to reaffirm their commitment every six months (the Secretary will send an email every six months to affirm commitment, replying "no" or not replying will result in removal).<br />
<br />
===Participating===<br />
<br />
Participating Members are anyone that is interested in volunteering time to the WIA Committee or sub-committees. Participating Members are able to participate in all activities, with the exception of voting and serving in one of the five Committee officer roles.<br />
<br />
In order to become a Participating member, you must express your volunteering commitment to the Secretary, who will then add you to the Membership List. Participating Members can withdraw their commitment at any time by notifying the Secretary. Participating Members do not need to be OWASP members.<br />
<br />
==Membership List==<br />
<br />
[https://docs.google.com/spreadsheets/d/1T7I0FJwfrI-h3XY-iL5URNNeZ-A0wxPTV0nfQHrSZVs/edit?usp=sharing Membership List]<br />
<br />
=GOVERNANCE=<br />
<br />
==Operating Model==<br />
<br />
WIA is a formal Committee of OWASP. WIA is governed by the rules set forth in the [https://www.owasp.org/index.php/Governance/OWASP_Committees OWASP Committees 2.0 Operational Model].<br />
<br />
==Committee Officers==<br />
<br />
#Chair<br />
##TBD for 2017 Term<br />
##Duties<br />
###Open/run the meetings<br />
###Put items to vote and announce the result<br />
###Oversee progress of committee activities<br />
###Participates in fundraising activities/sponsorship acquisition<br />
#Vice-Chair<br />
##TBD for 2017 Term<br />
##Duties<br />
###Serve in place of the chair when the chair is not available, temporarily or permanently<br />
###Confirm and validate results of votes<br />
###Help the chair oversee progress of committee activities<br />
###Participates in fundraising activities/sponsorship acquisition<br />
###Run doodles for upcoming meetings <br />
###Send out meeting invites<br />
#Secretary<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain the WIA membership list and associated bookkeeping<br />
###Take attendance/minutes at meetings<br />
###Create an agenda for each meeting, put out a call to members for agenda items<br />
###Post agendas and meetings<br />
###Edit/update committee Wiki page<br />
#Treasurer<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain budget<br />
###Track income and expenses for all committee activities<br />
###Report at each meeting the expenditures and incoming revenue for the month and the balance of the fund<br />
###Check the balance of the WIA budget with the OWASP accountant quarterly<br />
###Participates in fundraising activities/sponsorship acquisition<br />
<br />
Note: Only Voting Members may serve as Committee Officers<br />
<br />
==Sub-Committee Coordinators==<br />
<br />
#Volunteer Coordinator<br />
##TBD for 2017 Term<br />
##Duties<br />
###Recruit new members for WIA/volunteers for specific events<br />
###Schedule/train volunteers as needed<br />
###Provides direction and coordination for volunteers<br />
###Plan for retention and replacement<br />
###Support in fundraising activities/sponsorship acquisition<br />
###Connect with other local active groups in security to create volunteer networking<br />
###Maintain lessons learned in the volunteer recruiting for the different events to improve the recruiting process<br />
###Keep informal/formal contacts with all the volunteer to be able to reach them in case of new needs<br />
#Media Relations Coordinator<br />
##TBD for 2017 Term<br />
##Duties<br />
###Maintain list of media contacts<br />
###Maintain list of media articles mentioning WIA<br />
###Promote WIA to media<br />
###Prepare talking points, messaging strategy<br />
###Work with OWASP Global to issue press releases<br />
<br />
Note: All Committee Members may serve as Sub-Committee Coordinators<br />
<br />
=2017 ELECTIONS=<br />
<br />
==Timeline==<br />
* June 23, 2017 (Friday) - Call for Candidates closes<br />
* June 24, 2017 (Saturday) - Election emails send to voting members<br />
* July 2, 2017 (Sunday) - Election closes<br />
* July 3, 2017 (Monday) - Election results announced on WIA list<br />
<br />
==Candidates==<br />
===Committee Officers===<br />
<br />
''Positions can only be filled by Voting Members.''<br />
<br />
====Chair====<br />
* Bev Corwin<br />
<br />
====Vice Chair====<br />
* Loredana Mancini <br />
* Cathy Hall<br />
<br />
====Secretary====<br />
* Cathy Hall <br />
<br />
====Treasurer====<br />
* Cathy Hall<br />
<br />
===Sub-Committee Coordinators===<br />
<br />
''Positions can be filled by Voting and Participating Members.''<br />
<br />
====Volunteer Coordinator====<br />
*Wendy Istvanick<br />
*Loredana Mancini<br />
<br />
====Media Relations Coordinator====<br />
* None<br />
<br />
<br />
=PREVIOUS WIA ACTIVITIES=<br />
<br />
== AppSec USA 2015 ==<br />
<br />
'''AppSec USA 2015'''<br><br />
The Women in AppSec (WIA) program is for all OWASP members who believe that diversity is important to the success of an organization, as well as for women who want to make career connections with like-minded colleagues. We encourage you to attend our session on Thursday at 3:30pm in Room F, featuring the founders of InfoSec Girls, Apoorva Giri and Shruthi Kamath.<br><br><br />
We also invite you to join us for our networking and “Birds of a Feather” sessions on on Thursday in WIA meeting room . Stop by anytime between 10:00am and 3:30pm to meet other members and learn more about the WIA program. You can also suggest a discussion topic on the sign-up at the room entrance. <br><br><br />
Sponsorship opportunities for commercial organizations and OWASP chapters are also available.<br />
<br />
'''AppSec USA 2015'''<br><br />
Currently, there is an effort to plan activities for AppSec USA 2015. Volunteers are eagerly sought to support the program at AppSec USA! We are especially excited to invite the founders of the '''InfoSec Girls''' initiative to the AppSec USA 2015 conference. To bring InfoSec Girls to AppSec USA, we need to raise $7500. We are very close to our goal and know that with the support of the OWASP community, we can easily get there! Donations above and beyond our goal will be used for future WIA programs around the world. <BR><br>'''Donate now:'''<br><br />
<br />
== AppSec EU 2015 ==<br />
During AppSec EU there was a panel discussion and workshop supported by the Women in AppSec initiative. Through these sessions we hoped to encourage women to pursue a career in AppSec and help them realize it is an option for them. These sessions was be open to all so we can help build support for the women around us. Learn more here: [http://2015.appsec.eu/women-in-application-security/ http://2015.appsec.eu/women-in-application-security]<br><br />
<br />
'''Panel: "Women in AppSec - Making it Happen"'''<br><br />
During this panel session we discussed what can be done to Make it Happen for Women in AppSec going forward. What have those currently working in the field done to Make it Happen for themselves and other women; what tips and advice do they have to help you do to make a career for yourself or encourage those around you (sister, friend, daughter, etc…) to pursue a career in AppSec? What can we as professionals can do to help encourage girls to go for a career in AppSec?<br />
<br />
'''Workshop'''<br><br />
During the workshop we introduced female attendees of the conference to what a career in App Sec can involve. We discussed application security and the many career paths available. We hope to build relationships that may lead to a mentoring program for these women.<br />
<br />
== AppSec USA 2013 ==<br />
Learn more about the program here: http://2013.appsecusa.org/2013/activities/owasp-women-in-application-security-appsec-program/index.html <br />
<br />
==Previous Women in AppSec Winners==<br />
Following their experience at AppSec, winners are encouraged to write a short piece about their experience at the conference and their participation in the Women in AppSec program. Here, they outline their experience with the Women in AppSec Program in their own words. <br />
<br />
'''Carrie Schaper, 2013 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Carrie Schaper Small.jpg|100px]]<br />
| align="justify" |"OWASP Appsec proved to be a great experience for me, uniting and interacting with friends, professionals, and colleagues from the Information Security space from across the US and Internationally whom were in attendance. The huge space and well organized functions such as the: trainings, expert talks, panels, bug-bounty, lock-picking village and social events all enhanced the conference experience. Participating on the Women in IT panel was a wonderful experience, as many women were in attendance and participated in collaborative discussions. OWASP Appsec held in NY this year, was a premier NY conference not to be missed. Thank you to OWASP, its attendees and organizers."<br />
|}<br />
<br><br />
<br />
'''Nancy Lornston, 2013 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Nancy Lorntson Small.jpg|100px]]<br />
| align="justify" |"AppSec 2013 was an awesome experience! Nowhere in the world can you find the top security experts all in one place at one time (and participate in a marriage proposal!). The conference presentations were well organized and the speakers were prepared to share pros, cons, successes and failures of their work in order to advance the application security domain. The variety of vendors was terrific as well.<br />
<br />
The Women in AppSec panel was an opportunity to advance women's position in the community. Each speaker shared some very candid remarks about their personal experiences and by the end, it was clear that while more work needs to be done, there is a sincere interest by companies, universities and the industry in general to work on doing the things needed to attract more women to the profession.<br />
<br />
The training course I attended (Open source tools) lived up to it's billing and I came away with several invaluable tips and strategies to improve our program.<br />
<br />
A huge thank you to the Women in App Sec Panel and OWASP in general for this opportunity to attend the premier Application Security Conference in the world."<br />
|}<br />
<br><br />
<br />
'''Tara Wilson, 2011 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Tara wilson.jpg|100px]]<br />
| align="justify" |“Being fortunate enough to receive the Women in AppSec sponsorhsip is a unique and valuable experience. It is a great opportunity for women to have a chance to bolster their skills and dive deep into the world of application security. I found that attending the conference was not only a great way to experience what the OWASP community has to offer, but it also gives students a chance to network with a great group of people who are passionate about their field and willing to share a wealth of information.” <br />
|}<br />
<br><br />
<br />
'''Chandni Bhowmik, 2011 Winner'''<br />
{| style="background-color: transparent"<br />
|-<br />
! width="200" align="center" | <br> <br />
! width="1000" align="center" | <br><br />
|-<br />
| align="center" | [[Image:Chandni_bhowmik.jpg|100px]]<br />
| align="justify" |Chandni Bhowmik is currently completing an M.S. in Computer Security and Information Assurance at the Rochester Institute of Technology (RIT). Her first introduction to OWASP was through the project WebScarab during an application security lab last spring at RIT and her interest in OWASP grew ever since. Over the summer, she started programming open source web applications using built-in security features of Django and Python. She is interested in becoming an information security researcher, and hopes to leverage learning at OWASP AppSec USA 2011 in ad-hoc architecture, mobile platforms and over-all concepts of web application security. Besides secure programming, Chandni enjoys her current research involving digital image forensics and machine learning. In addition to attending school, she has interned in IT security and compliance at Paychex, a Rochester based payroll processing company, and gained industrial experience working an assistant systems engineer for Tata Consultancy Services, a global IT firm. <br />
|}<br />
<br><br />
<br />
<headertabs></headertabs></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Owen_Pendlebury_2016_Bio_%26_Why_Me%3F&diff=221351Owen Pendlebury 2016 Bio & Why Me?2016-09-16T10:52:17Z<p>Owen Pendlebury: </p>
<hr />
<div>'''About Owen:'''<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 6.5 years. Some of the projects that Owen has been involved in include, AppSec EU 2016 Committee/ Training Committee, AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars and numerous security workshops.<br />
<br />
Owen has over 6.5 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media. <br />
<br />
<br />
'''Why I would like to be elected to the Global OWASP Foundation Board of Directors'''<br />
<br />
I am extremely passionate about OWASP and the community. My main goal is to improve Europe’s/ global security capabilities and I feel I achieve this with a real can-do attitude. I would use my position on the board to ensure that Europe has an equal say and are aligned with OWASPs strategic goals. I have recently handed on the leadership baton for the Irish OWASP chapter to Tony Clarke and would relish the opportunity to get involved at a global level.<br />
<br />
The main areas in which I feel I can aid in improving within OWASP globally are;<br />
<br />
'''Projects''' – focus on projects new, immature and mature aiding these projects to progress to flagship OWASP projects. I feel that there are a number of key projects that have been left in incubator status for way too long. We need work with these projects in order for OWASP to grow. Existing projects need to be encouraged to grow.<br />
<br />
'''Governance''' – Enable chapters and new OWASP members to flourish without the shadow of big names. OWASP is about the community and we need to focus on the community. Chapters need to be empowered to grow. We need to be transparent in all our actions.<br />
<br />
'''Education''' – I feel that OWASP can reach further in the community. Not only to security professionals but to students. Students both in college and at high school levels should be empowered to join OWASP and learn from our community. We should stimulate enough interest at Community level to cause student volunteers to engage & participate.<br />
<br />
'''Build relationships''' with industry, government, and educational institutions<br />
<br />
'''Support''' the overall OWASP community and its various activities<br />
<br />
Increasing the '''awareness''' of OWASP outside the security community<br />
<br />
<br />
'''References'''<br />
<br />
'''Mark Denihan - OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
'''Fabio Cerullo - Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
'''Jason flood - CEO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Owen_Pendlebury_2016_Bio_%26_Why_Me%3F&diff=221350Owen Pendlebury 2016 Bio & Why Me?2016-09-16T10:48:01Z<p>Owen Pendlebury: </p>
<hr />
<div>'''About Owen:'''<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 6.5 years. Some of the projects that Owen has been involved in include, AppSec EU 2016 Committee/ Training Committee, AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars and numerous security workshops.<br />
<br />
Owen has over 6.5 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media. <br />
<br />
<br />
'''Why I would like to be elected to the Global OWASP Foundation Board of Directors'''<br />
<br />
I am extremely passionate about OWASP and the community. My main goal is to improve Europe’s/ global security capabilities and I feel I achieve this with a real can-do attitude. I would use my position on the board to ensure that Europe has an equal say and are aligned with OWASPs strategic goals. I have recently handed on the leadership baton for the Irish OWASP chapter to Tony Clarke and would relish the opportunity to get involved at a global level.<br />
<br />
The main areas in which I feel I can aid in improving within OWASP globally are;<br />
<br />
'''Projects''' – focus on projects new, immature and mature aiding these projects to progress to flagship OWASP projects. I feel that there are a number of key projects that have been left in incubator status for way too long. We need work with these projects in order for OWASP to grow. Existing projects need to be encouraged to grow.<br />
<br />
'''Governance''' – Enable chapters and new OWASP members to flourish without the shadow of big names. OWASP is about the community and we need to focus on the community. Chapters need to be empowered to grow. We need to be transparent in all our actions.<br />
<br />
'''Education''' – I feel that OWASP can reach further in the community. Not only to security professionals but to students. Students both in college and at high school levels should be empowered to join OWASP and learn from our community. We should stimulate enough interest at Community level to cause student volunteers to engage & participate.<br />
<br />
'''Build relationships''' with industry, government, and educational institutions<br />
<br />
'''Support''' the overall OWASP community and its various activities<br />
<br />
Increasing the '''awareness''' of OWASP outside the security community<br />
<br />
<br />
'''References'''<br />
<br />
Mark Denihan - OWASP Security Shepherd Project Lead<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
Fabio Cerullo - Managing Director at Cycubix<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
Jason flood - CEO of Security Gamification at IBM<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Owen_Pendlebury_2016_Bio_%26_Why_Me%3F&diff=221349Owen Pendlebury 2016 Bio & Why Me?2016-09-16T10:46:06Z<p>Owen Pendlebury: </p>
<hr />
<div>'''About Owen:'''<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 6.5 years. Some of the projects that Owen has been involved in include, AppSec EU 2016 Committee/ Training Committee, AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars and numerous security workshops.<br />
<br />
Owen has over 6.5 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media. <br />
<br />
<br />
'''Why I would like to be elected to the Global OWASP Foundation Board of Directors'''<br />
<br />
I am extremely passionate about OWASP and the community. My main goal is to improve Europe’s/ global security capabilities and I feel I achieve this with a real can-do attitude. I would use my position on the board to ensure that Europe has an equal say and are aligned with OWASPs strategic goals. I have recently handed on the leadership baton for the Irish OWASP chapter to Tony Clarke and would relish the opportunity to get involved at a global level.<br />
<br />
The main areas in which I feel I can aid in improving within OWASP globally are;<br />
<br />
'''Projects''' – focus on projects new, immature and mature aiding these projects to progress to flagship OWASP projects. I feel that there are a number of key projects that have been left in incubator status for way too long. We need work with these projects in order for OWASP to grow. Existing projects need to be encouraged to grow.<br />
<br />
'''Governance''' – Enable chapters and new OWASP members to flourish without the shadow of big names. OWASP is about the community and we need to focus on the community. Chapters need to be empowered to grow. We need to be transparent in all our actions.<br />
<br />
'''Education''' – I feel that OWASP can reach further in the community. Not only to security professionals but to students. Students both in college and at high school levels should be empowered to join OWASP and learn from our community. We should stimulate enough interest at Community level to cause student volunteers to engage & participate.<br />
<br />
'''Build relationships''' with industry, government, and educational institutions<br />
<br />
'''Support''' the overall OWASP community and its various activities<br />
<br />
Increasing the '''awareness''' of OWASP outside the security community<br />
<br />
<br />
'''References'''<br />
<br />
Mark Denihan<br />
<br />
OWASP Security Shepherd Project Lead<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
<br />
Fabio Cerullo<br />
<br />
Managing Director at Cycubix<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
<br />
Jason flood<br />
<br />
CEO of Security Gamification at IBM<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to<br />
<br />
improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=220034User:Owen Pendlebury2016-08-05T16:30:40Z<p>Owen Pendlebury: </p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
<br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 7 years. Some of the projects that Owen has been involved in include, AppSec EU 2016/2017 Committee/ Training Committee , AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, Cyber Security Summer Camp for school kids and numerous security workshops.<br />
<br />
Owen has over 7 years’ penetration testing experience, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
<br />
Owen has also performed numerous web application, network, mobile, specialised technologies (ATM), device penetration tests for major organisations in the financial services, banking and pharmaceutical sectors, consisting of ‘black-box’, ‘white-box’ and ‘grey-box’ testing. <br />
<br />
'''References'''<br />
<br />
'''John Doherty Msc Security & Forensic Computing'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
<br />
'''Mark Denihan OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
'''Fabio Cerullo Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
'''Jason flood CTO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=220032User:Owen Pendlebury2016-08-05T14:54:29Z<p>Owen Pendlebury: </p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
<br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 7 years. Some of the projects that Owen has been involved in include, AppSec EU 2016/2017 Committee/ Training Committee , AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, Cyber Security Summer Camp for school kids and numerous security workshops.<br />
<br />
Owen has over 7 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
<br />
Owen has also performed numerous web application, network, mobile, specialised technologies (ATM), device penetration tests for major organisations in the financial services, banking and pharmaceutical sectors, consisting of ‘black-box’, ‘white-box’ and ‘grey-box’ testing. <br />
<br />
'''References'''<br />
<br />
'''John Doherty Msc Security & Forensic Computing'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
<br />
'''Mark Denihan OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
'''Fabio Cerullo Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
'''Jason flood CTO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=220031User:Owen Pendlebury2016-08-05T14:41:39Z<p>Owen Pendlebury: </p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
<br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 7 years. Some of the projects that Owen has been involved in include, AppSec EU 2016/2017 Committee/ Training Committee , AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, Cyber Security Summer Camp for school kids and numerous security workshops.<br />
<br />
Owen has over 7 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
<br />
Owen has also performed numerous web application, network, mobile, specialised technologies (ATM), device penetration tests for major organisations in the financial services, banking and pharmaceutical sectors, consisting of ‘black-box’, ‘white-box’ and ‘grey-box’ testing. <br />
<br />
'''John Doherty Msc Security & Forensic Computing'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
'''Mark Denihan OWASP Security Shepherd Project Lead'''<br />
<br />
Owen is the model chapter lead, who has been extremely active and dedicated in the Dublin Space. His enthusiasm and perseverance for OWASP is inspiring. He has made significant impacts on the Information Security community through the regular activities for the OWASP Dublin chapter he has organised and the contributions he's made to other security entities (Daggercon 2015).<br />
<br />
<br />
