https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Ron+PerrisOWASP - User contributions [en]2026-05-05T19:20:40ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=JSON_Web_Token_(JWT)_Cheat_Sheet_for_Java&diff=240111JSON Web Token (JWT) Cheat Sheet for Java2018-04-20T17:55:46Z<p>Ron Perris: </p>
<hr />
<div>__NOTOC__<br />
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div><br />
<br />
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-<br />
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |<br />
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''<br />
= Introduction =<br />
__TOC__{{TOC hidden}}<br />
<br />
Many applications use '''JSON Web Tokens''' (JWT) to allow the client to indicate its identity for further exchange after authentication.<br />
<br />
From ''https://jwt.io/introduction'':<br />
<br />
''JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA.''<br />
<br />
JSON Web Token is used to carry information related to the identity and characteristics (claims) of a client. This "container" is signed by the server in order to avoid that a client tamper it in order to change, for example, the identity or any characteristics (example: change the role from simple user to admin or change the client login).<br />
<br />
This token is created during authentication (is provided in case of successful authentication) and is verified by the server before any processing. It is used by an application to allow a client to present a token representing his "identity card" (container with all information about him) to server and allow the server to verify the validity and integrity of the token in a secure way, all of this in a stateless and portable approach (portable in the way that client and server technologies can be different including also the transport channel even if HTTP is the most often used).<br />
<br />
= Token structure =<br />
<br />
Token structure example taken from ''https://jwt.io/#debugger'':<br />
<br />
'''[ Base64(HEADER) ] . [ Base64(PAYLOAD) ] . [ Base64(SIGNATURE) ]'''<br />
<br />
<pre><br />
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ<br />
</pre><br />
<br />
Chunk 1: Header<br />
<pre><br />
{<br />
"alg": "HS256",<br />
"typ": "JWT"<br />
}<br />
</pre><br />
<br />
Chunk 2: Payload<br />
<pre><br />
{<br />
"sub": "1234567890",<br />
"name": "John Doe",<br />
"admin": true<br />
}<br />
</pre><br />
<br />
Chunk 3: Signature<br />
<pre><br />
HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), KEY )<br />
</pre><br />
<br />
= Objective =<br />
This cheatsheet provides tips to prevent common security issues when using JSON Web Tokens (JWT) with Java.<br />
<br />
The tips presented in this article are part of a Java project that was created to show the correct way to handle creation and validation of JSON Web Tokens. You can find the Java project [https://github.com/righettod/poc-jwt here], it uses the official [https://jwt.io/#libraries JWT library].<br />
<br />
In the rest of the article, the term '''token''' refer to the '''JSON Web Tokens''' (JWT).<br />
<br />
= Consideration about using JWT =<br />
<br />
Even if a JWT token is "easy" to use and allow to expose services (mostly REST style) in a stateless way, it's not the solution that fits for all applications because it comes with some caveats, like for example the question of the storage of the token (tackled in this cheatsheet) and others...<br />
<br />
If your application does not need to be fully stateless, you can consider using traditional session system provided by all web frameworks and follow the advice from the dedicated [[Session_Management_Cheat_Sheet|cheatsheet]]. However, for stateless applications, when well implemented, it's a good candidate.<br />
<br />
= Issues =<br />
<br />
== NONE hashing algorithm ==<br />
<br />
=== Symptom ===<br />
<br />
This attack, described [https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ here] occur when a attacker alter the token and change the hashing algorithm to indicate, through, the ''none'' keyword, that the integrity of the token has already been verified. As explained in the link above ''some libraries treated tokens signed with the none algorithm as a valid token with a verified signature'', so an attacker can alter the token claims and tkey will be trusted by the application.<br />
<br />
=== How to prevent ===<br />
<br />
First, use a JWT library that is not exposed to this vulnerability.<br />
<br />
Last, during token validation, explicitly request that the expected algorithm was used.<br />
<br />
=== Implementation example ===<br />
<br />
<syntaxhighlight lang="java"><br />
// HMAC key - Block serialization and storage as String in JVM memory<br />
private transient byte[] keyHMAC = ...;<br />
<br />
...<br />
<br />
//Create a verification context for the token requesting explicitly the use of the HMAC-256 hashing algorithm<br />
JWTVerifier verifier = JWT.require(Algorithm.HMAC256(keyHMAC)).build();<br />
<br />
//Verify the token, if the verification fail then a exception is throwed<br />
DecodedJWT decodedToken = verifier.verify(token);<br />
</syntaxhighlight><br />
<br />
== Token sidejacking ==<br />
<br />
=== Symptom ===<br />
<br />
This attack occur when a token has been intercepted/stolen by a attacker and this one use it to gain access to the system using targeted user identity.<br />
<br />
=== How to prevent ===<br />
<br />
A way to protect is to add "user context" in the token. User context will be composed by the following information:<br />
<br />
* A random string that will be generated during the authentication phase and will be included into the token and also send to the client as an hardened cookie (flags: HttpOnly + Secure + SameSite + cookie prefix).<br />
* A SHA256 hash of the random string will be stored in the token (instead of the raw value) in order to prevent that any XSS issue allow the attacker to read the random string value and set the expected cookie.<br />
<br />
IP address will not be used because there some situation in which IP address can change during the same session like for example when a user access an application through his mobile and he change of mobile operator during the exchange then he change legitimately (often) is IP address. Moreover, using IP address can potentially cause issue at [http://www.eugdpr.org/ European GDPR] compliance level.<br />
<br />
During token validation, if the received token do not contains the right context so, it is replayed and then it must be rejected.<br />
<br />
=== Implementation example ===<br />
<br />
Code to create the token after success authentication.<br />
<br />
<syntaxhighlight lang="java"><br />
// HMAC key - Block serialization and storage as String in JVM memory<br />
private transient byte[] keyHMAC = ...;<br />
// Random data generator<br />
private SecureRandom secureRandom = new SecureRandom();<br />
<br />
...<br />
<br />
//Generate a random string that will constitute the fingerprint for this user<br />
byte[] randomFgp = new byte[50];<br />
this.secureRandom.nextBytes(randomFgp);<br />
String userFingerprint = DatatypeConverter.printHexBinary(randomFgp);<br />
<br />
//Add the fingerprint in a hardened cookie - Add cookie manually because SameSite attribute is not supported by javax.servlet.http.Cookie class<br />
String fingerprintCookie = "__Secure-Fgp=" + userFingerprint + "; SameSite=Strict; HttpOnly; Secure";<br />
response.addHeader("Set-Cookie", fingerprintCookie);<br />
<br />
//Compute a SHA256 hash of the fingerprint in order to store the fingerprint hash (instead of the raw value) in the token<br />
//to prevent an XSS to be able to read the fingerprint and set the expected cookie itself<br />
MessageDigest digest = MessageDigest.getInstance("SHA-256");<br />
byte[] userFingerprintDigest = digest.digest(userFingerprint.getBytes("utf-8"));<br />
String userFingerprintHash = DatatypeConverter.printHexBinary(userFingerprintDigest);<br />
<br />
//Create the token with a validity of 15 minutes and client context (fingerprint) information<br />
Calendar c = Calendar.getInstance();<br />
Date now = c.getTime();<br />
c.add(Calendar.MINUTE, 15);<br />
Date expirationDate = c.getTime();<br />
Map<String, Object> headerClaims = new HashMap<>();<br />
headerClaims.put("typ", "JWT");<br />
String token = JWT.create().withSubject(login)<br />
.withExpiresAt(expirationDate)<br />
.withIssuer(this.issuerID)<br />
.withIssuedAt(now)<br />
.withNotBefore(now)<br />
.withClaim("userFingerprint", userFingerprintHash)<br />
.withHeader(headerClaims)<br />
.sign(Algorithm.HMAC256(this.keyHMAC));<br />
</syntaxhighlight><br />
<br />
<br />
Code to validate the token.<br />
<br />
<syntaxhighlight lang="java"><br />
// HMAC key - Block serialization and storage as String in JVM memory<br />
private transient byte[] keyHMAC = ...;<br />
<br />
...<br />
<br />
//Retrieve the user fingerprint from the dedicated cookie<br />
String userFingerprint = null;<br />
if (request.getCookies() != null && request.getCookies().length > 0) {<br />
List<Cookie> cookies = Arrays.stream(request.getCookies()).collect(Collectors.toList());<br />
Optional<Cookie> cookie = cookies.stream().filter(c -> "__Secure-Fgp".equals(c.getName())).findFirst();<br />
if (cookie.isPresent()) {<br />
userFingerprint = cookie.get().getValue();<br />
}<br />
}<br />
<br />
//Compute a SHA256 hash of the received fingerprint in cookie in order to compare it to the fingerprint hash stored in the token<br />
MessageDigest digest = MessageDigest.getInstance("SHA-256");<br />
byte[] userFingerprintDigest = digest.digest(userFingerprint.getBytes("utf-8"));<br />
String userFingerprintHash = DatatypeConverter.printHexBinary(userFingerprintDigest);<br />
<br />
//Create a verification context for the token<br />
JWTVerifier verifier = JWT.require(Algorithm.HMAC256(keyHMAC))<br />
.withIssuer(issuerID)<br />
.withClaim("userFingerprint", userFingerprintHash)<br />
.build();<br />
<br />
//Verify the token, if the verification fail then a exception is throwed<br />
DecodedJWT decodedToken = verifier.verify(token);<br />
</syntaxhighlight><br />
<br />
== Token explicit revocation by the user ==<br />
<br />
=== Symptom ===<br />
<br />
This problem is inerrant to JWT token because a token become only invalid when it expires. The user has no built-in feature to explicitly revoke the validity of an token.<br />
So, in case of steal, a user cannot revoke the token itself and then block the attacker.<br />
<br />
=== How to prevent ===<br />
<br />
A way to protect is to implement a token blacklist that will be used to mimic the "logout" feature that exists with traditional session system.<br />
<br />
The blacklist will keep a digest (SHA-256 encoded in HEX) of the token with a revokation date, this, for a duration that must be superior to the duration validity of a issued token.<br />
<br />
When the user want to "logout" then it call a dedicated service that will add the provided user token to the blacklist resulting in a immediate invalidation of the token for further usage in the application.<br />
<br />
=== Implementation example ===<br />
<br />
==== Blacklist storage ====<br />
<br />
A database table with the following structure will used as central blacklist storage.<br />
<br />
<syntaxhighlight lang="sql"><br />
create table if not exists revoked_token(jwt_token_digest varchar(255) primary key, revokation_date timestamp default now());<br />