'''Fabio Cerullo Managing Director at Cycubix'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
<br />
'''Jason flood CTO of Security Gamification at IBM'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=WASPY_Awards_2016&diff=220001WASPY Awards 20162016-08-03T14:02:23Z<p>Owen Pendlebury: Updated profile link</p>
<hr />
<div>[[File:WASPY 2016 Banner.jpg]]<br />
<br><br />
<font size="6">'''Web Application Security People of the Year Awards 2016'''</font><br />
<br />
=='''Timeline'''==<br />
June 7, 2016 - Call for Nominees Opens! CLOSED<br><br />
June 20, 2016 - [https://www.owasp.org/index.php/2016_Membership_Drive_April_1_-_June_20 Paid Membership] Deadline. Not sure if you are a member? [https://docs.google.com/spreadsheets/d/1iabh7RrMMRQce0cDQsv_GdQtSKz4G9ISan9svfn_6kE/edit?usp=sharing Check Here ]<br><br />
July 28, 2016 - Call for Nominees CLOSED<br><br />
July 29, 2016 - Announcement of Nominees per Category to the Community<br><br />
August 5, 2016 - Deadline for Nominee Profile Picture and Bio to be created and added to the nominees Citation<br><br />
August 10, 2016 - Voting Opens<br><br />
August 24, 2016 - Voting Closes<br><br />
August 25, 2016 - Winners are Notified<br><br />
August 25, 2016 - Announcement of Winners to the Community<br><br />
October 13/14, 2016 - Award Ceremony at AppSecUSA 2016 in Washington, DC<br><br />
<br />
=='''Purpose of the Awards'''==<br />
Each year there are many individuals who do amazing work, dedicating countless hours to share, improve, and strengthen the OWASP mission. Some of these individuals are well known to the community while others are not. <br />
<br><br />
<br><br />
'''The purpose of these awards is to bring recognition to those who "FLY UNDER THE RADAR". These are the individuals who are passionate about OWASP, who contribute hours of their own free time to the organization to help improve the cyber-security world, yet seem to go unrecognized.'''<br />
<br><br />
<br><br />
Community members are able to nominate 1 individual per category (see Categories below) who they feel best fits these descriptions so that, as a community, we can recognize these people for their contributions. We are tying in the WASPY Awards to help identify and recognize individuals who demonstrate our core values and annual report theme of ''Leading - Learning - Sharing - Growing''. We value your input and consideration for nominations in the categories below.<br />
<br><br />
<br />
=='''Categories'''==<br />
1. '''Open/Leading''' - Everything at OWASP is radically transparent – from our finances to our code. This award goes to a member of the OWASP community who has supported the OWASP mission of transparency through their influence, management, and leadership in the community. This might be a chapter or project leader or may be someone who has worked within the community.<br />
<br><br />
<br />
2. '''Integrity/Learning''' - OWASP is an honest and truthful, vendor neutral, global community. This award goes to an individual who recognizes the benefits of the power of the collective community within OWASP, who challenges the status quo, and generates an excitement in the learning community.<br />
<br><br />
<br><br />
3. '''Innovation/Sharing''' - OWASP encourages and supports innovation and experiments for solutions to software security challenges. This award goes to an individual who has inspired and encouraged others in the arena of software security with innovative and cutting edge solutions to software security challenges.<br />
<br><br />
<br><br />
4. '''Global/Growing''' - Around the world, OWASP encourages and supports innovation and experiments for solutions to software security challenges. This award goes to an individual who truly represents the OWASP Global scope and recognizes the importance of growth. The nominee reaches out beyond the OWASP circle to raise awareness of software security in locations outside of the OWASP comfort zone.<br />
<br><br />
=='''And the Nominees Are...'''==<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="800" | Category & Citation<br />
|-<br />
|align="center"|Tony Clarke||align="center"|'''Open/Leading Category'''<br> Tony has been nominated 2 times for this category.<br> '''Citation 1'''Tony has recently volunteered in the Dublin (Ireland) chapter and more recently been voted in as chapter leader. From his initial efforts, Tony has completely transformed this stagnant chapter and has already in just a few months re-organised the chapter and opened it up to the many volunteers who want to be involved. Running initiatives such as 'Women in Appsec', Tony has helped increase meeting attendances and the Dublin board now consists of nearly 20 individuals. Tony has embraced the open, transparency and inclusiveness side of owasp and is an inspiration to many.<br> <br />
'''Citation 2''' I would like to Nominate Tony Clarke for this award. He has been on the OWASP board in Dublin since November 2015 and there have been massive changes within the chapter since then. Tony has transformed the Dublin Chapter and has been recently elected as Dublin Chapter Lead with a landslide victory.I have been attending OWASP events since 2012 and over the past 8 months it is visible of the impact Tony and OWASP are having within the local Dublin security security community.Previously, events were sporadic and occurred every few months. There was never an organised schedule of events. Communication of the events were also poor. With Tony on board, this has changed. Events are now at the end of each month and are organised on a scheduled basis. Communication has improved and with extra social media interaction, OWASP events are now more visible than before.At the end of May the Chapter hosted an event focusing on Women In Security. Keynote speakers such as Jane Frankland, Jacky Fox, local women involved in the security community presented at the event.Everyone left the event feeling motivated. My partner who is a science graduate attended the event with me. She left the event wanting to work in Security and has since begun the enrollment into a Security Conversion Masters in UCD. This is the sort of impact which Tony's work is having on the people of Dublin.The OWASP Dublin chapter previously had 40-50 people MAX at events. It was the same people always. There were 200+ people in attendance at the Women In Security event in May. This sort of attendee never been seen before at a local chapter meeting in Dublin.I believe that this attendance peaked because of Tony's drive to engage the security community in Dublin. Tony organised contacts in universities and large multinational organisations to send email communication to Dublin staff'students. His aim to get more women studying technology or working in technology companies engaging with the security community in Dublin. Tony is leaving no stone un-turned to make OWASP Dublin to success within the community.As a committee member of OWASP Dublin I know that Tony is now reaching out to work with local education bodies such as Smart futures (Science Foundation Ireland) Dublin Institute of Technology, ISACA and Science Gallery. He has brought a plan to our chapter and given us a goal this year to collaborate with education bodies to try sell our security industry to people in education. This is not limited to 3rd level, but also primary and secondary. Tony is leading this initiative and it would not happen without him.I found out about these awards as Tony is trying to improve the open-ness of the Dublin chapter. He is encouraging the community to post this sort of communications to the social media platforms such as facebook, twitter, linked-in.Based on above, Tony has demonstrated that he is not in this for the title or limelight but for the good of the community. He is a leader who is willing to listen and wants to delegate if any OWASP committee member are willing to take on a task. Like any good leader, if he does not have anyone available to do a task, he does it himself.OWASP Dublin Chapter has only been under the leadership of Tony Clarke for two months. We have been enjoying success since Tony first attended a board meeting in 2015. Tony is having major impact within Dublin. I encourage you to strongly consider Tony for this award as he has done great things for us here in Dublin and his leadership is going from strength to strength. <br />
|-<br />
|align="center"|Jeremy Long||align="center"|'''Open/Leading Category''' Jeremy wrote a tool, donated it to OWASP and in 2016 it because on of the OWASP Flagship projects. He is not noisy or gets a lot of attention, but every morning before work - Jeremy works on the OWASP Dependency Check. Dependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. Currently Java and .NET are supported; additional experimental support has been added for Ruby, Node.js, Python, and limited support for C/C++ build systems (autoconf and cmake). The tool can be part of a solution to the OWASP Top 10 2013 A9 - Using Components with Known Vulnerabilities. <br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/John_Patrick_Lita John Patrick Lita]||align="center"|'''Open/Leading Category''' An outstanding volunteer doing an amazing job in the Asia region to promote OWASP projects and materials, reaching a big audience through his outreach program on universities, government institutions and schools on the Philippines. OWASP is not very well know in this part of the Globe and by promoting it, he is creating awareness about application security<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User:Owen_Pendlebury Owen Pendlebury]||align="center"|'''Open/Leading Category''' Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 6.5 years. Some of the projects that Owen has been involved in include, AppSec EU 2016 Committee/ Training Committee, AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars and numerous security workshops.Owen has over 6.5 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland. Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
|-<br />
|align="center"|Kathy Thaxton||align="center"|'''Open/Leading Category''' Kathy Thaxton has been THE key leader for SnowFROC for many years. As with most regional conferences, everyone involved has a day job and nobody's got a lot of spare time to do what must be done.<br />
Kathy has somehow found time whenever she's been asked, and has done the lion's share of the work required to organize SnowFROC.<br />
For SnowFROC 2016 we had the usual chaotic first planning meeting where several of us gathered at a pub to see which of us would be able to commit time & to identify potential roles. Everybody left that meeting with action-items. Shortly thereafter, Kathy emailed the rest of us to inform us that she had: drafted a budget,drafted a planning schedule,identified primary & alternate venues,identified primary & competing caterers,reached out to some legendary speakers & gotten tentative commitments,reached out to several vendors & gotten tentative sponsorship commitments, and,identified a good source of volunteers for setup, event day, and tear-down. In other words, Kathy Thaxton had done most of the "heavy lifting" within days of the initial planning meeting! Like previous SnowFROC's, SnowFROC 2016 was attended by Coloradans for the most part, but as with most years we had attendees from Arizona, Utah, Wyoming, and New York. SnowFROC had about 200 attendees, with a mix of ITSec operators, QA/testers, Developers, Auditors, & Managers for all of the above. None of this would have happened without Kathy Thaxton's involvement. Her tact, initiative, cheerfulness, and exceptional organizational skills allowed the rest of the planning committee to focus on things like establishing the curriculum, including a day-long hands-on workshop. Kathy's contribution was so profound and her reputation for organizing a FUN, well-planned, LEARNING event is so great that the local Cloud Security Alliance went out of their way to request her participation on their planning committee for a regional event they're hosting later this year. I attended yesterday's Cloud Security Alliance meeting, and whereas AppSec in the Cloud has been an afterthought at most CSA meetings, it was front-and-center yesterday as the Chapter Leaders asked their members what tracks/topics they'd be most interested in for their upcoming event. That is DEFINITELY reach OUTSIDE of the OWASP community, and again would not have happened without Kathy's stellar achievements at SnowFROCs.<br />
|-<br />
|align="center"|[http://owasp.org/index.php/Dhiraj_Mishra Dhiraj Mishra]||align="center"|'''Open/Leading Category''' Core Team Member in [https://www.owasp.org/index.php/Category:India AppSec India 2016]<br />
* The [http://owasp.org/index.php/Mumbai_Student_Chapter Mumbai Student Chapter] Leader making student endorse in Information Security and Spreading Idea and Awareness via Chapter Meets.<br />
* Helping and Speaking Initiatives in [https://www.owasp.org/index.php/Mumbai OWASP Local Chapter Meet Mumbai] with chapter leader Narenda Choyal.<br />
|-<br />
|align="center"|Tom Brennan Honorable Mention||align="center"|Tom was nominated for the '''Open/Leading Category'''. Per the WASPY Award rules, board members are not eligible. Tom is a current board member and therefore he is not eligible for the award.<br />
|-<br />
|align="center"|[http://owasp.org/index.php/Dhiraj_Mishra Dhiraj Mishra]||align="center"|'''Integrity/Learning Category''' [https://www.owasp.org/index.php/OWASP_Trainers_Database Call_For_Trainers] in OWASP Mumbai, India , being in Trainers DB , Dhiraj have taken ton's of free Session's to Mumbai Cop's , Navi Mumbai Cyber Cell , Thane Cyber Cell and many other's. <br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/John_Patrick_Lita John Patrick Lita]||align="center"|'''Open/Leading Categor'''y An outstanding volunteer doing an amazing job in the Asia region to promote OWASP projects and materials, reaching a big audience through his outreach program on universities, government institutions and schools on the Philippines. OWASP is not very well know in this part of the Globe and by promoting it, he is creating awareness about application security<br />
|-<br />
|-<br />
|align="center"|Steve Kosten||align="center"|'''Integrity/Learning Category''' Steve Kosten is the Denver Chapter Leader. For the past year, Steve has built community and fostered AppSec learning within Colorado. Before Steve joined the Denver OWASP Board, the Chapter was averaging 2 meetings per year attended by about 15 people. After 1 year on the board there had been 6 meetings with a high-water mark of 50 attendees. Since Steve has become Chapter Leader, attendance is >75 for the 4+ meetings each year. This is directly attributable to Steve's selection of top-quality speakers and an exceptional partnership with a local vendor who provides venue & catering, all in exchange for a simple "thank you" and round of applause. As a SANS AppSec Instructor, Steve is an AppSec expert who has cheerfully shared his expertise with attendees. Steve is a selfless leader who has profoundly improved the Denver OWASP Chapter and become a highly sought-after resource in this community.<br />
|-<br />
|align="center"|Eoin Keary||align="center"|'''Integrity/Learning Category''' Eoin gives up his free time to run free security training sessions within the community in Dublin. He is dedicated to spreading the OWASP message within Dublin. He is working within the community for the good of OWASP . Eoin is a committee member and does not have any "board" level title. He is giving to the community and is demonstrating that he does not expect anything in return. Eoin is a role model within our Dublin Chapter<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User:Owen_Pendlebury Owen Pendlebury]||align="center"|'''Integrity/Learning Category''' Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 6.5 years. Some of the projects that Owen has been involved in include, AppSec EU 2016 Committee/ Training Committee, AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars and numerous security workshops. Owen has over 6.5 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland. Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/Dhiraj_Mishra Dhiraj Mishra]||align="center"|'''Innovation/Sharing Category''' Past Contributor in [http://owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet The Popular XSS Filter Evasion Cheat Sheet] where as ,This article is focused on providing application security testing professionals with a guide to assist in Cross Site Scripting testing.<br />
* Lead of [https://www.owasp.org/index.php/SQL_Injection_Bypassing_WAF SQLi WAF Bypass] a very helpful cheat sheet which consists of A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete),recommended by many Security Researcher's. <br />
*Contributor in [https://www.owasp.org/index.php/Benchmark OWASP Benchmark],contributed SQLi/XSS fuzz vectors as initial contribution towards adding support for WAF/RASP scoring. Many Thanks to [https://www.owasp.org/index.php/Benchmark#tab=Acknowledgements '''Dave Wichers''']<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/John_Patrick_Lita John Patrick Lita]||align="center"|'''Open/Leading Category''' An outstanding volunteer doing an amazing job in the Asia region to promote OWASP projects and materials, reaching a big audience through his outreach program on universities, government institutions and schools on the Philippines. OWASP is not very well know in this part of the Globe and by promoting it, he is creating awareness about application security<br />
|-<br />
|align="center"|Mark Major||align="center"|'''Innovation/Sharing Category''' Mark Major did a LOT of HARD work to ensure that AppSecUSA was a success in Denver. He has consulted with his Chapter and worked with OWASP to try to take the Chapter to the next level. Specifically, his research into using some of the proceeds from his efforts at AppSecUSA to establish an AppSec HackerSpace is both innovative and well overdue.<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User:Owen_Pendlebury Owen Pendlebury]||align="center"|'''Innovation/Sharing Category''' Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 6.5 years. Some of the projects that Owen has been involved in include, AppSec EU 2016 Committee/ Training Committee, AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars and numerous security workshops.Owen has over 6.5 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland. Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
|-<br />
|align="center"|[http://owasp.org/index.php/Dhiraj_Mishra Dhiraj Mishra]||align="center"|'''Global/Growing Category''' * [https://www.owasp.org/index.php/About_OWASP/Bug_Bounty/WOF '''OWASP Wall Of Fame''']<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/John_Patrick_Lita John Patrick Lita]||align="center"|'''Global/Growing Category''' An outstanding volunteer doing an amazing job in the Asia region to promote OWASP projects and materials, reaching a big audience through his outreach program on universities, government institutions and schools on the Philippines. OWASP is not very well know in this part of the Globe and by promoting it, he is creating awareness about application security<br />
|-<br />
|align="center"|Kathy Thazton||align="center"|'''Global/Growing Category''' Kathy Thaxton has been THE key leader for SnowFROC for many years. As with most regional conferences, everyone involved has a day job and nobody's got a lot of spare time to do what must be done.<br />
Kathy has somehow found time whenever she's been asked, and has done the lion's share of the work required to organize SnowFROC.<br />
For SnowFROC 2016 we had the usual chaotic first planning meeting where several of us gathered at a pub to see which of us would be able to commit time & to identify potential roles.Everybody left that meeting with action-items.Shortly thereafter, Kathy emailed the rest of us to inform us that she had: drafted a budget,drafted a planning schedule,identified primary & alternate venues,identified primary & competing caterers,reached out to some legendary speakers & gotten tentative commitments,reached out to several vendors & gotten tentative sponsorship commitments, and,identified a good source of volunteers for setup, event day, and tear-down.In other words, Kathy Thaxton had done most of the "heavy lifting" within days of the initial planning meeting!Like previous SnowFROC's, SnowFROC 2016 was attended by Coloradans for the most part, but as with most years we had attendees from Arizona, Utah, Wyoming, and New York.SnowFROC had about 200 attendees, with a mix of ITSec operators, QA/testers, Developers, Auditors, & Managers for all of the above.None of this would have happened without Kathy Thaxton's involvement. Her tact, initiative, cheerfulness, and exceptional organizational skills allowed the rest of the planning committee to focus on things like establishing the curriculum, including a day-long hands-on workshop.Kathy's contribution was so profound and her reputation for organizing a FUN, well-planned, LEARNING event is so great that the local Cloud Security Alliance went out of their way to request her participation on their planning committee for a regional event they're hosting later this year.I attended yesterday's Cloud Security Alliance meeting, and whereas AppSec in the Cloud has been an afterthought at most CSA meetings, it was front-and-center yesterday as the Chapter Leaders asked their members what tracks/topics they'd be most interested in for their upcoming event.That is DEFINITELY reach OUTSIDE of the OWASP community, and again would not have happened without Kathy's stellar achievements at SnowFROCs.<br />
|-<br />
|align="centre"|[https://www.owasp.org/index.php/User:Owen_Pendlebury Owen Pendlebury]||align="center"|'''Global/Growing Category''' Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 6.5 years. Some of the projects that Owen has been involved in include, AppSec EU 2016 Committee/ Training Committee, AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars and numerous security workshops. Owen has over 6.5 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
|}<br />
<br />
== '''Rules'''==<br />
'''Remember the purpose of these awards is to recognize the UNSUNG HEROS out there, that are barely recognized for their contributions to the OWASP Foundation.'''<br />
<br><br />
1. [https://www.owasp.org/index.php/About_OWASP#2015_Global_Board_Members Board members] may not be nominated<br />
<br><br />
2. [https://www.owasp.org/index.php/About_OWASP#Employees_and_Contractors_of_the_OWASP_Foundation Employees & Contractors] may not be nominated<br />
<br><br />
3. You MUST be a [https://www.owasp.org/index.php/2016_Membership_Drive_April_1_-_June_20 Paid or Honorary member] to vote and your [https://docs.google.com/spreadsheets/d/1iabh7RrMMRQce0cDQsv_GdQtSKz4G9ISan9svfn_6kE/edit#gid=1961079767 membership] needs to be on file by June 20, 2016<br />
<br><br />
4. All nominees will remain anonymous until July 11, 2016<br />
<br><br />
5. Anyone can nominate an "unsung hero" who has contributed in some way to OWASP who they feel best fits each category<br />
<br><br />
6. You may only nominate one person per category<br />
<br><br />
<br />
=='''Eligible Voters'''==<br />
Individuals who were members as of June 20, 2016 are eligible and are listed [https://docs.google.com/spreadsheets/d/1iabh7RrMMRQce0cDQsv_GdQtSKz4G9ISan9svfn_6kE/edit#gid=1961079767 here]. Please take a minute to verify your name is on the list. If you are '''NOT''' on the list and believe you should be, then you should '''[https://www.tfaforms.com/308703 contact us immediately]'''<br />
<br />
=='''Sponsorship Opportunities'''==<br />
Coming Soon!<br />
<br />
The support from our sponsors, is what makes these awards truly successful!<br />
<br />
=='''Communication'''==<br />
June 7, 2016 [https://twitter.com/owasp/status/740236956550959104 Twitter], [https://www.facebook.com/groups/owaspfoundation/permalink/1004714156315924/ Facebook], [https://www.linkedin.com/groups/36874/36874-6146003139049906179 LinkedIn], [https://plus.google.com/116933056486234813396/posts/7AktQkr9y5c Google+], [http://owasp.blogspot.com/2016/06/2016-waspy-awards.html OWASP Blog].<br />
<br />
=='''Past WASPY Awards'''==<br />
[https://www.owasp.org/index.php/WASPY_Awards_2015 2015]<br><br />
[https://www.owasp.org/index.php/WASPY_Awards_2014 2014] <br><br />
[https://www.owasp.org/index.php/WASPY_Awards_2013 2013] <br><br />
[https://www.owasp.org/index.php/WASPY_Awards_2012 2012]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=User:Owen_Pendlebury&diff=220000User:Owen Pendlebury2016-08-03T13:57:20Z<p>Owen Pendlebury: Update</p>
<hr />
<div>[[File:OwenPendlebury.jpg|left|]]<br />
<br />
<br />
<br />
Owen graduated in 2009 from Dundalk Institute of Technology, with a degree in Computer Applications and Support and an honours degree in IT Management specialising in web application development and networking. In 2009, Owen completed an MSc in Security & Forensic Computing from Dublin City University.<br />
<br />
Owen has been involved in the OWASP Foundation since 2009. He started out attending OWASP Dublin meetings and helping to facilitate chapter meetings and security workshops. Eventually, he took on the role of Dublin board member and then chapter lead a couple of years later. He has been an extremely active member of the security community and has strived to help drive and improve security best practice at a Global level through his commitment to the OWASP foundation. Owen has been an active and dedicated chapter leader, who has organised regular activities for the OWASP Dublin chapter that benefit the local information security community greatly over the past 7 years. Some of the projects that Owen has been involved in include, AppSec EU 2016/2017 Committee/ Training Committee , AppSec EU 2017 successful bid, DaggerCon, Cyber Startup Summit, Source Dublin, Advanced Threat Intelligence Seminars, Cyber Security Summer Camp for school kids and numerous security workshops.<br />
<br />
Owen has over 7 years’ penetration testing, working as part of a global attack & penetration team for a number organisations including a “Big 4” professional services company. With in-depth experience of application and network penetration testing Owen has worked with many local and global institutions to improve their security posture. Owen is currently a manager in Deloitte Ireland.<br />
<br />
Owen has also been involved in local education bodies, architecting a masters in cyber security and helping a number of students and experienced individuals find their way in to the security community by making himself available to through all media.<br />
<br />
Owen has also performed numerous web application, network, mobile, specialised technologies (ATM), device penetration tests for major organisations in the financial services, banking and pharmaceutical sectors, consisting of ‘black-box’, ‘white-box’ and ‘grey-box’ testing. <br />
<br />
'''Citation 1'''<br />
<br />
Owen was my lecturer for Security in NCI. His class and teaching made me seek a further interest in the cyber security field. Even after college I kept in touch with him and he gave me advice and encouraged me to do a masters in security in DCU. <br />
<br />
Since then Owen pointed me to the OWASP mailing list which keeps me updated on chapter meetings which I regularly attend and also cyber security job postings and courses. The speakers that have attended have been very interesting and informative. <br />
<br />
Owen is now advising/helping me with my DCU masters practicum.<br />
<br />
'''Citation 2'''<br />
<br />
Owen is an active and dedicated chapter leader, who organises regular activities for the OWASP Dublin chapter and that benefit greatly the local information security community.<br />
<br />
'''Citation 3'''<br />
<br />
Owen is a fantastic example of a dedicated security professional. I have worked with Owen for more than 5 years across various projects. He is a very active member of the security community and helps to drive and improve security best practice at a Global level through his commitment to the OWASP group. Owen is an asset that helps to improve Ireland's security capabilities with a real can-do attitude.</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=File:OwenPendlebury.jpg&diff=219998File:OwenPendlebury.jpg2016-08-03T13:37:33Z<p>Owen Pendlebury: </p>
<hr />
<div></div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Dublin&diff=212926Dublin2016-04-11T20:26:38Z<p>Owen Pendlebury: </p>
<hr />
<div>{{Chapter Template|chaptername=Ireland|extra= [[File:Owasp_logo_ireland_small.jpg]]| mailinglistsite=https://lists.owasp.org/mailman/listinfo/owasp-ireland}} become a [http://www.owasp.org/index.php/Membership#Categories_of_Membership_.26_Supporters Member or Annual Chapter Sponsor(s)]. <br><br />
<br />
'''Becoming a chapter sponsor means that you get your organisation mentioned in meeting promotion (including on this page), recognition at the beginning of the meeting and promotional material at the meeting. <br><br />
We currently have the following sponsorship options available: <br><br />
€250 for an individual meeting sponsorship<br><br />
€1500 for annual chapter sponsorship<br><br />
Contact any of the board members below for more information. <br>'''<br />
<br />
== OWASP Ireland Board ==<br />
<br />
Should you have a question about the local chapter, would like to get more involved contact ANY of the following people below <br><br><br />
<br />
*'''Chapter Lead''' [mailto:Owen.Pendlebury(at)owasp.org mail[[User:Owen Pendlebury|Owen Pendlebury]]] +353876605277<br><br />
*'''Board Member''' [mailto:Mark.Denihan(at)owasp.org Mark Denihan]<br><br />
*'''Board Member''' [[User:EoinKeary|Eoin Keary]] <br><br />
*'''Board Member/ Global Board Member''' [mailto:fcerullo(at)owasp.org Fabio Cerullo] <br><br />
*'''Board Member''' [mailto:Tony.Clarke(at)owasp.org Tony Clarke]<br><br />
<br />
<br />
<br />
<br />
<br />
<br>'''OWASP Ireland'''<br>40 Block E, Smithfield Market Smithfield <br> Dublin 7, Ireland <br>Tel: +353876605277 <br><br><br />
== OWASP Dublin Chapter 2016 ==<br />
=== OWASP April Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – '''OWASP April Event - DevOps''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Wednesday 27th April<br><br>''' Talks Start: 18:30pm <br> Event finishes at 21:30pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration [https://www.eventbrite.com/e/owasp-april-event-devops-tickets-24574522057register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | <br><br><br />
<br />
Hi Everyone,<br />
<br />
We're happy to announce that we will be hosting our next OWASP Dublin chapter event in the Morgan McKinley’s office on Wednesday April 27th 2016 at 6:30pm and will be focused on DevOps. Please feel free to forward the event to friends and colleagues. <br />
<br />
We're hoping to have some gifts to give away as part of the night. <BR> <br />
<br />
Thanks to Morgan McKinley for sponsoring the event.<br><br />
<br />
<br />
<br />
'''Session 1 - John Turner - Monkey Little'''<BR><br />
<br />
<br />
John Turner has been developing software in the financial and betting industry since 1999. He has a huge interest in the changing ways in which software projects are being delivered. This has led John to discover, learn and apply the practices and principles fundamental to Agile software development particularly those of Scrum and Lean. More recently John spends his time identifying how best to leverage the emergence of Cloud (IAAS, PAAS, SAAS) to create more Agile businesses. <BR><br />
<br />
<br />
John's session will focus on "DevOps Adoption Patterns". While DevOps is still riding high on a peak of inflated expectations, a number of patterns of adoption are starting to emerge. The conceptual definition of Agile made it difficult to embrace until frameworks such as Scrum became popular. In this same way, the theoretical and visionary definition of DevOps is creating a barrier to entry for those eager to realise its benefits. Fear not, for there are brave soles who have gone before us that we can strive to emulate! Join us to talk about some of the ways in which people are 'doing DevOps’. <BR><br />
<br />
<br />
'''Session 2 - Noel King - VSWare '''<BR><br />
<br />
<br />
Noel is VP for Engineering at VSWare an Irish Software company which provides a cloud based administration system to the education sector. He has led and developed software solutions across multiple sectors and is focused on driving excellence through team orientated development utilising the best industry standards. He has a passion for quality assurance, development automation, continuous delivery and leveraging cloud to get your product to market quicker. <BR><br />
<br />
<br />
He spends his free time volunteering with CoderDojo, mentoring the technology innovators of the future, building cool and fun course material and promoting the ideology. Passionate about education and inspiring the next generation he created CoderDojo Coolest Projects Awards. The Coolest Projects is now Ireland's largest tech event that focuses on creativity takes place annually in Dublin and Silicon Valley. <BR><br />
<br />
<br />
Noel's session is entitled "Banishing Snakes from Green Field Development". <BR><br />
<br />
<br />
'''Session 3 - Ryan Sudding - VMware'''<br />
<br />
Ryan works for VMware as a Systems Engineer. He has spent the last number of years working as an Infrastructure Consultant, but more recently has spent more time working with the VMware Network and Security Business Unit. He loves cars, travel and spending time with his wife and 11 month old daughter. <BR><br />
<br />
<br />
Ryan's session will be primarily focused on the current security landscape and also will also try debunk a few security myths. <BR><br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org''' or Tony Clarke on '''tony.clarke(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP March Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Session 1 – Data Protection / Session 2 - Working in IT Security Panel ''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 31st March<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-march-event-session-1-general-data-protection-regulation-gdpr-session-2-working-in-it-tickets-23939161677register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | Thanks to Morgan McKinley for sponsoring the event<br><br><br />
<br />
<br />
'''Session 1 – Hugh Jones - General Data Protection Regulation (GDPR) ''' [[File:OWASP_INtro_to_GDPR_1603.ppt]]<br />
<BR><br />
<br />
With the current EU legislation passing its 20th year back in October, it is high time that the EU Data Protection regime caught up with everything that is happening in the commercial, technological and social media sectors. The EU Commission has recently published the final draft of the new General Data Protection Regulation (GDPR), scheduled to take effect across the EU in early 2018. <BR><br />
<br />
<br />
For organisations who already have a culture of DP compliance in place, the new Regulation will introduce a few changes, but nothing particularly challenging. For those who have ignored or failed to step up to the 1995 Directive, the next two years could be a very busy time indeed! <BR><br />
<br />
This overview of the Regulation provides an understanding of the key concepts contained in the new legislation, the main areas of change, and some good advice on the steps which organisations need to take in order to prepare in a timely and organised manner.<br />
The key motto being: “Don’t Panic!”” <BR><br />
<br />
'''Session 2 – Working in IT Security'''<br />
<br />
A panel of experts will discuss what it is like to work in IT Security industry in Ireland. The aim is of this session is to give the audience an overview of the different types of roles and opportunities in IT Security and afford the audience an opportunity to ask questions in relation to any aspect of IT Security. <BR><br />
<br />
'''1. Jason Flood– CTO IBM'''<BR> <br />
<br />
Jason Flood is currently completing his Phd at the Institute of Technology in Blanchardstown. He is also heavily involved in the Security Research Lab, located in the Learning & Innovation Centre in ITB. His main research area is in the field of cyber-security and risk analysis. <BR><br />
<br />
Jason is founder of the Irish honeynet project and contributor to OWASP. He is also a board member of InfoSecurity Ireland. Jason is the CTO in IBM in the security space. Jason has helped deliver numerous Capture-the-Flag events at both a local, national and international level over the last 5 years for events such as Appsec, Source and IRISS. <BR><br />
<br />
'''2. Dara Boland – Morgan McKinley'''<BR><br />
<br />
Dara Boland heads up Morgan McKinley’s Information Security Recruitment team. He is a connector, blogger and market leader who is constantly helping companies locate and hire the right people, across the whole spectrum of Information Security. Dara has an extensive network and reputation in Ireland and across Europe. <BR><br />
<br />
'''3. Hugh Callaghan – Executive Director EY '''<BR><br />
<br />
Hugh is the Executive Director in our EMEIA Financial Services Advisory team with responsibility for leading our rapidly growing Advanced Security Centre, which is EY’s market-leading capability hub for delivering cyber security services to large domestic and multinational clients. Hugh has previous experience of large-scale technical security testing programmes, online banking fraud strategy, business-driven security architecture, cyber security roadmap definition and improvement programme delivery. Hugh currently has a significant focus on helping both boards and top executive management understand the implications of the cyber security threat environment in the context of their businesses, consistent with EY’s mission of making the digital world a safer place to do business. <BR><br />
<br />
Hugh is a research scientist by background, with a Ph.D. in computational physics from University College Cork and the Max Planck Institute, Germany. Hugh joined EY in 2003 from an international electronic payments company. <BR><br />
<br />
'''4. Rahim Jina – Director BCC Risk Advisory'''<BR><br />
<br />
Rahim is a director in BCC Risk Advisory and parent company of edgescan™, based in Ireland. Prior to this, Rahim was Head of Security for Fonality, a VOIP provider based in Los Angeles and was also a senior security consultant for a ‘Big 4’ consultancy firm for many years. Rahim has a degree in Computer Science from Trinity College Dublin and an MSc in Security & Forensic Computing from Dublin City University. Rahim has been an OWASP contributor and volunteer since 2007. <BR><br />
<br />
'''5. Declan Timmons – Principal Security Consultant Ward Solutions ''' <BR><br />
<br />
Declan is Ward Solutions Principal Security Consultants in Forensics and e-Discovery operating at both the consultative and practitioner level. Originally a member of the defence forces in Ireland, Declan has a 1st class honours masters in cybercrime and forensics investigations, as well as a Certified Encase Forensics Examiner (EnCE), Certified Information Security Manager (CISM), and ISO-27001 Lead Auditor. <BR><br />
<br />
'''6. Leonard McAuliffe – Director - Cyber Security and Forensics at PwC'''<BR><br />
<br />
Leonard leads the Cyber Security and Forensics practice for PwC Ireland. Leonard has worked in the area of Cyber Security and Forensics for over 17 years and had delivered Cyber Security and Forensics services to many top international and national clients in many sectors. Some of Leonard’s Cyber Security areas of expertise include Cyber Strategy and Operating Models, Governance & Program Management,Cyber Security Architecture, Cyber Security Standards, Data Protection and Privacy, Identity and Access Management, Vulnerability Management, Ethical Hacking, Application Security, Cloud Security, Mobile Device Management, infrastructure and operational security reviews.<br />
<br />
<BR><br />
<br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org''' or Tony Clarke on '''tony.clarke(at)owasp.org'''<br />
<BR><br />
<br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP February 2016 Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Gavin O’Gorman and Alain Abou Tass ''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 25th February<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration [https://www.eventbrite.com/e/owasp-february-event-gavin-ogorman-and-alain-abou-tass-tickets-21790679509 register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | <br />
<br />
We are delighted to to welcome Gavin O’Gorman and Alain Abou Tass for our latest OWASP Dublin Chapter meeting. Registration will start from 6:30pm 25th February with talks beginning at 7:00pm.<br />
<br />
There will be beer and Pizza generously provided by Morgan McKinley<br><br />
<br />
<br />
'''Gavin O’Gorman– Symantec - ''' <br />
<BR><br />
Working in Symantec for the past six years, Gavin is an intelligence analyst on the attack investigations team. Before moving to the attack investigations team in 2013, he worked as a reverse engineer, and later as an incident handler. Gavin’s primary role is to gather together information from both Symantec data sources, and open sources, in order to build a comprehensive picture of an attack, or attackers. Another aspect of the job is to work with law enforcement to assist in the investigation of e-crime where possible. Prior to working in Symantec, Gavin spent several years researching network security in Dublin City University, and currently lectures part-time for the Masters in Security & Forensics course. <BR><br />
<br><br><br />
''' Alain Abou Tass – Ward Solutions - Web applications on the battlefield''' [[File:Battle20160225-V1.0.0.pptx]]<br />
<BR><br />
Penetration testers spend most of their time identifying security holes. Sometimes if we’re lucky enough, we hit the jackpot. In this talk, I will be detailing some instances of real life attacks on web applications. I’ll show how one small vulnerability, in conjunction with others, can be lethal and lead to a big breach. This will highlight the importance of fixing the small issues that are usually neglected. Also, I’ll show some interesting tricks that can be used to exploit existing vulnerabilities.<br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
== OWASP Dublin Chapter 2015 ==<br />
=== OWASP December Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Tony Clarke and William Bailey ''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 10th December<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration [https://www.eventbrite.com/e/owasp-december-event-christmas-party-tony-clarke-will-bailey-tickets-19873992647 register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | The event will be followed by our annual Christmas party in a location to be decided. I would like to thank our sponsors Ward Solutions, Integrity 360,BH Consulting, Edgescan and Morgan McKinley. There will be a raffle during the event for a Samsung Galaxy Tab. <br />
<br><br />
<br />
<br />
'''Tony Clarke – ICON PLC - Application security in a cyber security program''' [[File:OWASP-v1.0.pptx]]<br />
<BR><br />
Data breaches such as the recent Talk Talk and Vtech breaches are regularly reported on in the media and its clear that existing approaches to application security are flawed and failing. This session will examine application security in the context of a cyber security program and will outline an approach to application security which facilitates modern development practices and standards. The session will examine security models, controls, processes and metrics which are required to prevent, detect and respond to these types of breach and integrate with operational models and compliance requirements.<br />
<BR><br />
<br><br><br />
'''Will Bailey – IBM - Drop your breaches''' [[File:OWASP_will_20151210.pptx]]<br />
<BR><br />
In this talk, I'll cover how we could be doing a much better job of improving the security of applications by educating developers better and why the approach a lot of the current security education employs both in the professional and academic spheres is wrong.<br />
<br />
I'll also explain why it's a reflection on why I'm more likely to hire a half decent coder than a security graduate these days, so if you're currently studying and/or looking to get a a job in application security / ethical hacking in the near future this might be your ticket!<br />
<br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP July Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Eoin Keary - Security Boot camp''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 16th July<br><br>''' Registration: 13:00pm <br>Talks Start: 13:00pm <br> Event finishes at 17:30pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration Members. [https://myowasp.force.com/login Members register here])''<br />
''(Registration Non-Members. [https://myowasp.force.com/MN4__PublicEventRegistration?id=a2oU0000000TZAOIA4 Non-Members register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | Thanks to Morgan McKinley for sponsoring the event<br><br><br />
<br />
'''Security Boot Camp'''<BR><br />
'''Eoin Keary – CTO BCC Risk Advisory '''<BR><br />
<br />
Eoin was on the international board of OWASP, the Open Web Application Security Project from 2009-2015 and during his time in OWASP he has lead the OWASP Testing and Security Code Review Guides and also contributed to OWASP SAMM, OWASP CISO Guide and the OWASP Cheat Sheet Series. <br />
<br />
Eoin is a well-known technical leader in industry in the area of software security and penetration testing, and has led global security engagements for some of the world's largest financial services and consumer products companies. He is the CTO and founder of BCC Risk Advisory which deliver professional security services and edgescan.com, a managed cloud-based SaaS, web vulnerability service.<br />
<br />
'''Abstract:''' <BR><br />
<br />
All - Please join us for a free security boot camp.....<br />
<br />
OWASP is hosting a special FREE security boot camp for all Owasp members and local developers. <br />
The training is recommended for developers who want to learn more about securing their code.<br />
Presented by Eoin Keary, this intensive boot camp focuses on the most common web application security problems, including aspects of both the OWASP Top Ten and the MITRE Top 25.<br />
The course will introduce and demonstrate application security techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code and understand fixes.<br />
<br><br><br><br><br><br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
=== OWASP June Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Jason Flood (IBM) & Paul Mooney (Free Lance)''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Tuesday 16th June<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location Hilton Dublin<br><br />
Venue Address: Charlemount Place, Dublin 2 '''<br><br />
Venue Map: [https://www.google.ie/maps/place/Hilton+Dublin/@53.330893,-6.259998,15z/data=!4m2!3m1!1s0x0:0x5b92598f4735994e?sa=X&ved=0CIQBEPwSMAtqFQoTCMyG-cibhcYCFQaWLAodAFAAeg Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-june-event-hilton-dublin-jason-flood-paul-mooney-tickets-17318536208register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | Thanks to Morgan McKinley for sponsoring the event<br><br><br />
<br />
'''Understanding cyber gaps in the human'''<BR><br />
'''Jason Flood – Ethical Hacker IBM '''<BR><br />
<br />
'''Abstract:''' <BR><br />
<br />
A Capture the Flag tournament, also known as a CTF is a framework often found at conferences such as IRISS, OWASP, Blackhat and many more. For the last number of years as part of my PhD research I have been creating CTF frameworks that operate at local, national and international levels, some of you may have played them or at least seen them, and looking at the results.<br />
<br />
These CTF events were built using a variety of architectures, network topologies and programming languages. The challenges they presented also varied both in complexity of exploit and potential organisational damage if exploited.<br />
<br />
Today we see attack know-how and attacker tools being freely traded on the internet, enabling hackers and exposing organisations to an even greater communal risk. Arguably it can be said that every organisation no matter the size needs a business plan. If that business has an online footprint, then a part of that plan needs to focus on it's own cyber risk profile.<br />