</syntaxhighlight><br />
<br />
==== Token revocation management ====<br />
<br />
Code in charge of adding a token to the blacklist and check if a token is revoked.<br />
<br />
<syntaxhighlight lang="java"><br />
/**<br />
* Handle the revokation of the token (logout).<br />
* Use a DB in order to allow multiple instances to check for revoked token and allow cleanup at centralized DB level.<br />
*/<br />
public class TokenRevoker {<br />
<br />
/** DB Connection */<br />
@Resource("jdbc/storeDS")<br />
private DataSource storeDS;<br />
<br />
/**<br />
* Verify if a digest encoded in HEX of the ciphered token is present in the revokation table<br />
*<br />
* @param jwtInHex Token encoded in HEX<br />
* @return Presence flag<br />
* @throws Exception If any issue occur during communication with DB<br />
*/<br />
public boolean isTokenRevoked(String jwtInHex) throws Exception {<br />
boolean tokenIsPresent = false;<br />
if (jwtInHex != null && !jwtInHex.trim().isEmpty()) {<br />
//Decode the ciphered token<br />
byte[] cipheredToken = DatatypeConverter.parseHexBinary(jwtInHex);<br />
<br />
//Compute a SHA256 of the ciphered token<br />
MessageDigest digest = MessageDigest.getInstance("SHA-256");<br />
byte[] cipheredTokenDigest = digest.digest(cipheredToken);<br />
String jwtTokenDigestInHex = DatatypeConverter.printHexBinary(cipheredTokenDigest);<br />
<br />
//Search token digest in HEX in DB<br />
try (Connection con = this.storeDS.getConnection()) {<br />
String query = "select jwt_token_digest from revoked_token where jwt_token_digest = ?";<br />
try (PreparedStatement pStatement = con.prepareStatement(query)) {<br />
pStatement.setString(1, jwtTokenDigestInHex);<br />
try (ResultSet rSet = pStatement.executeQuery()) {<br />
tokenIsPresent = rSet.next();<br />
}<br />
}<br />
}<br />
}<br />
<br />
return tokenIsPresent;<br />
}<br />
<br />
<br />
/**<br />
* Add a digest encoded in HEX of the ciphered token to the revokation token table<br />
*<br />
* @param jwtInHex Token encoded in HEX<br />
* @throws Exception If any issue occur during communication with DB<br />
*/<br />
public void revokeToken(String jwtInHex) throws Exception {<br />
if (jwtInHex != null && !jwtInHex.trim().isEmpty()) {<br />
//Decode the ciphered token<br />
byte[] cipheredToken = DatatypeConverter.parseHexBinary(jwtInHex);<br />
<br />
//Compute a SHA256 of the ciphered token<br />
MessageDigest digest = MessageDigest.getInstance("SHA-256");<br />
byte[] cipheredTokenDigest = digest.digest(cipheredToken);<br />
String jwtTokenDigestInHex = DatatypeConverter.printHexBinary(cipheredTokenDigest);<br />
<br />
//Check if the token digest in HEX is already in the DB and add it if it is absent<br />
if (!this.isTokenRevoked(jwtInHex)) {<br />
try (Connection con = this.storeDS.getConnection()) {<br />
String query = "insert into revoked_token(jwt_token_digest) values(?)";<br />
int insertedRecordCount;<br />
try (PreparedStatement pStatement = con.prepareStatement(query)) {<br />
pStatement.setString(1, jwtTokenDigestInHex);<br />
insertedRecordCount = pStatement.executeUpdate();<br />
}<br />
if (insertedRecordCount != 1) {<br />
throw new IllegalStateException("Number of inserted record is invalid, 1 expected but is " + insertedRecordCount);<br />
}<br />
}<br />
}<br />
<br />
}<br />
}<br />
</syntaxhighlight><br />
<br />
<br />
== Token information disclosure ==<br />
<br />
=== Symptom ===<br />
<br />
This attack occur when a attacker access to a token (or a set of tokens) and extract information stored into it (JWT token information are base64 encoded at the basis) in order to obtains information about the system. Information can be for example the security roles, login format...<br />
<br />
=== How to prevent ===<br />
<br />
A way to protect, is to cipher the token using for example a symetric algorithm.<br />
<br />
It's also important to protect the ciphered data against attack like [[Testing_for_Padding_Oracle_(OTG-CRYPST-002)|Padding Oracle]] or any other attack using cryptanalysis.<br />
<br />
In order to achieve all these goals, the algorithm ''AES-GCM'' can be used in conjunction with ''Additional Authentication Data (AAD)'' feature.<br />
<br />
A database can be used to store the ''NONCE'' and the ''AAD'' associated to a token.<br />
<br />
'''Note:'''<br />
<br />
Here ciphering is added mainly to hide internal information but it's very important to remember that the first protection against tampering of the JWT token is the signature so, the token signature and is verification must be always in place.<br />
<br />
=== Implementation example ===<br />
<br />
==== Token ciphering ====<br />
<br />
Database structure.<br />
<br />
<syntaxhighlight lang="sql"><br />
create table if not exists nonce(jwt_token_digest varchar(255) primary key, gcm_nonce varchar(255) not null unique, gcm_aad varchar(255) not null unique);<br />
create index if not exists idx_nonce on nonce(gcm_nonce);<br />
</syntaxhighlight><br />
<br />
<br />
Code in charge of managing the ciphering.<br />
<br />
<syntaxhighlight lang="java"><br />
/**<br />
* Handle ciphering and deciphering of the token using AES-GCM.<br />
* Use a DB in order to link a GCM NONCE to a ciphered message and ensure that a NONCE is never reused<br />
* and also allow use of several application nodes in load balancing.<br />
*/<br />
public class TokenCipher {<br />
<br />
/** AES-GCM parameters */<br />
private static final int GCM_NONCE_LENGTH = 12; // in bytes<br />
<br />
/** AES-GCM parameters */<br />
private static final int GCM_TAG_LENGTH = 16; // in bytes<br />
<br />
/**Secure random generator */<br />
private final SecureRandom secRandom = new SecureRandom();<br />
<br />
/** DB Connection */<br />
@Resource("jdbc/storeDS")<br />
private DataSource storeDS;<br />
<br />
/**<br />
* Cipher a JWT<br />
* @param jwt Token to cipher<br />
* @param key Ciphering key<br />
* @return The ciphered version of the token encoded in HEX<br />
* @throws Exception If any issue occur during token ciphering operation<br />
*/<br />
public String cipherToken(String jwt, byte[] key) throws Exception {<br />
//Verify parameters<br />
if(jwt == null || jwt.isEmpty() || key == null || key.length == 0){<br />
throw new IllegalArgumentException("Both parameters must be specified !");<br />
}<br />
<br />
//Generate a NONCE<br />
//NOTE: As in the DB, the column to store the NONCE is flagged UNIQUE then the insert will fail<br />
//if the NONCE already exists, normally as we use the Java Secure Random implementation<br />
//it will never happen.<br />
final byte[] nonce = new byte[GCM_NONCE_LENGTH];<br />
secRandom.nextBytes(nonce);<br />
<br />
//Prepare ciphering key from bytes provided<br />
SecretKey aesKey = new SecretKeySpec(key, 0, key.length, "AES");<br />
<br />
//Setup Cipher<br />
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding", "SunJCE");<br />
GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH * 8, nonce);<br />
cipher.init(Cipher.ENCRYPT_MODE, aesKey, spec);<br />
<br />
//Add "Additional Authentication Data" (AAD) in order to operate in AEAD mode - Generate it<br />
byte[] aad = new byte[32];<br />
secRandom.nextBytes(aad);<br />
cipher.updateAAD(aad);<br />
<br />
//Cipher the token<br />
byte[] cipheredToken = cipher.doFinal(jwt.getBytes("utf-8"));<br />
<br />
//Compute a SHA256 of the ciphered token<br />
MessageDigest digest = MessageDigest.getInstance("SHA-256");<br />
byte[] cipheredTokenDigest = digest.digest(cipheredToken);<br />
<br />
//Store GCM NONCE and GCM AAD<br />
this.storeNonceAndAAD(DatatypeConverter.printHexBinary(nonce), DatatypeConverter.printHexBinary(aad),<br />
DatatypeConverter.printHexBinary(cipheredTokenDigest));<br />
<br />
return DatatypeConverter.printHexBinary(cipheredToken);<br />
}<br />
<br />
/**<br />
* Decipher a JWT<br />
* @param jwtInHex Token to decipher encoded in HEX<br />
* @param key Ciphering key<br />
* @return The token in clear text<br />
* @throws Exception If any issue occur during token deciphering operation<br />
*/<br />
public String decipherToken(String jwtInHex, byte[] key) throws Exception{<br />
//Verify parameters<br />
if(jwtInHex == null || jwtInHex.isEmpty() || key == null || key.length == 0){<br />
throw new IllegalArgumentException("Both parameters must be specified !");<br />
}<br />
<br />
//Decode the ciphered token<br />
byte[] cipheredToken = DatatypeConverter.parseHexBinary(jwtInHex);<br />
<br />
//Compute a SHA256 of the ciphered token<br />
MessageDigest digest = MessageDigest.getInstance("SHA-256");<br />
byte[] cipheredTokenDigest = digest.digest(cipheredToken);<br />
<br />
//Read the GCM NONCE and GCM AAD associated from the DB<br />
Map<String,String> gcmInfos = this.readNonceAndAAD(DatatypeConverter.printHexBinary(cipheredTokenDigest));<br />
if(gcmInfos == null){<br />
throw new Exception("Cannot found a NONCE and AAD associated to the token provided !");<br />
}<br />
byte[] nonce = DatatypeConverter.parseHexBinary(gcmInfos.get("NONCE"));<br />
byte[] aad = DatatypeConverter.parseHexBinary(gcmInfos.get("AAD"));<br />
<br />
//Prepare ciphering key from bytes provided<br />
SecretKey aesKey = new SecretKeySpec(key, 0, key.length, "AES");<br />
<br />
//Setup Cipher<br />
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding", "SunJCE");<br />
GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH * 8, nonce);<br />
cipher.init(Cipher.DECRYPT_MODE, aesKey, spec);<br />
<br />
//Add "Additional Authentication Data" (AAD) in order to operate in AEAD mode<br />
cipher.updateAAD(aad);<br />
<br />
//Decipher the token<br />
byte[] decipheredToken = cipher.doFinal(cipheredToken);<br />
<br />
return new String(decipheredToken);<br />
}<br />
<br />
<br />
/**<br />
* Store GCM NONCE and GCM AAD in the DB<br />
* @param nonceInHex Nonce encoded in HEX<br />
* @param aadInHex AAD encoded in HEX<br />
* @param jwtTokenDigestInHex SHA256 of the JWT ciphered token encoded in HEX<br />
* @throws Exception If any issue occur during communication with DB<br />
*/<br />
private void storeNonceAndAAD(String nonceInHex, String aadInHex, String jwtTokenDigestInHex) throws Exception {<br />
try (Connection con = this.storeDS.getConnection()) {<br />
String query = "insert into nonce(jwt_token_digest, gcm_nonce, gcm_aad) values(?, ?, ?)";<br />
int insertedRecordCount;<br />
try (PreparedStatement pStatement = con.prepareStatement(query)) {<br />
pStatement.setString(1, jwtTokenDigestInHex);<br />
pStatement.setString(2, nonceInHex);<br />
pStatement.setString(3, aadInHex);<br />
insertedRecordCount = pStatement.executeUpdate();<br />
}<br />
if (insertedRecordCount != 1) {<br />
throw new IllegalStateException("Number of inserted record is invalid, 1 expected but is " + insertedRecordCount);<br />
}<br />
}<br />
}<br />
<br />
/**<br />
* Read GCM NONCE and GCM AAD from the DB<br />
* @param jwtTokenDigestInHex SHA256 of the JWT ciphered token encoded in HEX for which we must read the NONCE and AAD<br />
* @return A dict containing the NONCE and AAD if they exists for the specified token<br />
* @throws Exception If any issue occur during communication with DB<br />
*/<br />
private Map<String,String> readNonceAndAAD(String jwtTokenDigestInHex) throws Exception{<br />
Map<String,String> gcmInfos = null;<br />
try (Connection con = this.storeDS.getConnection()) {<br />
String query = "select gcm_nonce, gcm_aad from nonce where jwt_token_digest = ?";<br />