<br />
Join us to explore how CTF applied methodologies can be used as part of business decisions around resource management, defensive technology solutions, defect management and other aspects of business activities that are associated with operating in a hostile environment such as the internet.<br />
<br><br><br><br><br><br />
<br />
''' The Encrypted Token Pattern CSRF Defence'''<BR><br />
<br />
'''Paul Mooney – Freelance, Ryanair Labs, insidethecpu.com''<BR><br />
<br />
I’m the creator of the Encrypted Token Pattern and ARMOR, its .NET implementation.<br />
I specialise in taking apart problems, designing solutions, and providing those solutions as downloadable software frameworks, available under the MIT License.<br />
I’m a Software Architect, happiest when designing solutions to problems from a conceptual point-of-view, while getting my hands dirty assembling the nuts and bolts. For that reason, I try to avoid titles; if I had to brand myself, I’m a Technology Consultant.<br />
I’m most accomplished in C# in terms of language, however I’m also very proficient in JavaScript, Java, and Google Go.<br />
I’m a software-development mentor, and enjoy guiding teams of engineers toward effective technology-driven solutions to real-world problems.<br />
<br />
<br />
'''Abstract:''' <BR><br />
<br />
The Encrypted Token Pattern is a defence mechanism against Cross Site Request Forgery (CSRF) <br />
attacks, and is an alternative to its sister-patterns; Synchroniser Token, and Double Submit Cookie. <br />
This article discusses the merits and means of implementing this defence mechanism in web-based <br />
applications. <br />
<br />
''Brief Description'' <br />
The Encrypted Token Pattern <br />
The Encrypted Token Pattern leverages a single token, as opposed to dual tokens, and offers a more <br />
narrow scope of failure than alternative CSRF protection patterns. <BR><br />
<br />
Leveraging the Encrypted Token Pattern <br />
The Advanced Resilient Mode of Recognition (ARMOR) is a C# implementation of the Encrypted <br />
Token Pattern, available on GitHub under the MIT license that provides a means of protecting <br />
ASP.NET applications from CSRF attacks, by leveraging the Encrypted Token Pattern. A Java <br />
equivalent of ARMOR is under construction and will be available soon. <BR><br />
<br />
ARMOR <br />
ARMOR is a framework composed of interconnecting components exposed through custom web- <br />
handlers. ARMOR is essentially an advanced encryption and hashing mechanism, leveraging the <br />
Rijndael encryption standard, and SHA256 hashing by default.<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
=== OWASP March Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event - Denim Group - Dan Cornell & John Dickson''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 26th March<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-dublin-chapter-event-denim-group-dan-cornell-john-dickson-tickets-16065539461 register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking throughout,beer and pizza thanks to Morgan Mckinley<br><br><br />
<br />
'''Managing Your Application Security Program with the ThreadFix Ecosystem'''<BR><br />
'''Dan Cornell – Denim Group - (https://www.linkedin.com/in/dancornell) '''<BR><br />
<br />
A globally recognized application security expert, Dan Cornell holds over 15 years of experience architecting, developing and securing web-based software systems. As Chief Technology Officer and Principal at Denim Group, Ltd., he leads the technology team to help Fortune 500 companies and government organizations integrate security throughout the development process. Cornell is an active member of the development community and a sought-after speaker on topics of web application security, speaking at international conferences including RSA Security Conference, OWASP AppSec USA and EU and Black Hat Arsenal.<br />
<br />
'''Abstract:''' <BR><br />
<br />
ThreadFix is an open source application vulnerability management system that helps automate many common application security tasks and integrate security and development tools. This tutorial will walk through the capabilities of the ecosystem of ThreadFix applications, showing how ThreadFix can be used to: Manage a risk-ranked application portfolio Consolidate, normalize and de-duplicate the results of DAST, SAST, IAST and other application security testing activities and track these results over time to produce trending and mean-time-to-fix reporting Convert application vulnerabilities into software defects in developer issue tracking systems Pre-seed DAST scanners such as OWASP ZAP with application attack surface data to allow for better scan coverage Instrument developer Continuous Integration (CI) systems such as Jenkins to automatically collect security test data Map the results of SAST and DAST scanning into developer IDEs The presentation walks through these scenarios and demonstrates how ThreadFix, along with other open source tools, can be used to address common problems faced by teams implementing software security programs. It will also provide insight into the ThreadFix development roadmap and upcoming enhancements.<br><br><br><br><br><br />
<br />
''' AppSec Survey 2.0: Fine-Tuning an AppSec Training Program Based on Data'''<BR><br />
<br />
'''John Dickson – Denim Group''' (https://www.linkedin.com/pub/john-b-dickson-cissp/0/149/41a)<BR><br />
<br />
John Dickson is an internationally recognized security leader, entrepreneur and Principal at Denim Group, Ltd. He has nearly 20 years hands-on experience in intrusion detection, network security and application security in the commercial, public and military sectors. As a Denim Group Principal, he helps executives and Chief Security Officers (CSO’s) of Fortune 500 companies and government organizations launch and expand their critical application security initiatives.<br />
<br />
<br />
'''Abstract:''' <BR><br />
<br />
Measuring the effectiveness of any security activity is widely discussed – security leaders debate the topic with a religious fervor rivaling that of any other hot button issue. Virtually every organization has some sort of application security training effort, but data on training effectiveness remains scarce. Last year our research team delivered the first-ever survey that captured developer awareness of secure coding concepts and the impact of formal application security training on a developer’s ability to write secure code. We learned that most software developer were aware of certain application security concepts, yet when asked how to write more secure code, they faired poorly. This year’s 600-developer survey provides more quantitative data on what software developers understand about application security, both concepts and practices. It dives most deeply into awareness of defensive coding practices, which most developers largely did not grasp in the 2013 survey. It also is separates respondents by roles, so we can better understand how architects, developers, and QA staff grasp key application security concepts and put them to work. It better captures how software developers learn in general, so one can tailor any security training effort to how software developers, in practice, actually learn. This information will provide data to application security managers responsible for corporate security training that should allow them to make more fact-based decisions about security training.<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
== OWASP Dublin Chapter 2014 ==<br />
<br />
=== OWASP December Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event – David Rook/ Mark Hillick - Riot Games''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 4th December<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-chapter-meeting-riot-games-tickets-14523051839 register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking throughout,and pizza thanks to Morgan Mckinley<br><br><br />
<br />
'''Leveling up a global application security awareness program'''<BR><br />
'''David Rook - Riot Games - (http://ie.linkedin.com/pub/david-rook/3/41a/b1b) '''<BR><br />
<br />
David Rook is a Security Engineer focusing on Application Security at Riot Games in Dublin. David held various application security roles in the financial services industry since 2006 before moving into the computer games industry in early 2014. He has been a contributor to several OWASP projects including the code review guide and the Cryptographic Storage Cheat Sheet. He has presented at leading information security conferences including DEF CON, BlackHat USA and RSA Europe. In addition to his work with OWASP David created a security resource website and blog called Security Ninja.<br />
<br />
David strives to practice what he preaches and has backed up his work experience by developing two open source security code review tools called Agnitio and the Windows Phone App Analyser.<br />
<br />
'''Abstract:''' <BR><br />
<br />
The talk will focus on Riot application security awareness and knowledge sharing in a global company. I will talk about the application security awareness efforts we've implemented this year to bring application security knowledge to software engineers worldwide. These awareness efforts were designed to educate and support engineers around the world who work on high profile web properties and one of the worlds most popular computer games.<br />
<br />
I will explain how we've used a combination of traditional and innovative approaches to levelling up our software engineers security knowledge.<BR><BR><br />
<br><br><br><br><br><br />
<br />
''' Security and how it affects Users and Rioters '''<BR><br />
<br />
'''Mark Hillick Security Dude@Riot Games '''<BR><br />
<br />
Mark is a founder of HackEire, a founding member of IrissCert, the first person in Ireland to achieve the GIAC GSE, and has been stoking a passion for security for 14 years.<br />
<br />
Mark leads up the InfoSec team for Riot Games in Europe and is Product Owner of the Security Engineering vertical. Currently he's focused on building a team, engineering cool solutions, levelling the security program, finding the cloud, dealing with DDOS, and trying to earn Silver next year by himself.<br />
<br />
'''Abstract:''' <BR><br />
<br />
The presentation focuses on one of the major security aspects of Android Applications; rooting detection techniques. Many Apps, including (MDM) Mobile Device Management Agents, implements this check in different ways. The aim of the talk is to explore the effectiveness of these checks, with practical examples and explain the impact, in terms of security, of this control being bypassed or not implemented.<br />
<br />
A short demo will show the effects of having root permissions on an application when the application thinks you don't.Mark will be discussing his last 18 months at Riot and the increase in attention to security from both a player and Rioter perspective.<BR><BR><BR><br />
<br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
<br />
=== OWASP August Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event – Mobile Security''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Saturday 30th August<br><br>''' Registration: 09:30am <br>Talks Start: 10:00am <br> Event finishes at 6:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-mobile-security-day-30th-august-tickets-12685176705 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking throughout,and pizza thanks to BCC Risk Advisory (http://www.bccriskadvisory.com/) /edgescan (https://www.edgescan.com/)<br><br><br />
<br />
'''“Waving not Drowning” – Secure Mobile Development.'''<BR><br />
'''Eoin Keary - BCC Risk Advisory - (http://ie.linkedin.com/in/eoinkeary) '''<BR><br />
<br />
OWASP board member since 2009. Elected to position of global Vice Chair, September 2011. A long-time member of OWASP. Based in Dublin and director of BCC Risk Advisory Ltd. Eoin Keary has been with OWASP since 2004. He is based in Ireland and runs a software security practice, bccriskadvisory.com. He is currently on the global board of the OWASP foundation, he was elected to the board in 2009. During this time Eoin assisted in founding the OWASP legal entity in Europe and has helped provide structure to OWASPs finances and strategy.<BR><br />
<br />
'''Abstract:''' <BR><br />
<br />
In this talk Eoin shall discuss aspects of securing mobile apps from a source code standpoint. He shall discuss common pitfalls and associated with developing secure applications, why such issues are important and discuss “war stories” relating to real-world mobile app [in]security.<br />
<br />
This talk is suited to anyone involved in developing, managing development or testing mobile applications for security and robustness.<br />
<BR><BR><br />
<br />
''' Android rooting detection: how and why? '''<BR><br />
<br />
'''Giuliano Fasto – Espion – (http://uk.linkedin.com/in/giulianofasto) '''<BR><br />
<br />
Giuliano Fasto is a Security Consultant with more than six years of experience in the IT Security field. He has worked as a Security Consultant and Penetration Tester for well-respected security companies in Italy, the UK and Ireland. His academic background includes a BSc in IT Security and an MSc in Information Security and Audit. While he has a wide-ranging experience in penetration testing various systems and technologies, in recent years he has specialised in mobile application security testing, particularly on Android and iOS platforms. He is currently the lead mobile application tester at Espion.<br />
<br />
'''Abstract:''' <BR><br />
<br />
The presentation focuses on one of the major security aspects of Android Applications; rooting detection techniques. Many Apps, including (MDM) Mobile Device Management Agents, implements this check in different ways. The aim of the talk is to explore the effectiveness of these checks, with practical examples and explain the impact, in terms of security, of this control being bypassed or not implemented.<br />
<br />
A short demo will show the effects of having root permissions on an application when the application thinks you don't.<BR><BR><BR><br />
<br />
''' Bazuc - A talk about new types of attacks and vulnerabilities being exploited '''<BR><br />
<br />
'''Cathal McDaid – AdaptiveMobile - (http://ie.linkedin.com/pub/cathal-mc-daid/3/5b2/b77) '''<BR><br />
<br />
Cathal Mc Daid is Head of Data intelligence & Analytics in Adaptivemobile, and is responsible for a team dedicated to analysing and uncovering new threats to mobile operators and subscribers, using advanced ‘big data’ techniques. Cathal has 14 years experience in telecoms and wireless. Currently he is also Chairman of the GSMA’s Mobile Malware Group - who coordinates the world's response to mobile malware. His academic background includes a BEng in Computer Engineering from UL and an Executive MBA from INSEAD.<br />
<br />
'''Abstract:''' <BR><br />
<br />
Recent discussions and news about mobile malware primarily talk about new types of attacks and vulnerabilities being exploited. However what do you do when a user knowingly infects his handset for monetary gain?. In this presentation we will discuss a new type of mobile bad-ware, that promised and delivered the user money, in exchange for the renting out of his mobile device for unknown purposes. We discuss the app profile, tactics and impacts - on the users, on the network and on the stock market. <BR><BR><br />
<br />
<br />
<br />
''' OWASP Security Shepherd project '''<BR><br />
<br />
'''Mark denihan & Sean Duggan IBM (http://ie.linkedin.com/in/markdenihan , http://ie.linkedin.com/in/seankduggan ) '''<BR><br />
<br />
Mark is currently working on the IBM Ethical Hacking Team, the OWASP Dublin Board and founded of the OWASP Security Shepherd Project. He got his MSc in Information Security and Digital Forensics in the ITB and a BSc in Computing in the DIT. He also suffers from a love of caffeine and deep paranoia thanks to his extreme security enthusiasm.<br />
<br />
Sean has a BSc Computing from Dublin Institute of Technology, currently working in IBM with a passion for Android App Security and Development. He developed an interest in Mobile Application Security after reading about the OWASP Mobile Top Ten Risks in 2012 and has since been keeping up to date with Mobile App Issues. Sean leads the development of the mobile components in the OWASP Security Shepherd project.<br />
<br />
'''Abstract:''' <BR><br />
<br />
The OWASP Security Shepherd project has been designed and implemented with the aim of fostering and improving security awareness among a varied skill¬set demographic.<br />
<br />
Security Shepherd covers the OWASP Top Ten web app risks and has recently been injected with totally new content to cover the OWASP Top Ten Mobile risks as well. Many of these levels include insufficient mitigations and protections to these risks, such as blacklist filters, atrocious encoding schemes, barbaric security mechanisms and poor security configuration. <br />
<br />
The modules have been crafted to provide not only a challenge for a security novice, but security professionals as well. We're going to speak about the platform itself and what it offers someone wishing to teach or learn about mobile and web application security, such as the project’s anti plagiarism mechanisms or it’s flexible approach in presenting its users with lessons and resources.<BR><BR><BR><br />
<br />
<br />
''' CTF'''<BR><br />
<br />
CTF Using the above OWASP Security Shepherd project. <BR><br />
<BR><br />
''Please bring a laptop with Zed Attack Proxy/ Burp installed''<br />
<br />
<br />
<br />
'''Format for the day will be '''<BR><br />
<br />
9:30-10.00 -- Registration/ Networking<BR><br />
10:00-11:00 -- Speaker 1 50-55mins Talk<BR> <br />
11:00-12:00 --Speaker 2 50-55mins Talk <BR><br />
12:00-1:00 -- Speaker 3 50-55mins Talk <BR><br />
1:00-1:50 --Lunch <BR><br />
2:00-6:00 -- Mobile Shepherd talk leading into CTF. '''Please bring a laptop with Zed Attack Proxy/ Burp installed''' <BR><br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP May Event (2)===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event - Matt Johansen Sr. Manager for the Threat Research Center at WhiteHat Security''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 22nd May<br><br>''' Registration: 18:30 <br>Talk: 19:00<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.ie/e/owasp-chapter-meeting-may-tickets-11644682559 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking afterwards, with beer and pizza thanks to WhiteHat Security - https://www.whitehatsec.com/ <br><br />
<br />
'''*"Top 10 Web Hacks of 2013"*'''<br />
<br />
'''Matt Johansen Sr. Manager for the Threat Research Center at WhiteHat Security'''<br />
<br />
Matt Johansen is a Sr. Manager for the Threat Research Center at WhiteHat Security where he manages a team of Application Security Specialists, Engineers and Supervisors to prevent website security attacks and protect companies' and their customers' data. Before this he was an Application Security Engineer where he oversaw and assessed more than 35,000 web applications that WhiteHat has under contract for many Fortune 500 companies across a range of technologies.<br />
<br />
He was previously a security consultant for VerSprite, where he was responsible for performing network and web application penetration tests. Mr. Johansen is also an instructor of Web Application Security at Adelphi University, where he received his Bachelor of Science in Computer Science, and San Jose State University. He has also been utilized by the SANS Institute as an industry expert for certification review.<br />
<br />
List of past talks including videos/slides - http://mattjay.github.io/talks/ (BlackHat, DEFCON, RSA, SXSW, Many BSides, etc.<br />
<br />
Abstract:<br />
<br />
Every year the security community produces a stunning number of new Web hacking techniques that are published in various white papers, blog posts, magazine articles, mailing list emails, conference presentations, etc. Within the thousands of pages are the latest ways to attack websites, Web browsers, Web proxies, and their mobile platform equivalents. Beyond individual vulnerabilities with CVE numbers or system compromises, we are solely focused on new and creative methods of Web-based attack. Now in its eighth year, the Top 10 Web Hacking Techniques list encourages information sharing, provides a centralized knowledge base, and recognizes researchers who contribute excellent work.<br />
<br />
In this talk, We will do a technical deep dive and take you through the Top 10 Web Hacks of 2013 as picked by an expert panel of judges.<br />
<br />
This year’s winners are:<br />
<br />
1 - Mario Heiderich – Mutation XSS<br><br />
2 - Angelo Prado, Neal Harris, Yoel Gluck – BREACH<br><br />
3 - Pixel Perfect Timing Attacks with HTML5<br><br />
4 - Lucky 13 Attack<br><br />
5 - Weaknesses in RC4<br><br />
6 - Timur Yunusov and Alexey Osipov – XML Out of Band Data Retrieval<br><br />
7 - Million Browser Botnet<br><br />
8 - Large Scale Detection of DOM based XSS<br><br />
9 - Tor Hidden-Service Passive De-Cloaking<br><br />
10 - HTML5 Hard Disk Filler™ API<br><br />
<br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP May Event (1)===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event - Eoin Kearyof BCC Risk Advisory and Matej Saksida of Realex''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 1st May<br><br>''' Registration: 18:30 <br>Talk: 19:00<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: TCube<br><br />
Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland'''<br><br />
Venue Map: [https://maps.google.ie/maps?q=32+-+34+Castle+Street,+Dublin+2,+Ireland&hl=en&ll=53.343391,-6.269084&spn=0.004977,0.013679&sll=53.343392,-6.269086&sspn=0.009954,0.027359&hnear=34+Castle+St,+Dublin+2,+County+Dublin&t=m&z=17 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.ie/e/owasp-chapter-meeting-may-tickets-11354041243 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking afterwards, with beer and pizza thanks to BCC Risk Advisory (http://www.bccriskadvisory.com/) <br><br />
<br />
'''Talk 1: *"Top 10 defensive Java developer controls"*'''<br />
<br />
'''Eoin Keary - BCC Risk Advisory - (http://ie.linkedin.com/in/eoinkeary)'''<br />
<br />
OWASP board member since 2009. Elected to position of global Vice Chair, September 2011. A long time member of OWASP. Based in Dublin and director of BCC Risk Advisory Ltd.<br />
Eoin Keary has been with OWASP since 2004. He is based in Ireland and runs a software security practice, bccriskadvisory.com. He is currently on the global board of the OWASP foundation, he was elected to the board in 2009. During this time Eoin assisted in founding the OWASP legal entity in Europe and has helped provide structure to OWASPs finances and strategy. <br />
<br />
Abstract:<br />
<br />
In this talk Eoin shall go through a list of developer controls in order to help prevent common security vulnerabilities such those focused in the<br />
OWASP Top 10 2013. From input validation to contextual output encoding to crypto-secure storage, Eoin shall call out what developers can do to help<br />
mitigate such issues. Many of the mitigations are simple and use established API's such that developer need not be security experts and just<br />
use core components to help improve their security posture.<br />
<br />
<br />
<br />
<br />
<br />
'''Talk 2: *"Social Engineering - The Art of Human Hacking".*'''<br />
<br />
'''Matej Saksida - Realex Payments - (http://ie.linkedin.com/pub/matej-saksida-cism/20/412/176)'''<br />
<br />
Abstract:<br />
<br />
Nowadays if you want to hack a corporation or damage a personal "enemy" fast, Social Engineering techniques work every time and more often than not<br />
it works the first time. In this talk Matej shall go through what is social engineering is, types of social engineering and related threats.<br />
Matej shall call out practical example how to use Facebook to ruin someone's life and what countermeasures can be used against social engineering attacks.<br />
<br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP March Event ===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event - Rahim Jina of BCC Risk Advisory and Stephen Scott of Espion''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 13th March<br><br>''' Registration: 18:30 <br>Talk: 19:00<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: TCube<br><br />
Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland'''<br><br />
Venue Map: [https://maps.google.ie/maps?q=32+-+34+Castle+Street,+Dublin+2,+Ireland&hl=en&ll=53.343391,-6.269084&spn=0.004977,0.013679&sll=53.343392,-6.269086&sspn=0.009954,0.027359&hnear=34+Castle+St,+Dublin+2,+County+Dublin&t=m&z=17 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.ie/e/owasp-chapter-meeting-tickets-10802455435 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking afterwards, with beer and pizza thanks to Espion (http://www.espiongroup.com/)<br />
<br />
Talk 1: Building a shield of security - Vulnerability Management by the numbers and dumb robots!<br />
<br />
Rahim Jina - BCC Risk Advisory<br />
<br />
Rahim has been an active member of OWASP since 2008 and has contributed to many projects such as the OWASP Security Code Review Guide and is an ex-board member of the Irish Chapter. Previously Rahim was a senior security consultant at a “big 4” professional services firm and more recently, the head of security for Fonality Inc, a VoIP service provider based in Los Angeles. Rahim is currently a director for BCC Risk Advisory (bccriskadvisory.com), based in Dublin, Ireland. He is also responsible for the security architecture of the edgescan.comvulnerability management solution.<br />
<br />
Abstract: <br />
<br />
This presentation discusses how builders, breakers and defenders should look at vulnerability management when attempting to keep hackers at bay. We discuss the most common vulnerabilities which are not detected by security tools nor automation but nevertheless are common and can be used to commit real fraud resulting in financial loss. We will see that Web Application Firewalls are ineffective against such attacks and why the only practical solution is to apply a layered approach across all aspects of the SDLC.<br />
<br />
<br />
<br />
Talk 2: "PCI's Changing Environment - What You Need to Know & Why You Need To Know It".<br />
<br />
Stephen Scott - Senior Consultant and PCI QSA in Espion's Information Government practice<br />
<br />
Stephen Scott, Consultancy Team lead in Espion, is an experienced information security, risk and compliance consultant whose experience spans across many different areas including, PCI DSS, information security, risk management, group internal audit, IT service management and regulatory compliance. Stephen has extensive experience with information security, internal control testing, compliance programmes, information risk management, and process improvement. Stephen has worked across a wide range of industry verticals, including financial, industrial and insurance.<br />
<br />
Abstract:<br />
<br />
PCI DSS – The Payment Card Industry Data Security Standard sets common requirements for securing payment card information (credit, debit, some gift cards), and lays out a range of controls relating to auditing, scanning and assessment.<br />
<br />
This presentation discusses the ever evolving PCI environment, specifically focusing on the changes in the recent release of version 3 of the PCI DSS standard. Stephen will start off by giving a brief background to PCI, including motivators for merchant and service providers to adhere to the standard. In addition to this, the presentation will highlight what security considerations are relevant to application and information security practitioners.<br />
<br />
<br />
<br />
<br />
|-<br />
|}<br />
<br />
<br />
== OWASP Ireland 2013 Agenda ==<br />
<br />
=== OWASP July Event ===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event - Jeremiah Grossman - Another Year in Web Security''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 4th July<br><br>''' Registration: 17:30 <br>Talk: 18:00<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: TCube<br><br />
Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland'''<br><br />
Venue Map: [https://maps.google.ie/maps?q=32+-+34+Castle+Street,+Dublin+2,+Ireland&hl=en&ll=53.343391,-6.269084&spn=0.004977,0.013679&sll=53.343392,-6.269086&sspn=0.009954,0.027359&hnear=34+Castle+St,+Dublin+2,+County+Dublin&t=m&z=17 Google Maps] <br><br />
''(Registration. [http://www.eventbrite.com/event/7127672059 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | Jeremiah Grossman of WhiteHat Security will be in Dublin and will be talking at our next chapter event. His talk "Another Year In Web Security: What did 2012 teach us about survival in the coming years?" promises a great insight into the future of web security.<br />
<br />
Jeremiah Grossman, founder and CTO of WhiteHat Security, is a world-renowned expert in web application security and a founding member of the Web Application Security Consortium (WASC). At WhiteHat, Mr. Grossman is responsible for web application security R&D and industry evangelism. He is a frequent speaker at industry events including the BlackHat Briefings, ISACA's Networks Security Conference, NASA, ISSA and Defcon. <br />
<br />
A trusted media resource, Mr. Grossman has been featured in USA Today, the Washington Post, Information Week, NBC Nightly News, and many others. Mr. Grossman is also a featured expert and frequent contributor on TechTarget'sSearchAppSecurity.com.<br />
|-<br />
|}<br />
<br />
=== OWASP June Event ===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''CONFERENCE AND TRAINING''' <br />
|-<br />
| align="center" style="background:#EEEEEE;" colspan="2" | <br />
== '''OWASP Europe Tour - Dublin 2013''' == <br />
'''Tuesday 25th June''' ''(Training. [https://www.owasp.org/index.php/EUTour2013#Training Info about the training session])'' <br>'''Wednesday 26th June''' ''(Conference. [https://www.owasp.org/index.php/EUTour2013#Dublin Info and registration link for the conference])''<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | '''OWASP Europe TOUR,''' is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.<br />
<br />
*Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle.<br />
<br />
* This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.<br />
|-<br />
|}<br />
<br />
=== OWASP May Event ===<br />
<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''TRAINING & TALKS''' <br />
|-<br />
| align="center" style="background:#EEEEEE;" colspan="2" | <br />
== '''OWASP Dublin - Realex Payments Application Security Workshop''' == <br />
'''Thursday 30th May'''<br> ''('''Training'''. 1:30pm- 5:00pm)'' <br>('''Talks'''. 6:00pm - 8:00pm)''<br>[http://www.eventbrite.com/event/6665658163/eorg Click here for more information]<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | '''Training'''<br />
<br />
Eoin Keary will be delivering free application security training between 2pm and 5pm on the 30th May. Eoin was the founder of OWASP Ireland and is currently the global vice chair for OWASP (amongst many other things! https://www.owasp.org/index.php/Eoin_Keary). He has delivered application security training to many developers and security professionals around the world and recently delivered a training course to over 400 people at the RSA Conference.<br />
<br />
The training will focus on secure application development and why we can't hack ourselves secure. It will be covering why penetration testing on its own does not work approaches to improvement including "knowing what you don't know" and how to measure change.<br />
<br />
It will be technical training covering XSS eradication, client side security and browser DOM curiosities.<br />
<br />
'''Talks'''<br />
<br />
The talks will be starting at 6pm in our office and OWASP have arranged two very interesting talks! Diarmaid McManus https://twitter.com/elephant_rb from Realex Payments will be expanding his award winning SecurityBSides London Rookie Track talk https://www.securityninja.co.uk/application-security/securitybsides-london-esp-security-plugin/ to include more details about static analysis approaches and his research and development work on ESP: Security Plugin https://github.com/diarmaid-mcmanus/ESPSecurityPlugin.<br />
<br />
Hugh Pearse https://twitter.com/hughpearse will be talking about Low Level Exploits and this looks like it will be a great talk:<br />
<br />
“In 2010 Mr Haroon Meer from thinkst.com presented a timeline of memory corruption vulnerabilities and their mitigation techniques dating from 1985 to 2010. In his 35 page publication he referenced almost 150 events in low level information security history. The scope of the presentation "Low Level Exploits" is to explain in detail some of the most significant attacks in from Haroon Meers research. The attacks covered in this presentation include buffer overflows on the stack, heap overflows, integer overflows, format strings, null pointers and ROP chains. This brings us to exploits in the present day where researchers are looking for the successor of the buffer overflow attack, next big exploit.”<br />
|-<br />
|}<br />
<br />
<br />
<br />
== OWASP Ireland 2011 Agenda ==<br />
<br />
=== [[Ireland/Training/OWASP projects and resources you can use TODAY]] ===<br />
<br />
[[Image:Owasp logo Ireland Training 11 March 2010.gif]]<br />
<br />
*'''Overview & Goal'''<br />
**Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. <br />
**This course aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them. <br />
**The course will be very practical where demonstration and hands-on exercises will be provided for the tools covered. <br />
**If you are interested in participating in the hands on portion of the course, please bring a laptop. <br />
*'''Dates'''<br />
**March, 2011, 11<br />
*'''Course Main Content and Registration'''<br />
**[[Ireland/Training/OWASP projects and resources you can use TODAY|Click here]]<br />
<br />
== OWASP Ireland 2010 ==<br />
<br />
[[Image:Dublin2010.gif]]<br />
<br />
Click [[OWASP IRELAND 2010]] for more information <br><br><br />
<br />
== OWASP Ireland 2010 Agenda ==<br />
<br />
<br><br />
<br />
==== AUG 2010 ====<br />
== OWASP August Event ==<br />
<br />
'''When:''' 11/8/2010 6:00pm - 8:00pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br />
<br><br />
'''Title:''' OWASP ESAPI Swingset: Introduction & Demo by Cathal Courtney<br />
<br><br />
'''Abstract:''' The ESAPI Swingset is a web application which demonstrates common security vulnerabilities and asks users to secure the application against these vulnerabilities using the ESAPI library. The application is intended for Java Developers. The goal of the application is to teach developers about the functionality of the ESAPI library and give users a practical understanding of how it can be used to protect web applications against common security vulnerabilities. During the talk, Cathal will demonstrate how to install and use ESAPI Swingset in your organization. A copy of the latest version will be also provided to the attendees.<br />
<br><br />
'''Presenter:''' Cathal is an experienced developer working at AIB and is currently the ESAPI Swingset project leader. More information about this project could be found here: [http://www.owasp.org/index.php/ESAPI_Swingset Esapi SwingSet]<br />
<br><br />
'''Download Presentation:''' Not available<br />
<br><br><br />
'''Title:''' Security Implications for Web Applications based on SOA by John Marmelstein<br />
<br><br />
'''Abstract:''' The main point of SOA (in this context) is combining systems and applications to make new applications, or a big 'overall' application.This higher inter-operability does (by default) lower security. For a start, a request originating from a web user might end up at several back end systems, which do not know who or what the request came from.<br />
<br><br />
Each back end system might have no access to the customer data, have a different security models, and serve serveral front end. Each of the above systems could be under different ownership, thus the owners have different concerns and priorities. Also, the basic solution at a technical level include single sign on, or security as a service. This can be costly, give limited coverage and have a performance hit. But is pretty much the only way to do it. The other thing to do (probably in tandem) is strict management, and delegation of authority.<br />
<br><br />
'''Presenter:''' John has about 13 years in IT. Most of this in distributed systems and 'Middleware' integration software. Including BEA (now owned by Oracle). Mainly working on Enterprise Java and more recently on Microsoft BizTalk. Various industries, incuding financials, public services, and a fish farm.<br />
<br><br />
'''Download Presentation:''' <br />
<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== SEP 2010 ====<br />
<br />
== APPSEC IRELAND 2010 ==<br />
<br />
Due to popular demand we are hosting the 2nd OWASP IRELAND event, '''OWASP Ireland 2010'''. <br>Continuing last years highly successful conference, with more than 150 attendees from across the globe OWASP is happy to repeat this positive experience. <br>Delegates from numerous industry verticals attended the 2009 event; from government to finance to telecoms. Share your thoughts at this open event with some of the most experienced individuals in the information security industry. <br />
<br />
[http://www.owasp.org/index.php/OWASP_IRELAND_2010 [[Image:Dublin2010.gif]]]<br>[[OWASP_IRELAND_2010]]<br><br />
<br />
'''When:''' '''September 17th 2010'''<br><br />
<br />
'''Where:''' Trinity College Dublin, The Hamilton Building <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [[Eoin Keary|Eoin Keary]]. <br><br />
<br />
'''Subscribe to the OWASP Ireland [https://lists.owasp.org/mailman/listinfo/owasp-ireland mail list] for the up-to-date information.''' <br />
<br />
<br><br />
<br />
==== OCT 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== NOV 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== DEC 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
<br><br />
<br />
==== 2010 Chapter Plan ====<br />
<br />
'''Special Project:'''Educational Outreach<br>Summary: Drive education awareness of OWASP among Irish Universities and Third Level Institutions. <br>Plan: &lt;insert plan&gt; <br>Next Milestone: Update the plan<br>Participants: Fabio Cerullo <br><br><br />
<br />
'''Special Project:'''Industry Outreach<br>Summary: Raise awareness of OWASP among Irish industry.<br>Plan: &lt;insert plan&gt; <br>Next Milestone: Update the plan<br>Participants: Eoin Keary<br><br><br />
<br />
'''Special Project:'''Membership Drive <br>Summary: Increase local chapter members individuals and corporate supporters <br>Plan: &lt;insert&gt; <br>Next Milestone: Update the plan<br>Project Participants: Rahim Jina<br><br><br />
<br />
'''Special Project:'''Hands-On Training<br>Summary: Provide 1-day, 3-day and 5-day hands-on classroom / online training classes<br>Next Milestone: Organize Training Offerings<br>Project Participants: Fabio Cerullo<br><br><br />
<br />
<br>Call For Presentations for 2010 is now open - please contact fcerullo(@)owasp.org / +353877817468 if you would like to speak or can host a meeting. <br><br>*Note meeting hosts are provided with annual chapter sponsorship and free seats in training classes. The OWASP Foundation, Ireland chapter focuses on implementation of efforts defined by the [http://www.owasp.org/index.php/Global_Committee_Pages Global Committee] as well as new concepts and ideas defined locally. Below are a list of ACTIVE projects assigned to individual active members and teams within the local chapter. If you would like to help out on ANY of these efforts, contact them directly to get involved <br />
<br />
==== FEB 2010 ====<br />
<br />
== OWASP Ireland Event - What is the O2 Platform? ==<br />
<br />
'''When:''' 19/2/2010 3:00pm - 5:00pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br><br />
<br />
'''Title:''' OWASP O2 Platform - Open Platform for automating application security knowledge and workflows <br>'''Abstract:''' In this talk Dinis Cruz will show the OWASP O2 Platform which is an open source toolkit specifically designed for developers and security consultants to be able to perform quick, effective and thorough 'source-code-driven' application security reviews. The OWASP O2 Platform (http://www.owasp.org/index.php/OWASP_O2_Platform) consumes results from the scanning engines from Ounce Labs, Microsoft's CAT.NET tool, FindBugs, CodeCrawler and AppScan DE, and also provides limited support for Fortify and OWASP WebScarab dumps. In the past, there has been a very healthy skepticism on the usability of Source Code analysis engines to find commonly found vulnerablities in real world applications. This presentation will show that with some creative and powerful tools, it IS possible to use O2 to discover those issues. This presentation will also show O2's advanced support for Struts and Spring MVC. <br />
<br />
'''Presenter:''' Dinis Cruz is a Security Consultant based in London (UK) and specialized in: ASP.NET/J2EE Application Security, Application Security audits and .NET Security Curriculum Development. For the past years Dinis has focused on the field of Static Source Code analysis, from May 2007 to Dec 2009 he worked as a independent consultant for Ounce Labs (bought by IBM in July 2009) where during active security engagements using Ounce's technology he developed the Open Source codebase which now is the foundation of the OWASP O2 Platform. Dinis is currently focused on making the O2 Platform the industry standard for consuming, instrumenting and data-sharing between the multiple WebAppSec tools, the Security consultants and the final developers. Dinis is a also active trainer on .Net security having written and delivered courses for IOActive, Foundstone, Intense School and KPMG (at multiple locations including BlackHat), and has delivered a number of presentations and keynote speeches at multiple OWASP and Security related conferences. At OWASP, Dinis is the leader of the [[OWASP O2 Platform]] project, member of the OWASP [[Global Projects Committee]], chair of the [[OWASP Connections Committee]] and member of the [[About The Open Web Application Security Project#Global_Board_Members|OWASP Board]]. <br />
<br />
'''Download Presentation:''' http://www.o2-ounceopen.com/files-binaries-source-and-demo/old-documents-and-presentations/OWASP_O2_Platform_-_AppSec_Ireland_Sep_2009.pdf <br />
<br />
== IISF/OWASP – February Chapter Meeting ==<br />
<br />
'''When:''' 25/2/2010 2:00pm - 4:00pm <br><br />
<br />
'''Where:''' Georgian Suite, Buswells Hotel, Molesworth St., Dublin 2 <br />
<br />
'''Title:''' An overview of Web Application Security threats and technologies. Practical advice and techniques for improving Application Security, presented by OWASP. <br />
<br />
2:00 - Introduction by IISF Chairman <br />
<br />
2:05 - Presentation&nbsp;: “Practical advice for improving Application Security” - Introduction to OWASP and OWASP Top Ten - Demonstration video of typical web based attacks with high level explanation - Live SQL injection demo using WebGoat &amp; WebScarab - Live Cross Site Scripting demo using WebGoat &amp; WebScarab <br />
<br />
'''Download Presentation:''' [[Image:IISF 250210 part1.ppt]] <br />
<br />
3:00 - Coffee <br />
<br />
3:20 – Presentation continues - Application Security: "The problems we are faced with" - The Application Security Verification Standard - SDLC &amp; Security Assurance Maturity Model - Code Review versus traditional Runtime Testing. - Q&amp;A <br />
<br />
'''Download Presentation:''' [[Image:IISF 250210 part2.pptx]] <br />
<br />
4:00 - Close of Meeting <br />
<br />
4:05 - Traditional networking in Buswells Bar <br />
<br />
<br><br />
<br />
==== MAR 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP - 26/3/2010 ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== APR 2010 ====<br />
<br />
== OWASP Live CD - An open environment for Web Application Security ==<br />
<br />
'''When:''' 16/4/2010 2:30pm - 5:00pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br><br />
<br />
'''Title:''' OWASP Live CD - An open environment for Web Application Security <br>'''Abstract:''' This CD collects some of the best open source security projects in a single environment. Web developers, testers and security professionals can boot from this Live CD and have access to a full security testing suite. This presentation aims to provide a showcase for the great OWASP tools and documentation materials available in the CD, tips and tricks, and also some introductory stuff regarding code review and penetration testing. <br>Training is aimed at introductory /intermediate level in terms of pen testing, code review and tools. <br />
<br />
'''Presenters:''' <br />
<br />
'''Rahim Jina''' <br>Rahim Jina currently works as a senior consultant for Ernst &amp; Young's Risk Advisory Services in Dublin. He has worked there for nearly four years primarily delivering penetration testing services to clients globally, focusing on web applications and secure code review. He has been involved with OWASP for the past two years, being involved in the Summer of Code 2008 as lead reviewer for the Code Review Guide 2009. He has also made contributions to the SAMM project (OpenSAMM). He holds an MSC in Security and Forensic Computing from DCU and a degree in computer science from Trinity college. <br>'''Eoin Keary''' <br>Eoin is a long time member of OWASP and have contributed year on year to OWASP projects and the OWASP mission of fighting the causes of software insecurity. He is based in Dublin, Ireland and run the Ernst &amp; Young application security team across Europe. His OWASP contributions to date include the OWASP Code Review Guide, OWASP Testing Guide, OWASP SAMM, and OWASP ASVS. He is a member of the OWASP Global Industry Committee, chair of the OWASP Conferences Committee and member of the OWASP Global Board. Eoin founded the OWASP Ireland chapter back in 2004 and currently serves as Vice President of the OWASP Ireland Board. <br />
<br />
'''Pictures from the event:''' <br />
<center><br />
{| class="FCK__ShowTableBorders"<br />
|-<br />
| <br />
[http://www.owasp.org/images/d/db/P1040923_1024.JPG [[Image:|P1040923_small.jpg]]]<br>[http://www.owasp.org/images/d/db/P1040923_1024.JPG zoom]<br />
<br />
| <br />
[http://www.owasp.org/images/f/f3/P1040927_1024.JPG [[Image:|P1040927_small.jpg]]]<br>[http://www.owasp.org/images/f/f3/P1040927_1024.JPG zoom]<br />
<br />
| <br />
[http://www.owasp.org/images/6/64/P1040929_1024.JPG [[Image:|P1040929_small.jpg]]]<br>[http://www.owasp.org/images/6/64/P1040929_1024.JPG zoom]<br />
<br />
|}<br />
</center><br />
'''Download Presentation:''' [http://www.owasp.org/images/e/ee/OWASP_Live_CD.pptx [[Image:|Download.png]]] <br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''Where:''' Odeon Pub <br><br />
<br />
'''When:''' After OWASP Live CD training <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== MAY 2010 ====<br />
<br />
== OWASP Event: Trials &amp; Tribulations of WAF Implementation ==<br />
<br />
'''When:''' 20/5/2010 6:30pm - 7:30pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br><br />
<br />
'''Title:''' Trials &amp; Tribulations of WAF Implementation<br>'''Abstract:''' A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-site Scripting (XSS) and SQL Injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.<br>Mark will be presenting on his experience in implementing a Web Application Firewall solution through all phases from research to implementation. <br />
<br />
'''Presenters:''' <br />
<br />
'''Mark Hillick - Application Networking Team, Citrix Systems''' <br>Mark Hillick has 10 years experience in relation to Internet, networking, systems administration and security engineering. <br />
<br />
Mark graduated from Queen's University, where he studied Mathematics. <br />
<br />
Mark joined AIB from Queen's where he joined the Internet Infrastructure team, where he was responsible for designing, building and securing the Internet service in and out of AIB. He is a prominent member of the IT Security community in Ireland and has presented at several local security forums such as IISF and Owasp. Mark is one of the founding members of IRISS CERT, where he is also a Volunteer Incident Handler. He helped organise IRISSCon 2009, where he also designed and built HackEire 2009, the first Ethical Hacking 'Capture The Flag' contest in Ireland.<br><br />
<br />