try (PreparedStatement pStatement = con.prepareStatement(query)) {<br />
pStatement.setString(1, jwtTokenDigestInHex);<br />
try (ResultSet rSet = pStatement.executeQuery()) {<br />
while (rSet.next()) {<br />
gcmInfos = new HashMap<>(2);<br />
gcmInfos.put("NONCE", rSet.getString(1));<br />
gcmInfos.put("AAD", rSet.getString(2));<br />
}<br />
}<br />
}<br />
}<br />
<br />
return gcmInfos;<br />
}<br />
<br />
}<br />
</syntaxhighlight><br />
<br />
==== Creation / Validation of the token ====<br />
<br />
Use of the token ciphering during the creation and the validation of the token.<br />
<br />
Load keys and setup cipher.<br />
<br />
<syntaxhighlight lang="java"><br />
//Load keys from configuration text files in order to avoid to store keys as String in JVM memory<br />
private transient byte[] keyHMAC = Files.readAllBytes(Paths.get("key-hmac.txt"));<br />
private transient byte[] keyCiphering = Files.readAllBytes(Paths.get("key-ciphering.txt"));<br />
<br />
//Load issuer ID from configuration text file<br />
private transient String issuerID = Files.readAllLines(Paths.get("issuer-id.txt")).get(0);<br />
<br />
//Init token ciphering handler<br />
TokenCipher tokenCipher = new TokenCipher();<br />
</syntaxhighlight><br />
<br />
Token creation.<br />
<br />
<syntaxhighlight lang="java"><br />
//Generate a random string that will constitute the fingerprint for this user<br />
byte[] randomFgp = new byte[50];<br />
this.secureRandom.nextBytes(randomFgp);<br />
String userFingerprint = DatatypeConverter.printHexBinary(randomFgp);<br />
<br />
//Add the fingerprint in a hardened cookie - Add cookie manually because SameSite attribute is not supported by javax.servlet.http.Cookie class<br />
String fingerprintCookie = "__Secure-Fgp=" + userFingerprint + "; SameSite=Strict; HttpOnly; Secure";<br />
response.addHeader("Set-Cookie", fingerprintCookie);<br />
<br />
//Compute a SHA256 hash of the fingerprint in order to store the fingerprint hash (instead of the raw value) in the token<br />
//to prevent an XSS to be able to read the fingerprint and set the expected cookie itself<br />
MessageDigest digest = MessageDigest.getInstance("SHA-256");<br />
byte[] userFingerprintDigest = digest.digest(userFingerprint.getBytes("utf-8"));<br />
String userFingerprintHash = DatatypeConverter.printHexBinary(userFingerprintDigest);<br />
<br />
//Create the token with a validity of 15 minutes and client context (fingerprint) information<br />
Calendar c = Calendar.getInstance();<br />
Date now = c.getTime();<br />
c.add(Calendar.MINUTE, 15);<br />
Date expirationDate = c.getTime();<br />
Map<String, Object> headerClaims = new HashMap<>();<br />
headerClaims.put("typ", "JWT");<br />
String token = JWT.create().withSubject(login)<br />
.withExpiresAt(expirationDate)<br />
.withIssuer(this.issuerID)<br />
.withIssuedAt(now)<br />
.withNotBefore(now)<br />
.withClaim("userFingerprint", userFingerprintHash)<br />
.withHeader(headerClaims)<br />
.sign(Algorithm.HMAC256(this.keyHMAC));<br />
//Cipher the token<br />
String cipheredToken = tokenCipher.cipherToken(token, keyCiphering);<br />
</syntaxhighlight><br />
<br />
Token validation.<br />
<br />
<syntaxhighlight lang="java"><br />
//Decipher the token<br />
String token = tokenCipher.decipherToken(cipheredToken, keyCiphering);<br />
<br />
//Retrieve the user fingerprint from the dedicated cookie<br />
String userFingerprint = null;<br />
if (request.getCookies() != null && request.getCookies().length > 0) {<br />
List<Cookie> cookies = Arrays.stream(request.getCookies()).collect(Collectors.toList());<br />
Optional<Cookie> cookie = cookies.stream().filter(c -> "__Secure-Fgp".equals(c.getName())).findFirst();<br />
if (cookie.isPresent()) {<br />
userFingerprint = cookie.get().getValue();<br />
}<br />
}<br />
<br />
//Compute a SHA256 hash of the received fingerprint in cookie in order to compare it to the fingerprint hash stored in the token<br />
MessageDigest digest = MessageDigest.getInstance("SHA-256");<br />
byte[] userFingerprintDigest = digest.digest(userFingerprint.getBytes("utf-8"));<br />
String userFingerprintHash = DatatypeConverter.printHexBinary(userFingerprintDigest);<br />
<br />
//Decipher the token<br />
String token = this.tokenCipher.decipherToken(cipheredToken, this.keyCiphering);<br />
//Create a verification context for the token<br />
JWTVerifier verifier = JWT.require(Algorithm.HMAC256(this.keyHMAC))<br />
.withIssuer(this.issuerID)<br />
.withClaim("userFingerprint", userFingerprintHash)<br />
.build();<br />
<br />
//Verify the token, if the verification fail then a exception is throwed<br />
DecodedJWT decodedToken = verifier.verify(token);<br />
</syntaxhighlight><br />
<br />
== Token storage on client side ==<br />
<br />
=== Symptom ===<br />
<br />
It's occur when a application store the token in a way allowing this one to be:<br />
<br />
* Automatically sent by the browser (''Cookie'' storage).<br />
* Retrieved even if the browser is restarted (Use of browser ''localStorage'' container).<br />
* Retrieved in case of [[XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet|XSS]] issue (Cookie accessible to JavaScript code or Token stored in browser local/session storage). <br />
<br />
=== How to prevent ===<br />
<br />
# Store the token using the browser ''sessionStorage'' container.<br />
# Add it as a ''Bearer'' with JavaScript when calling services.<br />
# Add [[#Token sidejacking|fingerprint]] information to the token.<br />
<br />
By storing the token in browser ''sessionStorage'' container it expose the token to be steal in case of XSS issue. However, fingerprint added to the token prevent reuse of the stolen token by the attacker on his machine. To close a maximum of exploitation surfaces for an attacker, add a browser [[OWASP_Secure_Headers_Project#csp|Content Security Policy]] to harden the execution context.<br />
<br />
''Note:''<br />
<br />
* The remaining case is when a attacker use the user browsing context as a proxy to use the target application through the legitimate user but the Content Security Policy can prevent communication with non expected domains.<br />
* It's also possible to implements the authentication service in a way that the token is issued within a hardened cookie, but in this case, a protection against [[Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet|Cross-Site Request Forgery]] attack must be implemented.<br />
<br />
=== Implementation example ===<br />
<br />
<br />
JavaScript code to store the token after authentication.<br />
<br />
<syntaxhighlight lang="javascript"><br />
/* Handle request for JWT token and local storage*/<br />
function getToken(){<br />
var login = $("#login").val();<br />
var postData = "login=" + encodeURIComponent(login) + "&password=test";<br />
<br />
$.post("/services/authenticate", postData,function (data){<br />
if(data.status == "Authentication successful !"){<br />
...<br />
sessionStorage.setItem("token", data.token);<br />
}else{<br />
...<br />
sessionStorage.removeItem("token");<br />
}<br />
})<br />
.fail(function(jqXHR, textStatus, error){<br />
...<br />
sessionStorage.removeItem("token");<br />
});<br />
}<br />
</syntaxhighlight><br />
<br />
JavaScript code to add the token as ''Bearer'' when calling a service, for example a service to validate token here.<br />
<br />
<syntaxhighlight lang="javascript"><br />
/* Handle request for JWT token validation */<br />
function validateToken(){<br />
var token = sessionStorage.getItem("token");<br />
<br />
if(token == undefined || token == ""){<br />
$("#infoZone").removeClass();<br />
$("#infoZone").addClass("alert alert-warning");<br />
$("#infoZone").text("Obtain a JWT token first :)");<br />
return;<br />
}<br />
<br />
$.ajax({<br />
url: "/services/validate",<br />
type: "POST",<br />
beforeSend: function(xhr) {<br />
xhr.setRequestHeader("Authorization", "bearer " + token);<br />
},<br />
success: function(data) {<br />
...<br />
},<br />
error: function(jqXHR, textStatus, error) {<br />
...<br />
},<br />
});<br />
}<br />
</syntaxhighlight><br />
<br />
<br />
== Token weak secret ==<br />
<br />
=== Symptom ===<br />
<br />
It's occur when the secret used in case of HMAC SHA256 algorithm used for the token signature is weak and can be bruteforced.<br />
<br />
The result is the capacity for an attacker to forge arbitrary valid token from a signature point of view.<br />
<br />
See [https://www.notsosecure.com/crafting-way-json-web-tokens/ here] for an example.<br />
<br />
=== How to prevent ===<br />
<br />
Use a very strong secret: Alphanumeric (mixed case) + special characters.<br />
<br />
As it's a computer processing only, the size of the secret can be superior to 50 positions.<br />
<br />
Secret example:<br />
<br />
<pre>A&'/}Z57M(2hNg=;LE?~]YtRMS5(yZ<vcZTA3N-($>2j:ZeX-BGftaVk`)jKP~q?,jk)EMbgt*kW'(</pre><br />
<br />
To evaluate the strength of the secret used for your token signature, you can apply a password dictionary attack on the token combined with the JWT API to facilitate the implementation of a breaker.<br />
<br />
Password dictionaries can be found for example [https://wiki.skullsecurity.org/Passwords here].<br />
<br />
=== Implementation example ===<br />
<br />
Code in charge of testing a secret against a JWT token test base.<br />
<br />
<syntaxhighlight lang="java"><br />
/**<br />
* Test if a secret match the secret used to sign the token<br />
*<br />
* @param token Source JWT token (test base)<br />
* @param secret Secret to test<br />
* @return The token decoded if the secret matche otherwise return null<br />
*/<br />
private DecodedJWT checkSecret(String token, String secret) {<br />
DecodedJWT t = null;<br />
try {<br />
Algorithm algorithm = Algorithm.HMAC256(secret);<br />
JWTVerifier verifier = JWT.require(algorithm).build();<br />
t = verifier.verify(token);<br />
} catch (JWTVerificationException | UnsupportedEncodingException e) {<br />
//ignore...<br />
}<br />
return t;<br />
}<br />
</syntaxhighlight><br />
<br />
Code snippet to evaluate the token test base on the secret dictionary.<br />
<br />
<syntaxhighlight lang="java"><br />
final String tokenTestBase = ...;<br />
final String[] secret = new String[1];<br />
final DecodedJWT[] decodedToken = new DecodedJWT[1];<br />
List<String> secrets = Files.readAllLines(Paths.get("secrets-dictionary.txt"));<br />
secrets.parallelStream().forEach(s -> {<br />
DecodedJWT tentative = checkSecret(tokenTestBase, s);<br />
if (tentative != null) {<br />
secret[0] = s;<br />
decodedToken[0] = tentative;<br />
}<br />
});<br />
</syntaxhighlight><br />
<br />
=== Use dedicated tools ===<br />
<br />
You can also used [https://github.com/hashcat/hashcat/issues/1057#issuecomment-279651700 JohnTheRipper] to perform the password dictionary attack.<br />
<br />
<br />
Support for [https://github.com/hashcat/hashcat/issues/1057 Hashcat] is pending.<br />
<br />
<br />
= Authors and Primary Editors =<br />
<br />
Jim Manico - jim.manico@owasp.org<br />
<br />
Dominique Righetto - dominique.righetto@owasp.org<br />
<br />
Paul Ionescu - paul.ionescu@owasp.org<br />
<br />
= Other Cheatsheets =<br />
<br />
{{Cheatsheet_Navigation_Body}}<br />
<br />
|}<br />
<br />
[[Category:Cheatsheets]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=197023Orange County2015-07-06T00:51:35Z<p>Ron Perris: </p>
<hr />
<div>{{Chapter Template|chaptername=Orange County|extra=The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Orange_County|emailarchives=http://lists.owasp.org/pipermail/owasp-Orange_County}}<br />
<br />
[[Category:OWASP Chapter]]<br />
[[Category:United States]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196930Orange County2015-07-02T21:14:48Z<p>Ron Perris: </p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up, click the logo below to find out more about our chapter.<br />
<br />
[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris, ron.perris@owasp.org<br />
<br />
=== Next Chapter Meeting ===<br />
Thursday, July 30, 2015 at 6:00 PM<br />
<br />
==== Development with web2py ====<br />
<br />
Free open source full-stack framework for rapid development of fast, scalable, secure and portable database-driven web-based applications. Written and programmable in Python.<br />
<br />
Massimo Di Pierro (Professor of Computer Science at DePaul University, Chicago)</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196929Orange County2015-07-02T21:13:28Z<p>Ron Perris: /* Next Chapter Meeting = */</p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up.<br />
<br />
[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris, ron.perris@owasp.org<br />
<br />
=== Next Chapter Meeting ===<br />
Thursday, July 30, 2015 at 6:00 PM<br />
<br />
==== Development with web2py ====<br />
<br />
Free open source full-stack framework for rapid development of fast, scalable, secure and portable database-driven web-based applications. Written and programmable in Python.<br />
<br />
Massimo Di Pierro (Professor of Computer Science at DePaul University, Chicago)</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196928Orange County2015-07-02T21:13:16Z<p>Ron Perris: /* Next Chapter Meeting = */</p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up.<br />
<br />
[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris, ron.perris@owasp.org<br />
<br />
=== Next Chapter Meeting ====<br />
Thursday, July 30, 2015 at 6:00 PM<br />
<br />
===== Development with web2py ====<br />
<br />
Free open source full-stack framework for rapid development of fast, scalable, secure and portable database-driven web-based applications. Written and programmable in Python.<br />
<br />
Massimo Di Pierro (Professor of Computer Science at DePaul University, Chicago)</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196927Orange County2015-07-02T21:13:07Z<p>Ron Perris: </p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up.<br />
<br />
[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris, ron.perris@owasp.org<br />
<br />
=== Next Chapter Meeting ====<br />
Thursday, July 30, 2015 at 6:00 PM<br />
<br />
===== Development with web2py =====<br />
<br />
Free open source full-stack framework for rapid development of fast, scalable, secure and portable database-driven web-based applications. Written and programmable in Python.<br />
<br />
Massimo Di Pierro (Professor of Computer Science at DePaul University, Chicago)</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196926Orange County2015-07-02T21:12:34Z<p>Ron Perris: </p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up.<br />
<br />
[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris, ron.perris@owasp.org<br />
<br />
Next Chapter Meeting:<br />
Thursday, July 30, 2015 at 6:00 PM<br />
<br />
Development with web2py:<br />
<br />
Free open source full-stack framework for rapid development of fast, scalable, secure and portable database-driven web-based applications. Written and programmable in Python.<br />
<br />
Massimo Di Pierro (Professor of Computer Science at DePaul University, Chicago)</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196925Orange County2015-07-02T20:58:33Z<p>Ron Perris: </p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up.<br />
<br />
[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris, ron.perris@owasp.org</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196924Orange County2015-07-02T20:58:16Z<p>Ron Perris: </p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up, if you are unable to access it from your work computer as a result of filtering of social sites we recommend that you come to one of our meetings and ask about how to use a proxy. <br />
<br />
[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris, ron.perris@owasp.org</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196923Orange County2015-07-02T20:57:58Z<p>Ron Perris: </p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up, if you are unable to access it from your work computer as a result of filtering of social sites we recommend that you come to one of our meetings and ask about how to use a proxy. <br />
<br />
[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris <ron.perris@owasp.org></div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196922Orange County2015-07-02T20:57:46Z<p>Ron Perris: </p>
<hr />
<div>= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up, if you are unable to access it from your work computer as a result of filtering of social sites we recommend that you come to one of our meetings and ask about how to use a proxy. <br />
<br />
<h2>[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br />
Our Current Chapter Leader is Ron Perris <ron.perris@owasp.org></div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196921Orange County2015-07-02T20:57:17Z<p>Ron Perris: </p>
<hr />
<div>Check out more information on our chapter at [http://www.meetup.com/OWASP-OC Meetup]<br />
<br />
= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up, if you are unable to access it from your work computer as a result of filtering of social sites we recommend that you come to one of our meetings and ask about how to use a proxy. <br />
<br />
<h2>[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196920Orange County2015-07-02T20:56:59Z<p>Ron Perris: </p>
<hr />
<div>Check out more information on our chapter at [http://www.meetup.com/OWASP-OC Meetup]<br />
<br />
= OWASP Orange County California =<br />
The Orange County OWASP Chapter uses a community building website known as Meet-Up, if you are unable to access it from your work computer as a result of filtering of social sites we recommend that you come to one of our meetings and ask about how to use a proxy. <br />
<br />
<h2>[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]<br />
<br><br />
<br />
Are you looking for [https://www.owasp.org/index.php/NYC/training/may2015 ISC2 CSSLP Training in New York City?] simply [https://www.owasp.org/index.php/NYC/training/may2015 CLICK HERE]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196919Orange County2015-07-02T20:51:42Z<p>Ron Perris: Replaced content with "Check out more information on our chapter at [http://www.meetup.com/OWASP-OC Meetup]"</p>
<hr />
<div>Check out more information on our chapter at [http://www.meetup.com/OWASP-OC Meetup]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196918Orange County2015-07-02T20:46:50Z<p>Ron Perris: </p>
<hr />
<div>Check out more information on our chapter at [http://www.meetup.com/OWASP-OC Meetup]<br />
<br />
Check out our meetup.com page for recent chapter history.<br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Organization =<br />
<br />
'''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=196917Orange County2015-07-02T20:45:55Z<p>Ron Perris: </p>
<hr />
<div>Check out more information on our chapter at [http://www.meetup.com/owaspoc/ Meetup]<br />
<br />
Check out our meetup.com page for recent chapter history.<br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Organization =<br />
<br />
'''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=User:Ron_Perris&diff=183335User:Ron Perris2014-10-06T19:35:21Z<p>Ron Perris: /* Involvement in OWASP */</p>
<hr />
<div>== Professional Bio == <br />
<br />
Ron Perris is currently an Advisor for SecureReady, a phishing simulation software company. Formerly, Ron worked in product development executive roles for several information security companies. Ron spent 6 years with Sweden’s Outpost24, as CTO for 4 of those years. At Outpost24 Ron lead product development and software engineering. With Outpost24 he worked with over 2000 organizations globally to help them manage their network, systems and application security. Ron also worked for NTOBJECTives and Whitehat Security to help companies improve their application security programs. Ron joined OWASP in 2013 as the Orange County Chapter Leader and has worked through the chapter to carry out the OWASP mission locally.<br />
<br />
== Involvement in OWASP ==<br />
<br />
* OWASP Orange County Chapter.<br />
** Grew the chapter leadership organization to five chapter leaders from three. <br />
** Increased meeting frequency from bi-yearly to monthly. <br />
** Held 13 meetings in the last twelve months. <br />
** Attracted 140 new attendees to chapter meetings. <br />
** Established a culture of vendor neutrality and speakers selection based on merit<br />
<br />
* Organizer of [https://2014.appseccalifornia.org/ AppSecCalifornia 2014] along with OWASP OC Organizers and other California OWASP Chapters<br />
** Attracted Speakers to Call-for-Papers<br />
** Worked with OWASP team to Setup Vendor Room<br />
** Performed Registration and Information Desk Duty<br />
<br />
== Current Projects ==<br />
* OWASP Secure Coding for Charity Project in Orange County<br />
* OWASP Orange County Capture the Flag Challenge<br />
<br />
== Contact Info ==<br />
* Email: ron.perris@owasp.org<br />
* [http://www.meetup.com/OWASP-OC/ OWASP OC Meetings]<br />
* [https://www.linkedin.com/in/ronperris Linkedin]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=User:Ron_Perris&diff=183334User:Ron Perris2014-10-06T19:28:17Z<p>Ron Perris: /* Involvement in OWASP */</p>
<hr />
<div>== Professional Bio == <br />
<br />
Ron Perris is currently an Advisor for SecureReady, a phishing simulation software company. Formerly, Ron worked in product development executive roles for several information security companies. Ron spent 6 years with Sweden’s Outpost24, as CTO for 4 of those years. At Outpost24 Ron lead product development and software engineering. With Outpost24 he worked with over 2000 organizations globally to help them manage their network, systems and application security. Ron also worked for NTOBJECTives and Whitehat Security to help companies improve their application security programs. Ron joined OWASP in 2013 as the Orange County Chapter Leader and has worked through the chapter to carry out the OWASP mission locally.<br />
<br />
== Involvement in OWASP ==<br />
<br />
* OWASP Orange County Chapter.<br />
** Grew the chapter leadership organization to five chapter leaders from three. <br />
** Increased meeting frequency from bi-yearly to monthly. <br />
** Held 13 meetings in the last twelve months. <br />
** Attracted 140 new attendees to chapter meetings. <br />
** Established a culture of vendor neutrality and speakers selection based on merit<br />
<br />
* Helped Organize [https://2014.appseccalifornia.org/ AppSecCalifornia 2014] along with OWASP OC Organizers and other California OWASP Chapters<br />
** Attracted Speakers to Call-for-Papers<br />
** Worked with OWASP team to Setup Vendor Room<br />
** Performed Registration and Information Desk Duty<br />
<br />
== Current Projects ==<br />
* OWASP Secure Coding for Charity Project in Orange County<br />
* OWASP Orange County Capture the Flag Challenge<br />
<br />
== Contact Info ==<br />
* Email: ron.perris@owasp.org<br />
* [http://www.meetup.com/OWASP-OC/ OWASP OC Meetings]<br />