'''Pictures from the event:''' <br />
<br />
{| class="FCK__ShowTableBorders"<br />
|-<br />
| <br />
[[Image:20052010017.jpg|thumb|A caption from Mark's talk]]<br />
<br />
|}<br />
<br />
<br><br />
<br />
'''Download Presentation:''' [http://docs.google.com/fileview?id=0B3vrVYEosFeEZDMyZjIzYTktMzNkZC00ZjBlLWFiYTgtNThjZGE4YTE1NmFj [[Image:|Download.png]]] <br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''Where:''' Odeon Pub <br><br />
<br />
'''When:''' After WAF presentation <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
<br><br />
<br />
==== JUN 2010 ====<br />
<br />
== OWASP Event: Define Security Requirements - A practical approach ==<br />
<br />
'''When:''' 20/5/2010 6:30pm - 7:30pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br><br />
<br />
'''Title:''' Define Security Requirements - A practical approach<br>'''Abstract:''' The Data Protection Act states that "appropriate security measures" must be taken to protect personal data. How do you specify the appropriate security measures for a website which processes personal data? It is an important step in a development project, but is often neglected. In this talk, Alexis will descibe his own experiences of assessing web application, and will also look in more detail at what the Data Protection Commissioner says. He will then take a fictional website and look at a practical approach to specifying the security requirements that the fictional application should meet. This will use the kind of risk-based techniques outlined by OWASP or the Microsoft Secure Development Lifecycle (SDL). Issues discussed will include encryption, authentication, access control, audit, etc. The result will be a list of security requirements that can be carried into the design and development phases. Attendees should be able to apply the ideas to their own development projects. <br />
<br />
'''Presenters:''' <br />
<br />
'''Alexis Fitzgerald - Rits Information Security Group''' <br>For the last six years Alexis has worked for Rits Information Security Group, where he performs application penetration testing assignments as well as advising clients on application security issues. Before that, he spent many years as a developer (mainly in the financial sector), and he continues to be involved in development. Alexis holds an MSc in Information Security from the University of London, Royal Holloway.<br><br />
<br />
'''Pictures from the event:''' <br />
<br />
{| class="FCK__ShowTableBorders"<br />
|-<br />
| <br />
|}<br />
<br />
<br><br />
<br />
'''Download Presentation:''' [[Image:OWASP Ireland June10.pdf]] <br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' After Alexis presentation <br><br />
<br />
'''Where:''' Odeon Pub <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== JUL 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
<br />
<br><br />
<br />
<br><br />
<br />
__NOTOC__ <headertabs /><br />
<br />
[[Category:Ireland]]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=Dublin&diff=212269Dublin2016-04-01T12:17:46Z<p>Owen Pendlebury: </p>
<hr />
<div>{{Chapter Template|chaptername=Ireland|extra= [[File:Owasp_logo_ireland_small.jpg]]| mailinglistsite=https://lists.owasp.org/mailman/listinfo/owasp-ireland}} become a [http://www.owasp.org/index.php/Membership#Categories_of_Membership_.26_Supporters Member or Annual Chapter Sponsor(s)]. <br><br />
<br />
'''Becoming a chapter sponsor means that you get your organisation mentioned in meeting promotion (including on this page), recognition at the beginning of the meeting and promotional material at the meeting. <br><br />
We currently have the following sponsorship options available: <br><br />
€250 for an individual meeting sponsorship<br><br />
€1500 for annual chapter sponsorship<br><br />
Contact any of the board members below for more information. <br>'''<br />
<br />
== OWASP Ireland Board ==<br />
<br />
Should you have a question about the local chapter, would like to get more involved contact ANY of the following people below <br><br><br />
<br />
*'''Chapter Lead''' [mailto:Owen.Pendlebury(at)owasp.org mail[[User:Owen Pendlebury|Owen Pendlebury]]] +353876605277<br><br />
*'''Board Member''' [mailto:Mark.Denihan(at)owasp.org Mark Denihan]<br><br />
*'''Board Member''' [[User:EoinKeary|Eoin Keary]] <br><br />
*'''Board Member/ Global Board Member''' [mailto:fcerullo(at)owasp.org Fabio Cerullo] <br><br />
*'''Board Member''' [mailto:Tony.Clarke(at)owasp.org Tony Clarke]<br><br />
<br />
<br />
<br />
<br />
<br />
<br>'''OWASP Ireland'''<br>40 Block E, Smithfield Market Smithfield <br> Dublin 7, Ireland <br>Tel: +353876605277 <br><br><br />
== OWASP Dublin Chapter 2016 ==<br />
=== OWASP March Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Session 1 – Data Protection / Session 2 - Working in IT Security Panel ''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 31st March<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-march-event-session-1-general-data-protection-regulation-gdpr-session-2-working-in-it-tickets-23939161677register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | Thanks to Morgan McKinley for sponsoring the event<br><br><br />
<br />
<br />
'''Session 1 – Hugh Jones - General Data Protection Regulation (GDPR) ''' [[File:OWASP_INtro_to_GDPR_1603.ppt]]<br />
<BR><br />
<br />
With the current EU legislation passing its 20th year back in October, it is high time that the EU Data Protection regime caught up with everything that is happening in the commercial, technological and social media sectors. The EU Commission has recently published the final draft of the new General Data Protection Regulation (GDPR), scheduled to take effect across the EU in early 2018. <BR><br />
<br />
<br />
For organisations who already have a culture of DP compliance in place, the new Regulation will introduce a few changes, but nothing particularly challenging. For those who have ignored or failed to step up to the 1995 Directive, the next two years could be a very busy time indeed! <BR><br />
<br />
This overview of the Regulation provides an understanding of the key concepts contained in the new legislation, the main areas of change, and some good advice on the steps which organisations need to take in order to prepare in a timely and organised manner.<br />
The key motto being: “Don’t Panic!”” <BR><br />
<br />
'''Session 2 – Working in IT Security'''<br />
<br />
A panel of experts will discuss what it is like to work in IT Security industry in Ireland. The aim is of this session is to give the audience an overview of the different types of roles and opportunities in IT Security and afford the audience an opportunity to ask questions in relation to any aspect of IT Security. <BR><br />
<br />
'''1. Jason Flood– CTO IBM'''<BR> <br />
<br />
Jason Flood is currently completing his Phd at the Institute of Technology in Blanchardstown. He is also heavily involved in the Security Research Lab, located in the Learning & Innovation Centre in ITB. His main research area is in the field of cyber-security and risk analysis. <BR><br />
<br />
Jason is founder of the Irish honeynet project and contributor to OWASP. He is also a board member of InfoSecurity Ireland. Jason is the CTO in IBM in the security space. Jason has helped deliver numerous Capture-the-Flag events at both a local, national and international level over the last 5 years for events such as Appsec, Source and IRISS. <BR><br />
<br />
'''2. Dara Boland – Morgan McKinley'''<BR><br />
<br />
Dara Boland heads up Morgan McKinley’s Information Security Recruitment team. He is a connector, blogger and market leader who is constantly helping companies locate and hire the right people, across the whole spectrum of Information Security. Dara has an extensive network and reputation in Ireland and across Europe. <BR><br />
<br />
'''3. Hugh Callaghan – Executive Director EY '''<BR><br />
<br />
Hugh is the Executive Director in our EMEIA Financial Services Advisory team with responsibility for leading our rapidly growing Advanced Security Centre, which is EY’s market-leading capability hub for delivering cyber security services to large domestic and multinational clients. Hugh has previous experience of large-scale technical security testing programmes, online banking fraud strategy, business-driven security architecture, cyber security roadmap definition and improvement programme delivery. Hugh currently has a significant focus on helping both boards and top executive management understand the implications of the cyber security threat environment in the context of their businesses, consistent with EY’s mission of making the digital world a safer place to do business. <BR><br />
<br />
Hugh is a research scientist by background, with a Ph.D. in computational physics from University College Cork and the Max Planck Institute, Germany. Hugh joined EY in 2003 from an international electronic payments company. <BR><br />
<br />
'''4. Rahim Jina – Director BCC Risk Advisory'''<BR><br />
<br />
Rahim is a director in BCC Risk Advisory and parent company of edgescan™, based in Ireland. Prior to this, Rahim was Head of Security for Fonality, a VOIP provider based in Los Angeles and was also a senior security consultant for a ‘Big 4’ consultancy firm for many years. Rahim has a degree in Computer Science from Trinity College Dublin and an MSc in Security & Forensic Computing from Dublin City University. Rahim has been an OWASP contributor and volunteer since 2007. <BR><br />
<br />
'''5. Declan Timmons – Principal Security Consultant Ward Solutions ''' <BR><br />
<br />
Declan is Ward Solutions Principal Security Consultants in Forensics and e-Discovery operating at both the consultative and practitioner level. Originally a member of the defence forces in Ireland, Declan has a 1st class honours masters in cybercrime and forensics investigations, as well as a Certified Encase Forensics Examiner (EnCE), Certified Information Security Manager (CISM), and ISO-27001 Lead Auditor. <BR><br />
<br />
'''6. Leonard McAuliffe – Director - Cyber Security and Forensics at PwC'''<BR><br />
<br />
Leonard leads the Cyber Security and Forensics practice for PwC Ireland. Leonard has worked in the area of Cyber Security and Forensics for over 17 years and had delivered Cyber Security and Forensics services to many top international and national clients in many sectors. Some of Leonard’s Cyber Security areas of expertise include Cyber Strategy and Operating Models, Governance & Program Management,Cyber Security Architecture, Cyber Security Standards, Data Protection and Privacy, Identity and Access Management, Vulnerability Management, Ethical Hacking, Application Security, Cloud Security, Mobile Device Management, infrastructure and operational security reviews.<br />
<br />
<BR><br />
<br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org''' or Tony Clarke on '''tony.clarke(at)owasp.org'''<br />
<BR><br />
<br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP February 2016 Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Gavin O’Gorman and Alain Abou Tass ''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 25th February<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration [https://www.eventbrite.com/e/owasp-february-event-gavin-ogorman-and-alain-abou-tass-tickets-21790679509 register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | <br />
<br />
We are delighted to to welcome Gavin O’Gorman and Alain Abou Tass for our latest OWASP Dublin Chapter meeting. Registration will start from 6:30pm 25th February with talks beginning at 7:00pm.<br />
<br />
There will be beer and Pizza generously provided by Morgan McKinley<br><br />
<br />
<br />
'''Gavin O’Gorman– Symantec - ''' <br />
<BR><br />
Working in Symantec for the past six years, Gavin is an intelligence analyst on the attack investigations team. Before moving to the attack investigations team in 2013, he worked as a reverse engineer, and later as an incident handler. Gavin’s primary role is to gather together information from both Symantec data sources, and open sources, in order to build a comprehensive picture of an attack, or attackers. Another aspect of the job is to work with law enforcement to assist in the investigation of e-crime where possible. Prior to working in Symantec, Gavin spent several years researching network security in Dublin City University, and currently lectures part-time for the Masters in Security & Forensics course. <BR><br />
<br><br><br />
''' Alain Abou Tass – Ward Solutions - Web applications on the battlefield''' [[File:Battle20160225-V1.0.0.pptx]]<br />
<BR><br />
Penetration testers spend most of their time identifying security holes. Sometimes if we’re lucky enough, we hit the jackpot. In this talk, I will be detailing some instances of real life attacks on web applications. I’ll show how one small vulnerability, in conjunction with others, can be lethal and lead to a big breach. This will highlight the importance of fixing the small issues that are usually neglected. Also, I’ll show some interesting tricks that can be used to exploit existing vulnerabilities.<br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
== OWASP Dublin Chapter 2015 ==<br />
=== OWASP December Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Tony Clarke and William Bailey ''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 10th December<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration [https://www.eventbrite.com/e/owasp-december-event-christmas-party-tony-clarke-will-bailey-tickets-19873992647 register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | The event will be followed by our annual Christmas party in a location to be decided. I would like to thank our sponsors Ward Solutions, Integrity 360,BH Consulting, Edgescan and Morgan McKinley. There will be a raffle during the event for a Samsung Galaxy Tab. <br />
<br><br />
<br />
<br />
'''Tony Clarke – ICON PLC - Application security in a cyber security program''' [[File:OWASP-v1.0.pptx]]<br />
<BR><br />
Data breaches such as the recent Talk Talk and Vtech breaches are regularly reported on in the media and its clear that existing approaches to application security are flawed and failing. This session will examine application security in the context of a cyber security program and will outline an approach to application security which facilitates modern development practices and standards. The session will examine security models, controls, processes and metrics which are required to prevent, detect and respond to these types of breach and integrate with operational models and compliance requirements.<br />
<BR><br />
<br><br><br />
'''Will Bailey – IBM - Drop your breaches''' [[File:OWASP_will_20151210.pptx]]<br />
<BR><br />
In this talk, I'll cover how we could be doing a much better job of improving the security of applications by educating developers better and why the approach a lot of the current security education employs both in the professional and academic spheres is wrong.<br />
<br />
I'll also explain why it's a reflection on why I'm more likely to hire a half decent coder than a security graduate these days, so if you're currently studying and/or looking to get a a job in application security / ethical hacking in the near future this might be your ticket!<br />
<br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP July Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Eoin Keary - Security Boot camp''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 16th July<br><br>''' Registration: 13:00pm <br>Talks Start: 13:00pm <br> Event finishes at 17:30pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration Members. [https://myowasp.force.com/login Members register here])''<br />
''(Registration Non-Members. [https://myowasp.force.com/MN4__PublicEventRegistration?id=a2oU0000000TZAOIA4 Non-Members register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | Thanks to Morgan McKinley for sponsoring the event<br><br><br />
<br />
'''Security Boot Camp'''<BR><br />
'''Eoin Keary – CTO BCC Risk Advisory '''<BR><br />
<br />
Eoin was on the international board of OWASP, the Open Web Application Security Project from 2009-2015 and during his time in OWASP he has lead the OWASP Testing and Security Code Review Guides and also contributed to OWASP SAMM, OWASP CISO Guide and the OWASP Cheat Sheet Series. <br />
<br />
Eoin is a well-known technical leader in industry in the area of software security and penetration testing, and has led global security engagements for some of the world's largest financial services and consumer products companies. He is the CTO and founder of BCC Risk Advisory which deliver professional security services and edgescan.com, a managed cloud-based SaaS, web vulnerability service.<br />
<br />
'''Abstract:''' <BR><br />
<br />
All - Please join us for a free security boot camp.....<br />
<br />
OWASP is hosting a special FREE security boot camp for all Owasp members and local developers. <br />
The training is recommended for developers who want to learn more about securing their code.<br />
Presented by Eoin Keary, this intensive boot camp focuses on the most common web application security problems, including aspects of both the OWASP Top Ten and the MITRE Top 25.<br />
The course will introduce and demonstrate application security techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code and understand fixes.<br />
<br><br><br><br><br><br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
=== OWASP June Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event – Jason Flood (IBM) & Paul Mooney (Free Lance)''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Tuesday 16th June<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location Hilton Dublin<br><br />
Venue Address: Charlemount Place, Dublin 2 '''<br><br />
Venue Map: [https://www.google.ie/maps/place/Hilton+Dublin/@53.330893,-6.259998,15z/data=!4m2!3m1!1s0x0:0x5b92598f4735994e?sa=X&ved=0CIQBEPwSMAtqFQoTCMyG-cibhcYCFQaWLAodAFAAeg Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-june-event-hilton-dublin-jason-flood-paul-mooney-tickets-17318536208register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | Thanks to Morgan McKinley for sponsoring the event<br><br><br />
<br />
'''Understanding cyber gaps in the human'''<BR><br />
'''Jason Flood – Ethical Hacker IBM '''<BR><br />
<br />
'''Abstract:''' <BR><br />
<br />
A Capture the Flag tournament, also known as a CTF is a framework often found at conferences such as IRISS, OWASP, Blackhat and many more. For the last number of years as part of my PhD research I have been creating CTF frameworks that operate at local, national and international levels, some of you may have played them or at least seen them, and looking at the results.<br />
<br />
These CTF events were built using a variety of architectures, network topologies and programming languages. The challenges they presented also varied both in complexity of exploit and potential organisational damage if exploited.<br />
<br />
Today we see attack know-how and attacker tools being freely traded on the internet, enabling hackers and exposing organisations to an even greater communal risk. Arguably it can be said that every organisation no matter the size needs a business plan. If that business has an online footprint, then a part of that plan needs to focus on it's own cyber risk profile.<br />
<br />
Join us to explore how CTF applied methodologies can be used as part of business decisions around resource management, defensive technology solutions, defect management and other aspects of business activities that are associated with operating in a hostile environment such as the internet.<br />
<br><br><br><br><br><br />
<br />
''' The Encrypted Token Pattern CSRF Defence'''<BR><br />
<br />
'''Paul Mooney – Freelance, Ryanair Labs, insidethecpu.com''<BR><br />
<br />
I’m the creator of the Encrypted Token Pattern and ARMOR, its .NET implementation.<br />
I specialise in taking apart problems, designing solutions, and providing those solutions as downloadable software frameworks, available under the MIT License.<br />
I’m a Software Architect, happiest when designing solutions to problems from a conceptual point-of-view, while getting my hands dirty assembling the nuts and bolts. For that reason, I try to avoid titles; if I had to brand myself, I’m a Technology Consultant.<br />
I’m most accomplished in C# in terms of language, however I’m also very proficient in JavaScript, Java, and Google Go.<br />
I’m a software-development mentor, and enjoy guiding teams of engineers toward effective technology-driven solutions to real-world problems.<br />
<br />
<br />
'''Abstract:''' <BR><br />
<br />
The Encrypted Token Pattern is a defence mechanism against Cross Site Request Forgery (CSRF) <br />
attacks, and is an alternative to its sister-patterns; Synchroniser Token, and Double Submit Cookie. <br />
This article discusses the merits and means of implementing this defence mechanism in web-based <br />
applications. <br />
<br />
''Brief Description'' <br />
The Encrypted Token Pattern <br />
The Encrypted Token Pattern leverages a single token, as opposed to dual tokens, and offers a more <br />
narrow scope of failure than alternative CSRF protection patterns. <BR><br />
<br />
Leveraging the Encrypted Token Pattern <br />
The Advanced Resilient Mode of Recognition (ARMOR) is a C# implementation of the Encrypted <br />
Token Pattern, available on GitHub under the MIT license that provides a means of protecting <br />
ASP.NET applications from CSRF attacks, by leveraging the Encrypted Token Pattern. A Java <br />
equivalent of ARMOR is under construction and will be available soon. <BR><br />
<br />
ARMOR <br />
ARMOR is a framework composed of interconnecting components exposed through custom web- <br />
handlers. ARMOR is essentially an advanced encryption and hashing mechanism, leveraging the <br />
Rijndael encryption standard, and SHA256 hashing by default.<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
=== OWASP March Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''<br />
OWASP Dublin Chapter Event - Denim Group - Dan Cornell & John Dickson''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 26th March<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-dublin-chapter-event-denim-group-dan-cornell-john-dickson-tickets-16065539461 register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking throughout,beer and pizza thanks to Morgan Mckinley<br><br><br />
<br />
'''Managing Your Application Security Program with the ThreadFix Ecosystem'''<BR><br />
'''Dan Cornell – Denim Group - (https://www.linkedin.com/in/dancornell) '''<BR><br />
<br />
A globally recognized application security expert, Dan Cornell holds over 15 years of experience architecting, developing and securing web-based software systems. As Chief Technology Officer and Principal at Denim Group, Ltd., he leads the technology team to help Fortune 500 companies and government organizations integrate security throughout the development process. Cornell is an active member of the development community and a sought-after speaker on topics of web application security, speaking at international conferences including RSA Security Conference, OWASP AppSec USA and EU and Black Hat Arsenal.<br />
<br />
'''Abstract:''' <BR><br />
<br />
ThreadFix is an open source application vulnerability management system that helps automate many common application security tasks and integrate security and development tools. This tutorial will walk through the capabilities of the ecosystem of ThreadFix applications, showing how ThreadFix can be used to: Manage a risk-ranked application portfolio Consolidate, normalize and de-duplicate the results of DAST, SAST, IAST and other application security testing activities and track these results over time to produce trending and mean-time-to-fix reporting Convert application vulnerabilities into software defects in developer issue tracking systems Pre-seed DAST scanners such as OWASP ZAP with application attack surface data to allow for better scan coverage Instrument developer Continuous Integration (CI) systems such as Jenkins to automatically collect security test data Map the results of SAST and DAST scanning into developer IDEs The presentation walks through these scenarios and demonstrates how ThreadFix, along with other open source tools, can be used to address common problems faced by teams implementing software security programs. It will also provide insight into the ThreadFix development roadmap and upcoming enhancements.<br><br><br><br><br><br />