* [https://www.linkedin.com/in/ronperris Linkedin]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=User:Ron_Perris&diff=178741User:Ron Perris2014-07-14T17:12:26Z<p>Ron Perris: </p>
<hr />
<div>== Professional Bio == <br />
<br />
Ron Perris is currently an Advisor for SecureReady, a phishing simulation software company. Formerly, Ron worked in product development executive roles for several information security companies. Ron spent 6 years with Sweden’s Outpost24, as CTO for 4 of those years. At Outpost24 Ron lead product development and software engineering. With Outpost24 he worked with over 2000 organizations globally to help them manage their network, systems and application security. Ron also worked for NTOBJECTives and Whitehat Security to help companies improve their application security programs. Ron joined OWASP in 2013 as the Orange County Chapter Leader and has worked through the chapter to carry out the OWASP mission locally.<br />
<br />
== Involvement in OWASP ==<br />
<br />
* OWASP Orange County Chapter.<br />
** Grew the chapter leadership organization to five chapter leaders from three. <br />
** Increased meeting frequency from bi-yearly to monthly. <br />
** Held 13 meetings in the last twelve months. <br />
** Attracted 140 new attendees to chapter meetings. <br />
** Established a culture of vendor neutrality and speakers selection based on merit<br />
<br />
* Helped Organize [https://2014.appseccalifornia.org/ AppSecCalifornia 2013] along with OWASP OC Organizers and other California OWASP Chapters<br />
** Attracted Speakers to Call-for-Papers<br />
** Worked with OWASP team to Setup Vendor Room<br />
** Performed Registration and Information Desk Duty<br />
<br />
== Current Projects ==<br />
* OWASP Secure Coding for Charity Project in Orange County<br />
* OWASP Orange County Capture the Flag Challenge<br />
<br />
== Contact Info ==<br />
* Email: ron.perris@owasp.org<br />
* [http://www.meetup.com/OWASP-OC/ OWASP OC Meetings]<br />
* [https://www.linkedin.com/in/ronperris Linkedin]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=User:Ron_Perris&diff=178738User:Ron Perris2014-07-14T17:06:21Z<p>Ron Perris: </p>
<hr />
<div>== Professional Bio == <br />
<br />
Ron Perris is currently an Advisor for SecureReady, a phishing simulation software company. Formerly, Ron worked in product development executive roles for several information security companies. Ron spent 6 years with Sweden’s Outpost24, as CTO for 4 of those years. At Outpost24 Ron lead product development and software engineering. With Outpost24 he worked with over 2000 organizations globally to help them manage their network, systems and application security. Ron also worked for NTOBJECTives and Whitehat Security to help companies improve their application security programs. Ron joined OWASP in 2013 as the Orange County Chapter Leader and has worked through the chapter to carry out the OWASP mission locally.<br />
<br />
== Involvement in OWASP ==<br />
<br />
* Relaunched the OWASP Orange County Chapter.<br />
** Grew the chapter leadership organization to five chapter leaders from three. <br />
** Increased meeting frequency from bi-yearly to monthly. <br />
** Held 13 meetings in the last twelve months. <br />
** Attracted 140 new attendees to chapter meetings. <br />
** Established a culture of vendor neutrality and speakers selection based on merit<br />
<br />
* Helped Organize [https://2014.appseccalifornia.org/ AppSecCalifornia 2013] along with OWASP OC Organizers and other California OWASP Chapters<br />
** Attracted Speakers to Call-for-Papers<br />
** Worked with OWASP team to Setup Vendor Room<br />
** Performed Registration and Information Desk Duty<br />
<br />
== Current Projects ==<br />
* OWASP Secure Coding for Charity Project in Orange County<br />
* OWASP Orange County Capture the Flag Challenge<br />
<br />
== Contact Info ==<br />
* Email: ron.perris@owasp.org<br />
* [http://www.meetup.com/OWASP-OC/ OWASP OC Meetings]<br />
* [https://www.linkedin.com/in/ronperris Linkedin]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=User:Ron_Perris&diff=178737User:Ron Perris2014-07-14T17:05:51Z<p>Ron Perris: </p>
<hr />
<div>== Involvement in OWASP ==<br />
<br />
* Relaunched the OWASP Orange County Chapter.<br />
** Grew the chapter leadership organization to five chapter leaders from three. <br />
** Increased meeting frequency from bi-yearly to monthly. <br />
** Held 13 meetings in the last twelve months. <br />
** Attracted 140 new attendees to chapter meetings. <br />
** Established a culture of vendor neutrality and speakers selection based on merit<br />
<br />
* Helped Organize [https://2014.appseccalifornia.org/ AppSecCalifornia 2013] along with OWASP OC Organizers and other California OWASP Chapters<br />
** Attracted Speakers to Call-for-Papers<br />
** Worked with OWASP team to Setup Vendor Room<br />
** Performed Registration and Information Desk Duty<br />
<br />
== Current Projects ==<br />
* OWASP Secure Coding for Charity Project in Orange County<br />
* OWASP Orange County Capture the Flag Challenge<br />
<br />
== Contact Info ==<br />
* Email: ron.perris@owasp.org<br />
* [http://www.meetup.com/OWASP-OC/ OWASP OC Meetings]<br />
* [https://www.linkedin.com/in/ronperris Linkedin]<br />
<br />
== Professional Bio == <br />
<br />
Ron Perris is currently an Advisor for SecureReady, a phishing simulation software company. Formerly, Ron worked in product development executive roles for several information security companies. Ron spent 6 years with Sweden’s Outpost24, as CTO for 4 of those years. At Outpost24 Ron lead product development and software engineering. With Outpost24 he worked with over 2000 organizations globally to help them manage their network, systems and application security. Ron also worked for NTOBJECTives and Whitehat Security to help companies improve their application security programs. Ron joined OWASP in 2013 as the Orange County Chapter Leader and has worked through the chapter to carry out the OWASP mission locally.</div>Ron Perrishttps://wiki.owasp.org/index.php?title=User:Ron_Perris&diff=178735User:Ron Perris2014-07-14T17:01:44Z<p>Ron Perris: Updated bio</p>
<hr />
<div>== Involvement in OWASP ==<br />
<br />
* Relaunched the OWASP Orange County Chapter.<br />
** Grew the chapter leadership organization to five chapter leaders from three. <br />
** Increased meeting frequency from bi-yearly to monthly. <br />
** Held 13 meetings in the last twelve months. <br />
** Attracted 140 new attendees to chapter meetings. <br />
** Established a culture of vendor neutrality and speakers selection based on merit<br />
<br />
* Helped Organize [https://2014.appseccalifornia.org/ AppSecCalifornia 2013] along with OWASP OC Organizers and other California OWASP Chapters<br />
** Attracted Speakers to Call-for-Papers<br />
** Worked with OWASP team to Setup Vendor Room<br />
** Performed Registration and Information Desk Duty<br />
<br />
== Current Projects ==<br />
* OWASP Secure Coding for Charity Project in Orange County<br />
* OWASP Orange County Capture the Flag Challenge<br />
<br />
== Contact Info ==<br />
* Email: ron.perris@owasp.org<br />
* [http://www.meetup.com/OWASP-OC/ OWASP OC Meetings]<br />
* [https://www.linkedin.com/in/ronperris Linkedin]<br />
<br />
Bio: Ron Perris is currently an Advisor for SecureReady, a phishing simulation software company. Formerly, Ron worked in product development executive roles for several information security companies. Ron spent 6 years with Sweden’s Outpost24, as CTO for 4 of those years. At Outpost24 Ron lead product development and software engineering. With Outpost24 he worked with over 2000 organizations globally to help them manage their network, systems and application security. Ron also worked for NTOBJECTives and Whitehat Security to help companies improve their application security programs. Ron joined OWASP in 2013 as the Orange County Chapter Leader and has worked through the chapter to carry out the OWASP mission locally.</div>Ron Perrishttps://wiki.owasp.org/index.php?title=WASPY_Awards_2014&diff=178321WASPY Awards 20142014-07-09T00:08:56Z<p>Ron Perris: Undo revision 178320 by Ron Perris (talk)</p>
<hr />
<div>[[File:WASPY-BANNER-2014.jpg]]<br />
<br />
<br />
<br />
<font size="6">'''Web Application Security People of the Year Awards 2014'''</font><br />
<br />
Every year a group of individuals including researchers, developers, security professionals and others work to ensure the security of web applications. Some of these individuals are featured in news stories or at conferences as recognized experts. But there are many other ‘unsung heroes’ that work every day to improve web application security and yet are rarely recognized. <br />
<br />
<br />
=='''Timeline'''==<br />
<br />
June 10 - Call for Nominees '''Now Open!''' Submit your nominee [http://www.tfaforms.com/284578 here]<br />
<br />
June 23 - Reminder Email Will be Sent For Call for Nominees<br />
<br />
June 30 - Call for Nominees Closes<br />
<br />
July 7 - Announcement of Nominees Per Category<br />
<br />
July 15 - Deadline For Profile Picture and Bio to be Submitted<br />
<br />
July 31 - Paid Membership Deadline - '''NOT SURE IF YOU ARE A CURRENT MEMBER?''' <br />
<br />
August 8 - Voting Opens<br />
<br />
August 26 - Voting Closes<br />
<br />
August 27 - Announcement of Winners<br />
<br />
September 16-19 - Awards Ceremony at AppSecUSA 2014 in Denver, CO<br />
<br />
<br />
=='''Categories'''==<br />
<br />
1. Best Chapter Leader - active chapter leader to be recognized for their contributions to the growth and organization of the chapter.<br />
<br />
2. Best Project Leader - active project leader to be recognized for the development of their project.<br />
<br />
3. Best Mission Outreach - individual who contributed to the growth of the organization through outreach to the community. <br />
<br />
4. Best New Community Supporter "Rookie of the Year" - individual (no requirement to be a leader) who has contributed to any chapter, project, initiative, or other OWASP activity.<br />
<br />
5. Best Platform Supporter - (OWASP Staff Vote) individual who positively contributes to the reinforcement of the OWASP platform.<br />
<br />
=='''Rules:==<br />
<br />
1. Board members can NOT be nominated<br />
<br />
2. Paid staff can NOT be nominated<br />
<br />
3. Must be a paid member to vote.<br />
<br />
4. All nominees will remain anonymous until July 7, 2014<br />
<br />
5. Anyone can nominate any individual<br />
<br />
6. One person per category may be nominated <br />
<br />
=='''Sponsorship Opportunities'''==<br />
The support from our sponsors, is what makes these awards truly successful! To learn more about how you can support these awards please see our [http://owasp.com/images/1/1a/2014_WASPY_Sponsorship_Doc.pdf '''Sponsorship Opportunities'''.]<br />
<br />
'''Become involved and support the WASPY Awards today!'''<br />
<br />
=='''And the Nominees Are...'''==<br />
'''Categories:'''<br />
<br />
*Best Chapter Leader<br />
<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | Chapter <br />