<br />
''' AppSec Survey 2.0: Fine-Tuning an AppSec Training Program Based on Data'''<BR><br />
<br />
'''John Dickson – Denim Group''' (https://www.linkedin.com/pub/john-b-dickson-cissp/0/149/41a)<BR><br />
<br />
John Dickson is an internationally recognized security leader, entrepreneur and Principal at Denim Group, Ltd. He has nearly 20 years hands-on experience in intrusion detection, network security and application security in the commercial, public and military sectors. As a Denim Group Principal, he helps executives and Chief Security Officers (CSO’s) of Fortune 500 companies and government organizations launch and expand their critical application security initiatives.<br />
<br />
<br />
'''Abstract:''' <BR><br />
<br />
Measuring the effectiveness of any security activity is widely discussed – security leaders debate the topic with a religious fervor rivaling that of any other hot button issue. Virtually every organization has some sort of application security training effort, but data on training effectiveness remains scarce. Last year our research team delivered the first-ever survey that captured developer awareness of secure coding concepts and the impact of formal application security training on a developer’s ability to write secure code. We learned that most software developer were aware of certain application security concepts, yet when asked how to write more secure code, they faired poorly. This year’s 600-developer survey provides more quantitative data on what software developers understand about application security, both concepts and practices. It dives most deeply into awareness of defensive coding practices, which most developers largely did not grasp in the 2013 survey. It also is separates respondents by roles, so we can better understand how architects, developers, and QA staff grasp key application security concepts and put them to work. It better captures how software developers learn in general, so one can tailor any security training effort to how software developers, in practice, actually learn. This information will provide data to application security managers responsible for corporate security training that should allow them to make more fact-based decisions about security training.<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
== OWASP Dublin Chapter 2014 ==<br />
<br />
=== OWASP December Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event – David Rook/ Mark Hillick - Riot Games''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 4th December<br><br>''' Registration: 18:30pm <br>Talks Start: 19:00pm <br> Event finishes at 21:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-chapter-meeting-riot-games-tickets-14523051839 register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking throughout,and pizza thanks to Morgan Mckinley<br><br><br />
<br />
'''Leveling up a global application security awareness program'''<BR><br />
'''David Rook - Riot Games - (http://ie.linkedin.com/pub/david-rook/3/41a/b1b) '''<BR><br />
<br />
David Rook is a Security Engineer focusing on Application Security at Riot Games in Dublin. David held various application security roles in the financial services industry since 2006 before moving into the computer games industry in early 2014. He has been a contributor to several OWASP projects including the code review guide and the Cryptographic Storage Cheat Sheet. He has presented at leading information security conferences including DEF CON, BlackHat USA and RSA Europe. In addition to his work with OWASP David created a security resource website and blog called Security Ninja.<br />
<br />
David strives to practice what he preaches and has backed up his work experience by developing two open source security code review tools called Agnitio and the Windows Phone App Analyser.<br />
<br />
'''Abstract:''' <BR><br />
<br />
The talk will focus on Riot application security awareness and knowledge sharing in a global company. I will talk about the application security awareness efforts we've implemented this year to bring application security knowledge to software engineers worldwide. These awareness efforts were designed to educate and support engineers around the world who work on high profile web properties and one of the worlds most popular computer games.<br />
<br />
I will explain how we've used a combination of traditional and innovative approaches to levelling up our software engineers security knowledge.<BR><BR><br />
<br><br><br><br><br><br />
<br />
''' Security and how it affects Users and Rioters '''<BR><br />
<br />
'''Mark Hillick Security Dude@Riot Games '''<BR><br />
<br />
Mark is a founder of HackEire, a founding member of IrissCert, the first person in Ireland to achieve the GIAC GSE, and has been stoking a passion for security for 14 years.<br />
<br />
Mark leads up the InfoSec team for Riot Games in Europe and is Product Owner of the Security Engineering vertical. Currently he's focused on building a team, engineering cool solutions, levelling the security program, finding the cloud, dealing with DDOS, and trying to earn Silver next year by himself.<br />
<br />
'''Abstract:''' <BR><br />
<br />
The presentation focuses on one of the major security aspects of Android Applications; rooting detection techniques. Many Apps, including (MDM) Mobile Device Management Agents, implements this check in different ways. The aim of the talk is to explore the effectiveness of these checks, with practical examples and explain the impact, in terms of security, of this control being bypassed or not implemented.<br />
<br />
A short demo will show the effects of having root permissions on an application when the application thinks you don't.Mark will be discussing his last 18 months at Riot and the increase in attention to security from both a player and Rioter perspective.<BR><BR><BR><br />
<br />
<br />
<br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
<br />
=== OWASP August Event===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event – Mobile Security''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Saturday 30th August<br><br>''' Registration: 09:30am <br>Talks Start: 10:00am <br> Event finishes at 6:00pm<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.com/e/owasp-mobile-security-day-30th-august-tickets-12685176705 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking throughout,and pizza thanks to BCC Risk Advisory (http://www.bccriskadvisory.com/) /edgescan (https://www.edgescan.com/)<br><br><br />
<br />
'''“Waving not Drowning” – Secure Mobile Development.'''<BR><br />
'''Eoin Keary - BCC Risk Advisory - (http://ie.linkedin.com/in/eoinkeary) '''<BR><br />
<br />
OWASP board member since 2009. Elected to position of global Vice Chair, September 2011. A long-time member of OWASP. Based in Dublin and director of BCC Risk Advisory Ltd. Eoin Keary has been with OWASP since 2004. He is based in Ireland and runs a software security practice, bccriskadvisory.com. He is currently on the global board of the OWASP foundation, he was elected to the board in 2009. During this time Eoin assisted in founding the OWASP legal entity in Europe and has helped provide structure to OWASPs finances and strategy.<BR><br />
<br />
'''Abstract:''' <BR><br />
<br />
In this talk Eoin shall discuss aspects of securing mobile apps from a source code standpoint. He shall discuss common pitfalls and associated with developing secure applications, why such issues are important and discuss “war stories” relating to real-world mobile app [in]security.<br />
<br />
This talk is suited to anyone involved in developing, managing development or testing mobile applications for security and robustness.<br />
<BR><BR><br />
<br />
''' Android rooting detection: how and why? '''<BR><br />
<br />
'''Giuliano Fasto – Espion – (http://uk.linkedin.com/in/giulianofasto) '''<BR><br />
<br />
Giuliano Fasto is a Security Consultant with more than six years of experience in the IT Security field. He has worked as a Security Consultant and Penetration Tester for well-respected security companies in Italy, the UK and Ireland. His academic background includes a BSc in IT Security and an MSc in Information Security and Audit. While he has a wide-ranging experience in penetration testing various systems and technologies, in recent years he has specialised in mobile application security testing, particularly on Android and iOS platforms. He is currently the lead mobile application tester at Espion.<br />
<br />
'''Abstract:''' <BR><br />
<br />
The presentation focuses on one of the major security aspects of Android Applications; rooting detection techniques. Many Apps, including (MDM) Mobile Device Management Agents, implements this check in different ways. The aim of the talk is to explore the effectiveness of these checks, with practical examples and explain the impact, in terms of security, of this control being bypassed or not implemented.<br />
<br />
A short demo will show the effects of having root permissions on an application when the application thinks you don't.<BR><BR><BR><br />
<br />
''' Bazuc - A talk about new types of attacks and vulnerabilities being exploited '''<BR><br />
<br />
'''Cathal McDaid – AdaptiveMobile - (http://ie.linkedin.com/pub/cathal-mc-daid/3/5b2/b77) '''<BR><br />
<br />
Cathal Mc Daid is Head of Data intelligence & Analytics in Adaptivemobile, and is responsible for a team dedicated to analysing and uncovering new threats to mobile operators and subscribers, using advanced ‘big data’ techniques. Cathal has 14 years experience in telecoms and wireless. Currently he is also Chairman of the GSMA’s Mobile Malware Group - who coordinates the world's response to mobile malware. His academic background includes a BEng in Computer Engineering from UL and an Executive MBA from INSEAD.<br />
<br />
'''Abstract:''' <BR><br />
<br />
Recent discussions and news about mobile malware primarily talk about new types of attacks and vulnerabilities being exploited. However what do you do when a user knowingly infects his handset for monetary gain?. In this presentation we will discuss a new type of mobile bad-ware, that promised and delivered the user money, in exchange for the renting out of his mobile device for unknown purposes. We discuss the app profile, tactics and impacts - on the users, on the network and on the stock market. <BR><BR><br />
<br />
<br />
<br />
''' OWASP Security Shepherd project '''<BR><br />
<br />
'''Mark denihan & Sean Duggan IBM (http://ie.linkedin.com/in/markdenihan , http://ie.linkedin.com/in/seankduggan ) '''<BR><br />
<br />
Mark is currently working on the IBM Ethical Hacking Team, the OWASP Dublin Board and founded of the OWASP Security Shepherd Project. He got his MSc in Information Security and Digital Forensics in the ITB and a BSc in Computing in the DIT. He also suffers from a love of caffeine and deep paranoia thanks to his extreme security enthusiasm.<br />
<br />
Sean has a BSc Computing from Dublin Institute of Technology, currently working in IBM with a passion for Android App Security and Development. He developed an interest in Mobile Application Security after reading about the OWASP Mobile Top Ten Risks in 2012 and has since been keeping up to date with Mobile App Issues. Sean leads the development of the mobile components in the OWASP Security Shepherd project.<br />
<br />
'''Abstract:''' <BR><br />
<br />
The OWASP Security Shepherd project has been designed and implemented with the aim of fostering and improving security awareness among a varied skill¬set demographic.<br />
<br />
Security Shepherd covers the OWASP Top Ten web app risks and has recently been injected with totally new content to cover the OWASP Top Ten Mobile risks as well. Many of these levels include insufficient mitigations and protections to these risks, such as blacklist filters, atrocious encoding schemes, barbaric security mechanisms and poor security configuration. <br />
<br />
The modules have been crafted to provide not only a challenge for a security novice, but security professionals as well. We're going to speak about the platform itself and what it offers someone wishing to teach or learn about mobile and web application security, such as the project’s anti plagiarism mechanisms or it’s flexible approach in presenting its users with lessons and resources.<BR><BR><BR><br />
<br />
<br />
''' CTF'''<BR><br />
<br />
CTF Using the above OWASP Security Shepherd project. <BR><br />
<BR><br />
''Please bring a laptop with Zed Attack Proxy/ Burp installed''<br />
<br />
<br />
<br />
'''Format for the day will be '''<BR><br />
<br />
9:30-10.00 -- Registration/ Networking<BR><br />
10:00-11:00 -- Speaker 1 50-55mins Talk<BR> <br />
11:00-12:00 --Speaker 2 50-55mins Talk <BR><br />
12:00-1:00 -- Speaker 3 50-55mins Talk <BR><br />
1:00-1:50 --Lunch <BR><br />
2:00-6:00 -- Mobile Shepherd talk leading into CTF. '''Please bring a laptop with Zed Attack Proxy/ Burp installed''' <BR><br />
<BR><br />
Any questions please contact me on '''owen.pendlebury(at)owasp.org'''<br />
<BR><br />
-- <br />
Owen Pendlebury<BR><br />
OWASP Ireland-Dublin Chapter Lead<BR><br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP May Event (2)===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event - Matt Johansen Sr. Manager for the Threat Research Center at WhiteHat Security''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 22nd May<br><br>''' Registration: 18:30 <br>Talk: 19:00<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: Morgan McKinley Dublin office <br><br />
Venue Address: Morgan McKinley, Connaught House, No.1 Burlington Road, Dublin 4 (off the canal, across from the Mespil Hotel. On the second floor.)'''<br><br />
Venue Map: [https://www.google.ie/maps/place/Connaught+House/@53.332691,-6.2473347,17z/data=!3m1!4b1!4m2!3m1!1s0x48670ebdacbb7d5f:0x5c32fa5458ed31b9 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.ie/e/owasp-chapter-meeting-may-tickets-11644682559 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking afterwards, with beer and pizza thanks to WhiteHat Security - https://www.whitehatsec.com/ <br><br />
<br />
'''*"Top 10 Web Hacks of 2013"*'''<br />
<br />
'''Matt Johansen Sr. Manager for the Threat Research Center at WhiteHat Security'''<br />
<br />
Matt Johansen is a Sr. Manager for the Threat Research Center at WhiteHat Security where he manages a team of Application Security Specialists, Engineers and Supervisors to prevent website security attacks and protect companies' and their customers' data. Before this he was an Application Security Engineer where he oversaw and assessed more than 35,000 web applications that WhiteHat has under contract for many Fortune 500 companies across a range of technologies.<br />
<br />
He was previously a security consultant for VerSprite, where he was responsible for performing network and web application penetration tests. Mr. Johansen is also an instructor of Web Application Security at Adelphi University, where he received his Bachelor of Science in Computer Science, and San Jose State University. He has also been utilized by the SANS Institute as an industry expert for certification review.<br />
<br />
List of past talks including videos/slides - http://mattjay.github.io/talks/ (BlackHat, DEFCON, RSA, SXSW, Many BSides, etc.<br />
<br />
Abstract:<br />
<br />
Every year the security community produces a stunning number of new Web hacking techniques that are published in various white papers, blog posts, magazine articles, mailing list emails, conference presentations, etc. Within the thousands of pages are the latest ways to attack websites, Web browsers, Web proxies, and their mobile platform equivalents. Beyond individual vulnerabilities with CVE numbers or system compromises, we are solely focused on new and creative methods of Web-based attack. Now in its eighth year, the Top 10 Web Hacking Techniques list encourages information sharing, provides a centralized knowledge base, and recognizes researchers who contribute excellent work.<br />
<br />
In this talk, We will do a technical deep dive and take you through the Top 10 Web Hacks of 2013 as picked by an expert panel of judges.<br />
<br />
This year’s winners are:<br />
<br />
1 - Mario Heiderich – Mutation XSS<br><br />
2 - Angelo Prado, Neal Harris, Yoel Gluck – BREACH<br><br />
3 - Pixel Perfect Timing Attacks with HTML5<br><br />
4 - Lucky 13 Attack<br><br />
5 - Weaknesses in RC4<br><br />
6 - Timur Yunusov and Alexey Osipov – XML Out of Band Data Retrieval<br><br />
7 - Million Browser Botnet<br><br />
8 - Large Scale Detection of DOM based XSS<br><br />
9 - Tor Hidden-Service Passive De-Cloaking<br><br />
10 - HTML5 Hard Disk Filler™ API<br><br />
<br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP May Event (1)===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event - Eoin Kearyof BCC Risk Advisory and Matej Saksida of Realex''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 1st May<br><br>''' Registration: 18:30 <br>Talk: 19:00<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: TCube<br><br />
Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland'''<br><br />
Venue Map: [https://maps.google.ie/maps?q=32+-+34+Castle+Street,+Dublin+2,+Ireland&hl=en&ll=53.343391,-6.269084&spn=0.004977,0.013679&sll=53.343392,-6.269086&sspn=0.009954,0.027359&hnear=34+Castle+St,+Dublin+2,+County+Dublin&t=m&z=17 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.ie/e/owasp-chapter-meeting-may-tickets-11354041243 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking afterwards, with beer and pizza thanks to BCC Risk Advisory (http://www.bccriskadvisory.com/) <br><br />
<br />
'''Talk 1: *"Top 10 defensive Java developer controls"*'''<br />
<br />
'''Eoin Keary - BCC Risk Advisory - (http://ie.linkedin.com/in/eoinkeary)'''<br />
<br />
OWASP board member since 2009. Elected to position of global Vice Chair, September 2011. A long time member of OWASP. Based in Dublin and director of BCC Risk Advisory Ltd.<br />
Eoin Keary has been with OWASP since 2004. He is based in Ireland and runs a software security practice, bccriskadvisory.com. He is currently on the global board of the OWASP foundation, he was elected to the board in 2009. During this time Eoin assisted in founding the OWASP legal entity in Europe and has helped provide structure to OWASPs finances and strategy. <br />
<br />
Abstract:<br />
<br />
In this talk Eoin shall go through a list of developer controls in order to help prevent common security vulnerabilities such those focused in the<br />
OWASP Top 10 2013. From input validation to contextual output encoding to crypto-secure storage, Eoin shall call out what developers can do to help<br />
mitigate such issues. Many of the mitigations are simple and use established API's such that developer need not be security experts and just<br />
use core components to help improve their security posture.<br />
<br />
<br />
<br />
<br />
<br />
'''Talk 2: *"Social Engineering - The Art of Human Hacking".*'''<br />
<br />
'''Matej Saksida - Realex Payments - (http://ie.linkedin.com/pub/matej-saksida-cism/20/412/176)'''<br />
<br />
Abstract:<br />
<br />
Nowadays if you want to hack a corporation or damage a personal "enemy" fast, Social Engineering techniques work every time and more often than not<br />
it works the first time. In this talk Matej shall go through what is social engineering is, types of social engineering and related threats.<br />
Matej shall call out practical example how to use Facebook to ruin someone's life and what countermeasures can be used against social engineering attacks.<br />
<br />
<br />
<br />
|-<br />
|}<br />
<br />
=== OWASP March Event ===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event - Rahim Jina of BCC Risk Advisory and Stephen Scott of Espion''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 13th March<br><br>''' Registration: 18:30 <br>Talk: 19:00<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: TCube<br><br />
Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland'''<br><br />
Venue Map: [https://maps.google.ie/maps?q=32+-+34+Castle+Street,+Dublin+2,+Ireland&hl=en&ll=53.343391,-6.269084&spn=0.004977,0.013679&sll=53.343392,-6.269086&sspn=0.009954,0.027359&hnear=34+Castle+St,+Dublin+2,+County+Dublin&t=m&z=17 Google Maps] <br><br />
''(Registration. [https://www.eventbrite.ie/e/owasp-chapter-meeting-tickets-10802455435 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | There will be networking afterwards, with beer and pizza thanks to Espion (http://www.espiongroup.com/)<br />
<br />
Talk 1: Building a shield of security - Vulnerability Management by the numbers and dumb robots!<br />
<br />
Rahim Jina - BCC Risk Advisory<br />
<br />
Rahim has been an active member of OWASP since 2008 and has contributed to many projects such as the OWASP Security Code Review Guide and is an ex-board member of the Irish Chapter. Previously Rahim was a senior security consultant at a “big 4” professional services firm and more recently, the head of security for Fonality Inc, a VoIP service provider based in Los Angeles. Rahim is currently a director for BCC Risk Advisory (bccriskadvisory.com), based in Dublin, Ireland. He is also responsible for the security architecture of the edgescan.comvulnerability management solution.<br />
<br />
Abstract: <br />
<br />
This presentation discusses how builders, breakers and defenders should look at vulnerability management when attempting to keep hackers at bay. We discuss the most common vulnerabilities which are not detected by security tools nor automation but nevertheless are common and can be used to commit real fraud resulting in financial loss. We will see that Web Application Firewalls are ineffective against such attacks and why the only practical solution is to apply a layered approach across all aspects of the SDLC.<br />
<br />
<br />
<br />
Talk 2: "PCI's Changing Environment - What You Need to Know & Why You Need To Know It".<br />
<br />
Stephen Scott - Senior Consultant and PCI QSA in Espion's Information Government practice<br />
<br />
Stephen Scott, Consultancy Team lead in Espion, is an experienced information security, risk and compliance consultant whose experience spans across many different areas including, PCI DSS, information security, risk management, group internal audit, IT service management and regulatory compliance. Stephen has extensive experience with information security, internal control testing, compliance programmes, information risk management, and process improvement. Stephen has worked across a wide range of industry verticals, including financial, industrial and insurance.<br />
<br />
Abstract:<br />
<br />
PCI DSS – The Payment Card Industry Data Security Standard sets common requirements for securing payment card information (credit, debit, some gift cards), and lays out a range of controls relating to auditing, scanning and assessment.<br />
<br />
This presentation discusses the ever evolving PCI environment, specifically focusing on the changes in the recent release of version 3 of the PCI DSS standard. Stephen will start off by giving a brief background to PCI, including motivators for merchant and service providers to adhere to the standard. In addition to this, the presentation will highlight what security considerations are relevant to application and information security practitioners.<br />
<br />
<br />
<br />
<br />
|-<br />
|}<br />
<br />
<br />
== OWASP Ireland 2013 Agenda ==<br />
<br />
=== OWASP July Event ===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''Chapter Event - Jeremiah Grossman - Another Year in Web Security''' <br />
|-<br />
|-<br />
|-<br />
| style="width:20%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''When''' <br />
| style="width:80%" valign="middle" bgcolor="#CCCCEE" align="center" colspan="0" | '''Where'''<br />
|-<br />
|-<br />
| valign="middle" bgcolor="#EEEEEE" align="center" | ''' Thursday 4th July<br><br>''' Registration: 17:30 <br>Talk: 18:00<br />
| valign="middle" bgcolor="#EEEEEE" align="left" | '''Venue Location: TCube<br><br />
Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland'''<br><br />