! scope="col" align="center" width="800" | Citation<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Sen Ueno]||align="center"|[https://www.owasp.org/index.php/Japan Japan]||align="center"|"He is OWASP Japan Co-Chapter leader and leading OWASP AppSec APAC."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Riotaro Okada]||align="center"|[https://www.owasp.org/index.php/Japan Japan]||align="center"|"The foundation of the OWASP Japan local chapter, its rapid growth to reaching over 2,000 participants in local chapter meetings in the first 2 years and the massive success of AppSec APAC 2014 in Tokyo would not have been possible without the passion and full commitment to the OWASP cause demonstrated by Rio. He is definitely a role model for the OWASP community, especially in the Asia Pacific region which in general is lacking strong and effective leadership, and there is no doubt in my mind he is the most suited candidate for Best Chapter Leader based on the efforts he's contributed in the past few years as well as the success and results of those efforts." <br />
<br />
<br />
"He holds local chapter meeting(we call OWASP Night), and every event is full capacity and good topics. And he organized successful event, which is OWASP APAC 2014 in this year."<br />
<br />
<br />
"Rio has done an amazing job building up our Japan chapters. <br />
Over the last few years with huge community meetings, new chapters in Japan and a lot of community activity. <br />
This is truely outstanding!"<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User:Ron_Perris Ron Perris]||align="center"|[https://www.owasp.org/index.php/ Orange County]||align="center"|"Ron relaunched the OWASP Orange County Chapter. Grew the chapter leadership organization to five chapter leaders from three. Increased meeting frequency from bi-yearly to monthly. Held 13 meetings in the last twelve months. Attracted 140 new attendees to chapter meetings. Established a culture of vendor neutrality and speaker selection based on merit."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Sebastien Deleersnyder]||align="center"|[https://www.owasp.org/index.php/ Belgium]||align="center"|"He does a lot of work, not only for the chapter meetings but also for the BeNeLux days. He is very approachable and open for suggestions."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Jonathan Marcil]||align="center"|[https://www.owasp.org/index.php/ Montreal]||align="center"|""I would like to nominate Jonathan for his involvement in:<br />
1) Successfully leading the Montreal Chapter. Even when personally absent and traveling on another continent, Jonathan has remotely managed the overall execution of the local chapter meetings.<br />
2) His valuable contribution to the OWASP Media project, that undoubtedly brings the ""O"" of OWASP to audiences unable to attend meetings<br />
3) Jonathan has contributed and invested efforts on the ""outreach"" objective, announced by the board as a core objective for 2013-2014."<br />
|-<br />
|}<br />
<br />
*Best Project Leader<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | Project <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Jeremy Long]||align="center"|[https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency Check]||align="center"|"Reasons Jeremy Long and his Dependency Check deserve a WASPY award:<br />
<br />
- His OWASP Dependency Check is a solution to the problem of third party libraries that needed to be solved. <br />
- Jeremy's work on D.C. is steady. He has put a lot of work into this project<br />
- Jeremy has successfully involved others to help work on the project. It is a model open source project.<br />
- He has been responsive and helpful to questions and created a nice community of users."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Achim Hoffmann]||align="center"|[https://www.owasp.org/index.php/O-Saft OWASP O-Saft]||align="center"|"Achim is the project leader of O-Saft (https://www.owasp.org/index.php/O-Saft). O-Saft is a tool to analyze the SSL configuration of a web or mail server. It is a tool with a very specific focus, not a swiss army knife but there is a need for exactly this tool. Achim started the development at the beginning of the big SSL-crisis (concerns about weak ciphers, cipher orders, perfect forward secrecy, ). Without a specialized tool it is impossible to find out the SSL behaviour of a given server. Achim's interest was focused on facts only. The outcome of the tool is not a subjective rating, score or grade, only facts about the config. Achim goals were exactness, comprehensiveness and impartiality which he achieved with his project. He was open to suggestions and could win additional highly motivated and skilled contributors. He is not a marketing driven project leader instead of that he gives talks and trainings about SSL and O-Saft (Munich Chapter, OWASP AppSec EU 2014 Cambridge) to share his knowledge.<br />
<br />
I would like to nominate Achim for the OWASP Project Leader 2014 because his project fulfills the OWASP mission in a perfect way. It makes the security of SSL servers visible. There is no free avaiblabe tool beside O-Saft with a comparable comprehensive scope and ability to execute. It is completely free of commercial interests or commercial ""added values"", distributed under a GPL."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Tokuji Akamine]||align="center"|[https://www.owasp.org/index.php/OWASP_XSecurity_Project OWASP XSecurity Project]||align="center"|"The idea(feature) of this security tool is excellent, especially these two points below.<br />
Usually security is difficult and burdensome. But this security tool makes security much easier and less burdensome to iOS app developers.<br />
1. Provide developer friendly security features on top of Xcode to assist developers to learn iOS app security.(Quick Security Help with built-in Security Guidelines)<br />
2. Avoid making vulnerabilities during development.(Real-time Vulnerability Notifications)"<br />
<br />
<br />
"He provides to assist iOS developers to develop secure iOS apps and a security plugin for Xcode plus clang static analyzer checkers for iOS application development. This plugin will be to reduce the vulnerability made during development by detecting the vulnerability."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Matteo Meucci]||align="center"|[https://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Project]||align="center"|"Matteo collaborates in OWASP from 2002.He founded the Italian Chapter in 2005.He candidates for the Autum of Code in 2006 to start a new project regarding the Testing Guide. He leads the OWASP Testing from 2006 (v2) to now with the publishing of Testing Guide v4 in the next weeks. He was capable to attract and manage more than 50 people to create the new Guide. Nowadays the Testing Guide is the most recognized project of OWASP with great contents and high quality delivery."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: John Melton]||align="center"|[https://www.owasp.org/index.php/OWASP_AppSensor OWASP AppSensor]||align="center"|"John has working tirelessly, and mostly invisible behind the scenes in developing the OWASP AppSensor project. While others have lead the charge on the OWASP AppSensor documentation project, for the most part, John has been the sole contributor to the OWASP AppSensor source code."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Spyros Gasteratos]||align="center"|[https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project OWASP Hackademic Challenges Project]||align="center"|"Spyros has been involved in OWASP since 2010, contributing more and more time as years go by. He began by volunteering for OWASP AppSec Research 2012, where he was in charge for coordinating a team of more than 20 volunteers. For the past 1.5 year he as been co-leading the OWASP Hackademic Challenges Project. During that time he has managed to take the project into the next level both by producing code and by mentoring GSOC students. Spyros has spent a tremendous amount of time in coding, fixing bugs, setting up and maintaining a live version of Hackademic. Undoubtedly, without his efforts the project would have become dormant.Furthermore, he is also helping in other OWASP initiatives, e.g. by participating in the Open Source Showcase, presenting Hackademic and OWASP at the FOSDEM conference in Belgium and by setting up the new ""OWASP Code Wind"" project that aims to bring more student contributions to OWASP."<br />
|-<br />
|}<br />
<br />
*Best Mission Outreach<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Mostafa Siraj]||align="center"|[https://www.owasp.org/index.php/Cairo Cairo Chapter]||align="center"|"Mostafa did a great job helping our chapter (Cairo Chapter), here are summary of his contribution: - He had a great talk in the latest chapter event, he talk about AppSec US summarizing the conference technical sessions (Mostafa attended the 2013 conference and won the technical competition there), - Mostafa is one of the main members of a small group of AppSec expertise from Cairo chapter, this group is engaged now for preparing security awareness training program for all governmental developers in Egypt, I highly recommend him,"<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Jonathan Marcil]||align="center"|[https://www.owasp.org/index.php/Category:OWASP_Video OWASP Videos]||align="center"|"Because he is helping spread OWASP message through this videos and live streaming events"<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: AppSecUSA2013 Team]||align="center"|[http://2013.appsecusa.org/ AppSecUSA 2013 Team]||align="center"|<br />
|}<br />
<br />
*Best New Community Supporter<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: AppSec APAC 2014 Team]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=TEAM AppSec Asia Pac 2014]||align="center"|"Despite it being the first time that AppSec was held in Japan and despite the lack of experience in planning and organizing a large scale international conference, the volunteers on the AppSec APAC 2014 team came together and went above and beyond their responsibilities to make AppSec APAC 2014 in Tokyo a stunning success. It was by far the most successful AppSec in the Asia Pacific region and achieved an unprecedented level of profitability. The vast majority of the sponsors were Japanese companies and many of the attendees were Japanese. The ability to achieve this despite the relatively low level of awareness of the OWASP brand in Japan was definitely due to the hard work and dedication of the AppSec APAC 2014 team who worked around the clock to make the event a success. Considering that there were no applicants to hold AppSec APAC 2015 despite the tremendous success in Tokyo, recognizing the contributions of the AppSec APAC 2015 team would definitely give a strong message motivating the Asia Pacific community and facilitate future OWASP initiatives in the region."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Robert Dracea]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=WELCOME AppSec Asia Pac 2014] [https://www.owasp.org/index.php/Japan Japan]||align="center"|"His contribution has been excellent, since we have started preparation for the Global AppSec APAC2014. Based on his passion to promote valuable information regards to information security in Japan, he contributed his bilingual ability to prepare and preside AppSec APAC in Tokyo. He committed the local committee by attended every weekly meeting for more than 9 months from his office and his home. Surely, thanks to his help, potential language barrier were completely broken in the conference. This experience of us will be a good example for OWASP organizers especially in Asia Pacific area."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Takanori Nakanowatari]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=TEAM AppSec Asia Pac 2014][https://www.owasp.org/index.php/Japan Japan]||align="center"|"His contribution has been awesome, since we have started preparation for the Global AppSec APAC2014. His experience which attended a few AppSecs were very helpful to organize the newly AppSec in Tokyo, and he committee the local committee by attended every weekly meeting for more than 9 months from his office and his home. Moreover, thanks to his advice, 2 OWASP ZAP evangelists were born in Japan at the timing of AppSec APAC 2014."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Beth Guth]||align="center"|[https://www.owasp.org/index.php/New_Jersey_South South New Jersey]||align="center"|"She started South New Jersey chapter with energy and enthusiasm bringing together people from builders, breakers and defenders. Self-starter"<br />