Venue Map: [https://maps.google.ie/maps?q=32+-+34+Castle+Street,+Dublin+2,+Ireland&hl=en&ll=53.343391,-6.269084&spn=0.004977,0.013679&sll=53.343392,-6.269086&sspn=0.009954,0.027359&hnear=34+Castle+St,+Dublin+2,+County+Dublin&t=m&z=17 Google Maps] <br><br />
''(Registration. [http://www.eventbrite.com/event/7127672059 Register here])''<br />
|-<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | Jeremiah Grossman of WhiteHat Security will be in Dublin and will be talking at our next chapter event. His talk "Another Year In Web Security: What did 2012 teach us about survival in the coming years?" promises a great insight into the future of web security.<br />
<br />
Jeremiah Grossman, founder and CTO of WhiteHat Security, is a world-renowned expert in web application security and a founding member of the Web Application Security Consortium (WASC). At WhiteHat, Mr. Grossman is responsible for web application security R&D and industry evangelism. He is a frequent speaker at industry events including the BlackHat Briefings, ISACA's Networks Security Conference, NASA, ISSA and Defcon. <br />
<br />
A trusted media resource, Mr. Grossman has been featured in USA Today, the Washington Post, Information Week, NBC Nightly News, and many others. Mr. Grossman is also a featured expert and frequent contributor on TechTarget'sSearchAppSecurity.com.<br />
|-<br />
|}<br />
<br />
=== OWASP June Event ===<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''CONFERENCE AND TRAINING''' <br />
|-<br />
| align="center" style="background:#EEEEEE;" colspan="2" | <br />
== '''OWASP Europe Tour - Dublin 2013''' == <br />
'''Tuesday 25th June''' ''(Training. [https://www.owasp.org/index.php/EUTour2013#Training Info about the training session])'' <br>'''Wednesday 26th June''' ''(Conference. [https://www.owasp.org/index.php/EUTour2013#Dublin Info and registration link for the conference])''<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | '''OWASP Europe TOUR,''' is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.<br />
<br />
*Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle.<br />
<br />
* This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.<br />
|-<br />
|}<br />
<br />
=== OWASP May Event ===<br />
<br />
{|style="vertical-align:top;width:90%;background-color:#white;padding:10px;border:1px solid silver;" align="center" cellspacing="5"<br />
|-<br />
| align="center" height="30" style="background:#CCCCEE;" colspan="2" | '''TRAINING & TALKS''' <br />
|-<br />
| align="center" style="background:#EEEEEE;" colspan="2" | <br />
== '''OWASP Dublin - Realex Payments Application Security Workshop''' == <br />
'''Thursday 30th May'''<br> ''('''Training'''. 1:30pm- 5:00pm)'' <br>('''Talks'''. 6:00pm - 8:00pm)''<br>[http://www.eventbrite.com/event/6665658163/eorg Click here for more information]<br />
|-<br />
| valign="center" bgcolor="#CCCCEE" align="center" colspan="2" | '''DESCRIPTION'''<br />
|-<br />
| valign="left" height="80" bgcolor="#EEEEEE" align="left" colspan="2" | '''Training'''<br />
<br />
Eoin Keary will be delivering free application security training between 2pm and 5pm on the 30th May. Eoin was the founder of OWASP Ireland and is currently the global vice chair for OWASP (amongst many other things! https://www.owasp.org/index.php/Eoin_Keary). He has delivered application security training to many developers and security professionals around the world and recently delivered a training course to over 400 people at the RSA Conference.<br />
<br />
The training will focus on secure application development and why we can't hack ourselves secure. It will be covering why penetration testing on its own does not work approaches to improvement including "knowing what you don't know" and how to measure change.<br />
<br />
It will be technical training covering XSS eradication, client side security and browser DOM curiosities.<br />
<br />
'''Talks'''<br />
<br />
The talks will be starting at 6pm in our office and OWASP have arranged two very interesting talks! Diarmaid McManus https://twitter.com/elephant_rb from Realex Payments will be expanding his award winning SecurityBSides London Rookie Track talk https://www.securityninja.co.uk/application-security/securitybsides-london-esp-security-plugin/ to include more details about static analysis approaches and his research and development work on ESP: Security Plugin https://github.com/diarmaid-mcmanus/ESPSecurityPlugin.<br />
<br />
Hugh Pearse https://twitter.com/hughpearse will be talking about Low Level Exploits and this looks like it will be a great talk:<br />
<br />
“In 2010 Mr Haroon Meer from thinkst.com presented a timeline of memory corruption vulnerabilities and their mitigation techniques dating from 1985 to 2010. In his 35 page publication he referenced almost 150 events in low level information security history. The scope of the presentation "Low Level Exploits" is to explain in detail some of the most significant attacks in from Haroon Meers research. The attacks covered in this presentation include buffer overflows on the stack, heap overflows, integer overflows, format strings, null pointers and ROP chains. This brings us to exploits in the present day where researchers are looking for the successor of the buffer overflow attack, next big exploit.”<br />
|-<br />
|}<br />
<br />
<br />
<br />
== OWASP Ireland 2011 Agenda ==<br />
<br />
=== [[Ireland/Training/OWASP projects and resources you can use TODAY]] ===<br />
<br />
[[Image:Owasp logo Ireland Training 11 March 2010.gif]]<br />
<br />
*'''Overview & Goal'''<br />
**Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. <br />
**This course aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them. <br />
**The course will be very practical where demonstration and hands-on exercises will be provided for the tools covered. <br />
**If you are interested in participating in the hands on portion of the course, please bring a laptop. <br />
*'''Dates'''<br />
**March, 2011, 11<br />
*'''Course Main Content and Registration'''<br />
**[[Ireland/Training/OWASP projects and resources you can use TODAY|Click here]]<br />
<br />
== OWASP Ireland 2010 ==<br />
<br />
[[Image:Dublin2010.gif]]<br />
<br />
Click [[OWASP IRELAND 2010]] for more information <br><br><br />
<br />
== OWASP Ireland 2010 Agenda ==<br />
<br />
<br><br />
<br />
==== AUG 2010 ====<br />
== OWASP August Event ==<br />
<br />
'''When:''' 11/8/2010 6:00pm - 8:00pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br />
<br><br />
'''Title:''' OWASP ESAPI Swingset: Introduction & Demo by Cathal Courtney<br />
<br><br />
'''Abstract:''' The ESAPI Swingset is a web application which demonstrates common security vulnerabilities and asks users to secure the application against these vulnerabilities using the ESAPI library. The application is intended for Java Developers. The goal of the application is to teach developers about the functionality of the ESAPI library and give users a practical understanding of how it can be used to protect web applications against common security vulnerabilities. During the talk, Cathal will demonstrate how to install and use ESAPI Swingset in your organization. A copy of the latest version will be also provided to the attendees.<br />
<br><br />
'''Presenter:''' Cathal is an experienced developer working at AIB and is currently the ESAPI Swingset project leader. More information about this project could be found here: [http://www.owasp.org/index.php/ESAPI_Swingset Esapi SwingSet]<br />
<br><br />
'''Download Presentation:''' Not available<br />
<br><br><br />
'''Title:''' Security Implications for Web Applications based on SOA by John Marmelstein<br />
<br><br />
'''Abstract:''' The main point of SOA (in this context) is combining systems and applications to make new applications, or a big 'overall' application.This higher inter-operability does (by default) lower security. For a start, a request originating from a web user might end up at several back end systems, which do not know who or what the request came from.<br />
<br><br />
Each back end system might have no access to the customer data, have a different security models, and serve serveral front end. Each of the above systems could be under different ownership, thus the owners have different concerns and priorities. Also, the basic solution at a technical level include single sign on, or security as a service. This can be costly, give limited coverage and have a performance hit. But is pretty much the only way to do it. The other thing to do (probably in tandem) is strict management, and delegation of authority.<br />
<br><br />
'''Presenter:''' John has about 13 years in IT. Most of this in distributed systems and 'Middleware' integration software. Including BEA (now owned by Oracle). Mainly working on Enterprise Java and more recently on Microsoft BizTalk. Various industries, incuding financials, public services, and a fish farm.<br />
<br><br />
'''Download Presentation:''' <br />
<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== SEP 2010 ====<br />
<br />
== APPSEC IRELAND 2010 ==<br />
<br />
Due to popular demand we are hosting the 2nd OWASP IRELAND event, '''OWASP Ireland 2010'''. <br>Continuing last years highly successful conference, with more than 150 attendees from across the globe OWASP is happy to repeat this positive experience. <br>Delegates from numerous industry verticals attended the 2009 event; from government to finance to telecoms. Share your thoughts at this open event with some of the most experienced individuals in the information security industry. <br />
<br />
[http://www.owasp.org/index.php/OWASP_IRELAND_2010 [[Image:Dublin2010.gif]]]<br>[[OWASP_IRELAND_2010]]<br><br />
<br />
'''When:''' '''September 17th 2010'''<br><br />
<br />
'''Where:''' Trinity College Dublin, The Hamilton Building <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [[Eoin Keary|Eoin Keary]]. <br><br />
<br />
'''Subscribe to the OWASP Ireland [https://lists.owasp.org/mailman/listinfo/owasp-ireland mail list] for the up-to-date information.''' <br />
<br />
<br><br />
<br />
==== OCT 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== NOV 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== DEC 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
<br><br />
<br />
==== 2010 Chapter Plan ====<br />
<br />
'''Special Project:'''Educational Outreach<br>Summary: Drive education awareness of OWASP among Irish Universities and Third Level Institutions. <br>Plan: &lt;insert plan&gt; <br>Next Milestone: Update the plan<br>Participants: Fabio Cerullo <br><br><br />
<br />
'''Special Project:'''Industry Outreach<br>Summary: Raise awareness of OWASP among Irish industry.<br>Plan: &lt;insert plan&gt; <br>Next Milestone: Update the plan<br>Participants: Eoin Keary<br><br><br />
<br />
'''Special Project:'''Membership Drive <br>Summary: Increase local chapter members individuals and corporate supporters <br>Plan: &lt;insert&gt; <br>Next Milestone: Update the plan<br>Project Participants: Rahim Jina<br><br><br />
<br />
'''Special Project:'''Hands-On Training<br>Summary: Provide 1-day, 3-day and 5-day hands-on classroom / online training classes<br>Next Milestone: Organize Training Offerings<br>Project Participants: Fabio Cerullo<br><br><br />
<br />
<br>Call For Presentations for 2010 is now open - please contact fcerullo(@)owasp.org / +353877817468 if you would like to speak or can host a meeting. <br><br>*Note meeting hosts are provided with annual chapter sponsorship and free seats in training classes. The OWASP Foundation, Ireland chapter focuses on implementation of efforts defined by the [http://www.owasp.org/index.php/Global_Committee_Pages Global Committee] as well as new concepts and ideas defined locally. Below are a list of ACTIVE projects assigned to individual active members and teams within the local chapter. If you would like to help out on ANY of these efforts, contact them directly to get involved <br />
<br />
==== FEB 2010 ====<br />
<br />
== OWASP Ireland Event - What is the O2 Platform? ==<br />
<br />
'''When:''' 19/2/2010 3:00pm - 5:00pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br><br />
<br />
'''Title:''' OWASP O2 Platform - Open Platform for automating application security knowledge and workflows <br>'''Abstract:''' In this talk Dinis Cruz will show the OWASP O2 Platform which is an open source toolkit specifically designed for developers and security consultants to be able to perform quick, effective and thorough 'source-code-driven' application security reviews. The OWASP O2 Platform (http://www.owasp.org/index.php/OWASP_O2_Platform) consumes results from the scanning engines from Ounce Labs, Microsoft's CAT.NET tool, FindBugs, CodeCrawler and AppScan DE, and also provides limited support for Fortify and OWASP WebScarab dumps. In the past, there has been a very healthy skepticism on the usability of Source Code analysis engines to find commonly found vulnerablities in real world applications. This presentation will show that with some creative and powerful tools, it IS possible to use O2 to discover those issues. This presentation will also show O2's advanced support for Struts and Spring MVC. <br />
<br />
'''Presenter:''' Dinis Cruz is a Security Consultant based in London (UK) and specialized in: ASP.NET/J2EE Application Security, Application Security audits and .NET Security Curriculum Development. For the past years Dinis has focused on the field of Static Source Code analysis, from May 2007 to Dec 2009 he worked as a independent consultant for Ounce Labs (bought by IBM in July 2009) where during active security engagements using Ounce's technology he developed the Open Source codebase which now is the foundation of the OWASP O2 Platform. Dinis is currently focused on making the O2 Platform the industry standard for consuming, instrumenting and data-sharing between the multiple WebAppSec tools, the Security consultants and the final developers. Dinis is a also active trainer on .Net security having written and delivered courses for IOActive, Foundstone, Intense School and KPMG (at multiple locations including BlackHat), and has delivered a number of presentations and keynote speeches at multiple OWASP and Security related conferences. At OWASP, Dinis is the leader of the [[OWASP O2 Platform]] project, member of the OWASP [[Global Projects Committee]], chair of the [[OWASP Connections Committee]] and member of the [[About The Open Web Application Security Project#Global_Board_Members|OWASP Board]]. <br />
<br />
'''Download Presentation:''' http://www.o2-ounceopen.com/files-binaries-source-and-demo/old-documents-and-presentations/OWASP_O2_Platform_-_AppSec_Ireland_Sep_2009.pdf <br />
<br />
== IISF/OWASP – February Chapter Meeting ==<br />
<br />
'''When:''' 25/2/2010 2:00pm - 4:00pm <br><br />
<br />
'''Where:''' Georgian Suite, Buswells Hotel, Molesworth St., Dublin 2 <br />
<br />
'''Title:''' An overview of Web Application Security threats and technologies. Practical advice and techniques for improving Application Security, presented by OWASP. <br />
<br />
2:00 - Introduction by IISF Chairman <br />
<br />
2:05 - Presentation&nbsp;: “Practical advice for improving Application Security” - Introduction to OWASP and OWASP Top Ten - Demonstration video of typical web based attacks with high level explanation - Live SQL injection demo using WebGoat &amp; WebScarab - Live Cross Site Scripting demo using WebGoat &amp; WebScarab <br />
<br />
'''Download Presentation:''' [[Image:IISF 250210 part1.ppt]] <br />
<br />
3:00 - Coffee <br />
<br />
3:20 – Presentation continues - Application Security: "The problems we are faced with" - The Application Security Verification Standard - SDLC &amp; Security Assurance Maturity Model - Code Review versus traditional Runtime Testing. - Q&amp;A <br />
<br />
'''Download Presentation:''' [[Image:IISF 250210 part2.pptx]] <br />
<br />
4:00 - Close of Meeting <br />
<br />
4:05 - Traditional networking in Buswells Bar <br />
<br />
<br><br />
<br />
==== MAR 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP - 26/3/2010 ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== APR 2010 ====<br />
<br />
== OWASP Live CD - An open environment for Web Application Security ==<br />
<br />
'''When:''' 16/4/2010 2:30pm - 5:00pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br><br />
<br />
'''Title:''' OWASP Live CD - An open environment for Web Application Security <br>'''Abstract:''' This CD collects some of the best open source security projects in a single environment. Web developers, testers and security professionals can boot from this Live CD and have access to a full security testing suite. This presentation aims to provide a showcase for the great OWASP tools and documentation materials available in the CD, tips and tricks, and also some introductory stuff regarding code review and penetration testing. <br>Training is aimed at introductory /intermediate level in terms of pen testing, code review and tools. <br />
<br />
'''Presenters:''' <br />
<br />
'''Rahim Jina''' <br>Rahim Jina currently works as a senior consultant for Ernst &amp; Young's Risk Advisory Services in Dublin. He has worked there for nearly four years primarily delivering penetration testing services to clients globally, focusing on web applications and secure code review. He has been involved with OWASP for the past two years, being involved in the Summer of Code 2008 as lead reviewer for the Code Review Guide 2009. He has also made contributions to the SAMM project (OpenSAMM). He holds an MSC in Security and Forensic Computing from DCU and a degree in computer science from Trinity college. <br>'''Eoin Keary''' <br>Eoin is a long time member of OWASP and have contributed year on year to OWASP projects and the OWASP mission of fighting the causes of software insecurity. He is based in Dublin, Ireland and run the Ernst &amp; Young application security team across Europe. His OWASP contributions to date include the OWASP Code Review Guide, OWASP Testing Guide, OWASP SAMM, and OWASP ASVS. He is a member of the OWASP Global Industry Committee, chair of the OWASP Conferences Committee and member of the OWASP Global Board. Eoin founded the OWASP Ireland chapter back in 2004 and currently serves as Vice President of the OWASP Ireland Board. <br />
<br />
'''Pictures from the event:''' <br />
<center><br />
{| class="FCK__ShowTableBorders"<br />
|-<br />
| <br />
[http://www.owasp.org/images/d/db/P1040923_1024.JPG [[Image:|P1040923_small.jpg]]]<br>[http://www.owasp.org/images/d/db/P1040923_1024.JPG zoom]<br />
<br />
| <br />
[http://www.owasp.org/images/f/f3/P1040927_1024.JPG [[Image:|P1040927_small.jpg]]]<br>[http://www.owasp.org/images/f/f3/P1040927_1024.JPG zoom]<br />
<br />
| <br />
[http://www.owasp.org/images/6/64/P1040929_1024.JPG [[Image:|P1040929_small.jpg]]]<br>[http://www.owasp.org/images/6/64/P1040929_1024.JPG zoom]<br />
<br />
|}<br />
</center><br />
'''Download Presentation:''' [http://www.owasp.org/images/e/ee/OWASP_Live_CD.pptx [[Image:|Download.png]]] <br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''Where:''' Odeon Pub <br><br />
<br />
'''When:''' After OWASP Live CD training <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== MAY 2010 ====<br />
<br />
== OWASP Event: Trials &amp; Tribulations of WAF Implementation ==<br />
<br />
'''When:''' 20/5/2010 6:30pm - 7:30pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br><br />
<br />
'''Title:''' Trials &amp; Tribulations of WAF Implementation<br>'''Abstract:''' A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-site Scripting (XSS) and SQL Injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.<br>Mark will be presenting on his experience in implementing a Web Application Firewall solution through all phases from research to implementation. <br />
<br />
'''Presenters:''' <br />
<br />
'''Mark Hillick - Application Networking Team, Citrix Systems''' <br>Mark Hillick has 10 years experience in relation to Internet, networking, systems administration and security engineering. <br />
<br />
Mark graduated from Queen's University, where he studied Mathematics. <br />
<br />
Mark joined AIB from Queen's where he joined the Internet Infrastructure team, where he was responsible for designing, building and securing the Internet service in and out of AIB. He is a prominent member of the IT Security community in Ireland and has presented at several local security forums such as IISF and Owasp. Mark is one of the founding members of IRISS CERT, where he is also a Volunteer Incident Handler. He helped organise IRISSCon 2009, where he also designed and built HackEire 2009, the first Ethical Hacking 'Capture The Flag' contest in Ireland.<br><br />
<br />
'''Pictures from the event:''' <br />
<br />
{| class="FCK__ShowTableBorders"<br />
|-<br />
| <br />
[[Image:20052010017.jpg|thumb|A caption from Mark's talk]]<br />
<br />
|}<br />
<br />
<br><br />
<br />
'''Download Presentation:''' [http://docs.google.com/fileview?id=0B3vrVYEosFeEZDMyZjIzYTktMzNkZC00ZjBlLWFiYTgtNThjZGE4YTE1NmFj [[Image:|Download.png]]] <br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''Where:''' Odeon Pub <br><br />
<br />
'''When:''' After WAF presentation <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
<br><br />
<br />
==== JUN 2010 ====<br />
<br />
== OWASP Event: Define Security Requirements - A practical approach ==<br />
<br />
'''When:''' 20/5/2010 6:30pm - 7:30pm <br><br />
<br />
'''Where:''' Ernst &amp; Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland <br />
<br />
'''Sponsors:''' [[Image:Ey logo.gif]]<br><br />
<br />
'''Title:''' Define Security Requirements - A practical approach<br>'''Abstract:''' The Data Protection Act states that "appropriate security measures" must be taken to protect personal data. How do you specify the appropriate security measures for a website which processes personal data? It is an important step in a development project, but is often neglected. In this talk, Alexis will descibe his own experiences of assessing web application, and will also look in more detail at what the Data Protection Commissioner says. He will then take a fictional website and look at a practical approach to specifying the security requirements that the fictional application should meet. This will use the kind of risk-based techniques outlined by OWASP or the Microsoft Secure Development Lifecycle (SDL). Issues discussed will include encryption, authentication, access control, audit, etc. The result will be a list of security requirements that can be carried into the design and development phases. Attendees should be able to apply the ideas to their own development projects. <br />
<br />
'''Presenters:''' <br />
<br />
'''Alexis Fitzgerald - Rits Information Security Group''' <br>For the last six years Alexis has worked for Rits Information Security Group, where he performs application penetration testing assignments as well as advising clients on application security issues. Before that, he spent many years as a developer (mainly in the financial sector), and he continues to be involved in development. Alexis holds an MSc in Information Security from the University of London, Royal Holloway.<br><br />
<br />
'''Pictures from the event:''' <br />
<br />
{| class="FCK__ShowTableBorders"<br />
|-<br />
| <br />
|}<br />
<br />
<br><br />
<br />
'''Download Presentation:''' [[Image:OWASP Ireland June10.pdf]] <br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' After Alexis presentation <br><br />
<br />
'''Where:''' Odeon Pub <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
==== JUL 2010 ====<br />
<br />
== APPSEC IRELAND INFORMAL MEET-UP ==<br />
<br />
This is a informal gathering to meet others in information security and have a pint&nbsp;;) all are welcome <br><br />
<br />
'''When:''' TBD <br><br />
<br />
'''Where:''' TBD <br><br />
<br />
'''Sponsors:''' In case you want to sponsor this event, please contact [mailto:fcerullo(at)owasp.org Fabio Cerullo]. <br><br />
<br />
<br />
<br><br />
<br />
<br><br />
<br />
__NOTOC__ <headertabs /><br />
<br />
[[Category:Ireland]]</div>Owen Pendleburyhttps://wiki.owasp.org/index.php?title=File:OWASP_INtro_to_GDPR_1603.ppt&diff=212268File:OWASP INtro to GDPR 1603.ppt2016-04-01T12:16:33Z<p>Owen Pendlebury: Hugh Jones - OWASP Dublin Chapter Meeting</p>
<hr />
<div>Hugh Jones - OWASP Dublin Chapter Meeting</div>Owen Pendlebury