|-</div>Ron Perrishttps://wiki.owasp.org/index.php?title=WASPY_Awards_2014&diff=178320WASPY Awards 20142014-07-09T00:06:39Z<p>Ron Perris: </p>
<hr />
<div>[[File:WASPY-BANNER-2014.jpg]]<br />
<br />
<br />
<br />
<font size="6">'''Web Application Security People of the Year Awards 2014'''</font><br />
<br />
Every year a group of individuals including researchers, developers, security professionals and others work to ensure the security of web applications. Some of these individuals are featured in news stories or at conferences as recognized experts. But there are many other ‘unsung heroes’ that work every day to improve web application security and yet are rarely recognized. <br />
<br />
<br />
=='''Timeline'''==<br />
<br />
June 10 - Call for Nominees '''Now Open!''' Submit your nominee [http://www.tfaforms.com/284578 here]<br />
<br />
June 23 - Reminder Email Will be Sent For Call for Nominees<br />
<br />
June 30 - Call for Nominees Closes<br />
<br />
July 7 - Announcement of Nominees Per Category<br />
<br />
July 15 - Deadline For Profile Picture and Bio to be Submitted<br />
<br />
July 31 - Paid Membership Deadline - '''NOT SURE IF YOU ARE A CURRENT MEMBER?''' <br />
<br />
August 8 - Voting Opens<br />
<br />
August 26 - Voting Closes<br />
<br />
August 27 - Announcement of Winners<br />
<br />
September 16-19 - Awards Ceremony at AppSecUSA 2014 in Denver, CO<br />
<br />
<br />
=='''Categories'''==<br />
<br />
1. Best Chapter Leader - active chapter leader to be recognized for their contributions to the growth and organization of the chapter.<br />
<br />
2. Best Project Leader - active project leader to be recognized for the development of their project.<br />
<br />
3. Best Mission Outreach - individual who contributed to the growth of the organization through outreach to the community. <br />
<br />
4. Best New Community Supporter "Rookie of the Year" - individual (no requirement to be a leader) who has contributed to any chapter, project, initiative, or other OWASP activity.<br />
<br />
5. Best Platform Supporter - (OWASP Staff Vote) individual who positively contributes to the reinforcement of the OWASP platform.<br />
<br />
=='''Rules:==<br />
<br />
1. Board members can NOT be nominated<br />
<br />
2. Paid staff can NOT be nominated<br />
<br />
3. Must be a paid member to vote.<br />
<br />
4. All nominees will remain anonymous until July 7, 2014<br />
<br />
5. Anyone can nominate any individual<br />
<br />
6. One person per category may be nominated <br />
<br />
=='''Sponsorship Opportunities'''==<br />
The support from our sponsors, is what makes these awards truly successful! To learn more about how you can support these awards please see our [http://owasp.com/images/1/1a/2014_WASPY_Sponsorship_Doc.pdf '''Sponsorship Opportunities'''.]<br />
<br />
'''Become involved and support the WASPY Awards today!'''<br />
<br />
=='''And the Nominees Are...'''==<br />
'''Categories:'''<br />
<br />
*Best Chapter Leader<br />
<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | Chapter <br />
! scope="col" align="center" width="800" | Citation<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Sen Ueno]||align="center"|[https://www.owasp.org/index.php/Japan Japan]||align="center"|"He is OWASP Japan Co-Chapter leader and leading OWASP AppSec APAC."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Riotaro Okada]||align="center"|[https://www.owasp.org/index.php/Japan Japan]||align="center"|"The foundation of the OWASP Japan local chapter, its rapid growth to reaching over 2,000 participants in local chapter meetings in the first 2 years and the massive success of AppSec APAC 2014 in Tokyo would not have been possible without the passion and full commitment to the OWASP cause demonstrated by Rio. He is definitely a role model for the OWASP community, especially in the Asia Pacific region which in general is lacking strong and effective leadership, and there is no doubt in my mind he is the most suited candidate for Best Chapter Leader based on the efforts he's contributed in the past few years as well as the success and results of those efforts." <br />
<br />
<br />
"He holds local chapter meeting(we call OWASP Night), and every event is full capacity and good topics. And he organized successful event, which is OWASP APAC 2014 in this year."<br />
<br />
<br />
"Rio has done an amazing job building up our Japan chapters. <br />
Over the last few years with huge community meetings, new chapters in Japan and a lot of community activity. <br />
This is truely outstanding!"<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User:Ron_Perris]||align="center"|[https://www.owasp.org/index.php/ Orange County]||align="center"|"Ron relaunched the OWASP Orange County Chapter. Grew the chapter leadership organization to five chapter leaders from three. Increased meeting frequency from bi-yearly to monthly. Held 13 meetings in the last twelve months. Attracted 140 new attendees to chapter meetings. Established a culture of vendor neutrality and speaker selection based on merit."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Sebastien Deleersnyder]||align="center"|[https://www.owasp.org/index.php/ Belgium]||align="center"|"He does a lot of work, not only for the chapter meetings but also for the BeNeLux days. He is very approachable and open for suggestions."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Jonathan Marcil]||align="center"|[https://www.owasp.org/index.php/ Montreal]||align="center"|""I would like to nominate Jonathan for his involvement in:<br />
1) Successfully leading the Montreal Chapter. Even when personally absent and traveling on another continent, Jonathan has remotely managed the overall execution of the local chapter meetings.<br />
2) His valuable contribution to the OWASP Media project, that undoubtedly brings the ""O"" of OWASP to audiences unable to attend meetings<br />
3) Jonathan has contributed and invested efforts on the ""outreach"" objective, announced by the board as a core objective for 2013-2014."<br />
|-<br />
|}<br />
<br />
*Best Project Leader<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | Project <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Jeremy Long]||align="center"|[https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency Check]||align="center"|"Reasons Jeremy Long and his Dependency Check deserve a WASPY award:<br />
<br />
- His OWASP Dependency Check is a solution to the problem of third party libraries that needed to be solved. <br />
- Jeremy's work on D.C. is steady. He has put a lot of work into this project<br />
- Jeremy has successfully involved others to help work on the project. It is a model open source project.<br />
- He has been responsive and helpful to questions and created a nice community of users."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Achim Hoffmann]||align="center"|[https://www.owasp.org/index.php/O-Saft OWASP O-Saft]||align="center"|"Achim is the project leader of O-Saft (https://www.owasp.org/index.php/O-Saft). O-Saft is a tool to analyze the SSL configuration of a web or mail server. It is a tool with a very specific focus, not a swiss army knife but there is a need for exactly this tool. Achim started the development at the beginning of the big SSL-crisis (concerns about weak ciphers, cipher orders, perfect forward secrecy, ). Without a specialized tool it is impossible to find out the SSL behaviour of a given server. Achim's interest was focused on facts only. The outcome of the tool is not a subjective rating, score or grade, only facts about the config. Achim goals were exactness, comprehensiveness and impartiality which he achieved with his project. He was open to suggestions and could win additional highly motivated and skilled contributors. He is not a marketing driven project leader instead of that he gives talks and trainings about SSL and O-Saft (Munich Chapter, OWASP AppSec EU 2014 Cambridge) to share his knowledge.<br />
<br />
I would like to nominate Achim for the OWASP Project Leader 2014 because his project fulfills the OWASP mission in a perfect way. It makes the security of SSL servers visible. There is no free avaiblabe tool beside O-Saft with a comparable comprehensive scope and ability to execute. It is completely free of commercial interests or commercial ""added values"", distributed under a GPL."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Tokuji Akamine]||align="center"|[https://www.owasp.org/index.php/OWASP_XSecurity_Project OWASP XSecurity Project]||align="center"|"The idea(feature) of this security tool is excellent, especially these two points below.<br />
Usually security is difficult and burdensome. But this security tool makes security much easier and less burdensome to iOS app developers.<br />
1. Provide developer friendly security features on top of Xcode to assist developers to learn iOS app security.(Quick Security Help with built-in Security Guidelines)<br />
2. Avoid making vulnerabilities during development.(Real-time Vulnerability Notifications)"<br />
<br />
<br />
"He provides to assist iOS developers to develop secure iOS apps and a security plugin for Xcode plus clang static analyzer checkers for iOS application development. This plugin will be to reduce the vulnerability made during development by detecting the vulnerability."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Matteo Meucci]||align="center"|[https://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Project]||align="center"|"Matteo collaborates in OWASP from 2002.He founded the Italian Chapter in 2005.He candidates for the Autum of Code in 2006 to start a new project regarding the Testing Guide. He leads the OWASP Testing from 2006 (v2) to now with the publishing of Testing Guide v4 in the next weeks. He was capable to attract and manage more than 50 people to create the new Guide. Nowadays the Testing Guide is the most recognized project of OWASP with great contents and high quality delivery."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: John Melton]||align="center"|[https://www.owasp.org/index.php/OWASP_AppSensor OWASP AppSensor]||align="center"|"John has working tirelessly, and mostly invisible behind the scenes in developing the OWASP AppSensor project. While others have lead the charge on the OWASP AppSensor documentation project, for the most part, John has been the sole contributor to the OWASP AppSensor source code."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Spyros Gasteratos]||align="center"|[https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project OWASP Hackademic Challenges Project]||align="center"|"Spyros has been involved in OWASP since 2010, contributing more and more time as years go by. He began by volunteering for OWASP AppSec Research 2012, where he was in charge for coordinating a team of more than 20 volunteers. For the past 1.5 year he as been co-leading the OWASP Hackademic Challenges Project. During that time he has managed to take the project into the next level both by producing code and by mentoring GSOC students. Spyros has spent a tremendous amount of time in coding, fixing bugs, setting up and maintaining a live version of Hackademic. Undoubtedly, without his efforts the project would have become dormant.Furthermore, he is also helping in other OWASP initiatives, e.g. by participating in the Open Source Showcase, presenting Hackademic and OWASP at the FOSDEM conference in Belgium and by setting up the new ""OWASP Code Wind"" project that aims to bring more student contributions to OWASP."<br />
|-<br />
|}<br />
<br />
*Best Mission Outreach<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Mostafa Siraj]||align="center"|[https://www.owasp.org/index.php/Cairo Cairo Chapter]||align="center"|"Mostafa did a great job helping our chapter (Cairo Chapter), here are summary of his contribution: - He had a great talk in the latest chapter event, he talk about AppSec US summarizing the conference technical sessions (Mostafa attended the 2013 conference and won the technical competition there), - Mostafa is one of the main members of a small group of AppSec expertise from Cairo chapter, this group is engaged now for preparing security awareness training program for all governmental developers in Egypt, I highly recommend him,"<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Jonathan Marcil]||align="center"|[https://www.owasp.org/index.php/Category:OWASP_Video OWASP Videos]||align="center"|"Because he is helping spread OWASP message through this videos and live streaming events"<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: AppSecUSA2013 Team]||align="center"|[http://2013.appsecusa.org/ AppSecUSA 2013 Team]||align="center"|<br />
|}<br />
<br />
*Best New Community Supporter<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: AppSec APAC 2014 Team]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=TEAM AppSec Asia Pac 2014]||align="center"|"Despite it being the first time that AppSec was held in Japan and despite the lack of experience in planning and organizing a large scale international conference, the volunteers on the AppSec APAC 2014 team came together and went above and beyond their responsibilities to make AppSec APAC 2014 in Tokyo a stunning success. It was by far the most successful AppSec in the Asia Pacific region and achieved an unprecedented level of profitability. The vast majority of the sponsors were Japanese companies and many of the attendees were Japanese. The ability to achieve this despite the relatively low level of awareness of the OWASP brand in Japan was definitely due to the hard work and dedication of the AppSec APAC 2014 team who worked around the clock to make the event a success. Considering that there were no applicants to hold AppSec APAC 2015 despite the tremendous success in Tokyo, recognizing the contributions of the AppSec APAC 2015 team would definitely give a strong message motivating the Asia Pacific community and facilitate future OWASP initiatives in the region."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Robert Dracea]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=WELCOME AppSec Asia Pac 2014] [https://www.owasp.org/index.php/Japan Japan]||align="center"|"His contribution has been excellent, since we have started preparation for the Global AppSec APAC2014. Based on his passion to promote valuable information regards to information security in Japan, he contributed his bilingual ability to prepare and preside AppSec APAC in Tokyo. He committed the local committee by attended every weekly meeting for more than 9 months from his office and his home. Surely, thanks to his help, potential language barrier were completely broken in the conference. This experience of us will be a good example for OWASP organizers especially in Asia Pacific area."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Takanori Nakanowatari]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=TEAM AppSec Asia Pac 2014][https://www.owasp.org/index.php/Japan Japan]||align="center"|"His contribution has been awesome, since we have started preparation for the Global AppSec APAC2014. His experience which attended a few AppSecs were very helpful to organize the newly AppSec in Tokyo, and he committee the local committee by attended every weekly meeting for more than 9 months from his office and his home. Moreover, thanks to his advice, 2 OWASP ZAP evangelists were born in Japan at the timing of AppSec APAC 2014."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Beth Guth]||align="center"|[https://www.owasp.org/index.php/New_Jersey_South South New Jersey]||align="center"|"She started South New Jersey chapter with energy and enthusiasm bringing together people from builders, breakers and defenders. Self-starter"<br />
|-</div>Ron Perrishttps://wiki.owasp.org/index.php?title=User:Ron_Perris&diff=178319User:Ron Perris2014-07-09T00:01:45Z<p>Ron Perris: </p>
<hr />
<div>== Involvement in OWASP ==<br />
<br />
* Relaunched the OWASP Orange County Chapter.<br />
** Grew the chapter leadership organization to five chapter leaders from three. <br />
** Increased meeting frequency from bi-yearly to monthly. <br />
** Held 13 meetings in the last twelve months. <br />
** Attracted 140 new attendees to chapter meetings. <br />
** Established a culture of vendor neutrality and speakers selection based on merit<br />
<br />
* Helped Organize [https://2014.appseccalifornia.org/ AppSecCalifornia 2013] along with OWASP OC Organizers and other California OWASP Chapters<br />
** Attracted Speakers to Call-for-Papers<br />
** Worked with OWASP team to Setup Vendor Room<br />
** Performed Registration and Information Desk Duty<br />
<br />
== Current Projects ==<br />
* OWASP Secure Coding for Charity Project in Orange County<br />
* OWASP Orange County Capture the Flag Challenge<br />
<br />
== Contact Info ==<br />
* Email: ron.perris@owasp.org<br />
* [http://www.meetup.com/OWASP-OC/ OWASP OC Meetings]<br />
* [https://www.linkedin.com/in/ronperris Linkedin]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=WASPY_Awards_2014&diff=178105WASPY Awards 20142014-07-07T16:20:58Z<p>Ron Perris: </p>
<hr />
<div>[[File:WASPY-BANNER-2014.jpg]]<br />
<br />
<br />
<br />
<font size="6">'''Web Application Security People of the Year Awards 2014'''</font><br />
<br />
Every year a group of individuals including researchers, developers, security professionals and others work to ensure the security of web applications. Some of these individuals are featured in news stories or at conferences as recognized experts. But there are many other ‘unsung heroes’ that work every day to improve web application security and yet are rarely recognized. <br />
<br />
<br />
=='''Timeline'''==<br />
<br />
June 10 - Call for Nominees '''Now Open!''' Submit your nominee [http://www.tfaforms.com/284578 here]<br />
<br />
June 23 - Reminder Email Will be Sent For Call for Nominees<br />
<br />
June 30 - Call for Nominees Closes<br />
<br />
July 7 - Announcement of Nominees Per Category<br />
<br />
July 15 - Deadline For Profile Picture and Bio to be Submitted<br />
<br />
July 31 - Paid Membership Deadline - '''NOT SURE IF YOU ARE A CURRENT MEMBER?''' <br />
<br />
August 8 - Voting Opens<br />
<br />
August 26 - Voting Closes<br />
<br />
August 27 - Announcement of Winners<br />
<br />
September 16-19 - Awards Ceremony at AppSecUSA 2014 in Denver, CO<br />
<br />
<br />
=='''Categories'''==<br />
<br />
1. Best Chapter Leader - active chapter leader to be recognized for their contributions to the growth and organization of the chapter.<br />
<br />
2. Best Project Leader - active project leader to be recognized for the development of their project.<br />
<br />
3. Best Mission Outreach - individual who contributed to the growth of the organization through outreach to the community. <br />
<br />
4. Best New Community Supporter "Rookie of the Year" - individual (no requirement to be a leader) who has contributed to any chapter, project, initiative, or other OWASP activity.<br />
<br />
5. Best Platform Supporter - (OWASP Staff Vote) individual who positively contributes to the reinforcement of the OWASP platform.<br />
<br />
=='''Rules:==<br />
<br />
1. Board members can NOT be nominated<br />
<br />
2. Paid staff can NOT be nominated<br />
<br />
3. Must be a paid member to vote.<br />
<br />
4. All nominees will remain anonymous until July 7, 2014<br />
<br />
5. Anyone can nominate any individual<br />
<br />
6. One person per category may be nominated <br />
<br />
=='''Sponsorship Opportunities'''==<br />
The support from our sponsors, is what makes these awards truly successful! To learn more about how you can support these awards please see our [http://owasp.com/images/1/1a/2014_WASPY_Sponsorship_Doc.pdf '''Sponsorship Opportunities'''.]<br />
<br />
'''Become involved and support the WASPY Awards today!'''<br />
<br />
=='''And the Nominees Are...'''==<br />
'''Categories:'''<br />
<br />
*Best Chapter Leader<br />
<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | Chapter <br />
! scope="col" align="center" width="800" | Citation<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Sen Ueno]||align="center"|[https://www.owasp.org/index.php/Japan Japan]||align="center"|"He is OWASP Japan Co-Chapter leader and leading OWASP AppSec APAC."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User:Brennan Tom Brennan]||align="center"|[https://www.owasp.org/index.php/ New York City]||align="center"|"Tom Brennan has consistently invested the time and effort into making the NYC chapter one of the best organizations to which I belong. Due to Tom's hard work there are regular chapter meetings with great speakers from whom to learn cutting edge techniques, free food, non-pushy sponsors, and networking opportunities. His passion for the industry, desire to make a difference, and inclusiveness comes through when you hear him speak at any chapter event. When I speak with colleagues in other OWASP chapters and other organizations (ISSA, ISACA, Infragard, Secret Service Electronic Crimes Task Force, etc.), they are amazed at the quantity and quality of OWASP NYC chapter events. This is why I think Tom Brennan deserves to be recognized as the Best Chapter Leader."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Riotaro Okada]||align="center"|[https://www.owasp.org/index.php/Japan Japan]||align="center"|"The foundation of the OWASP Japan local chapter, its rapid growth to reaching over 2,000 participants in local chapter meetings in the first 2 years and the massive success of AppSec APAC 2014 in Tokyo would not have been possible without the passion and full commitment to the OWASP cause demonstrated by Rio. He is definitely a role model for the OWASP community, especially in the Asia Pacific region which in general is lacking strong and effective leadership, and there is no doubt in my mind he is the most suited candidate for Best Chapter Leader based on the efforts he's contributed in the past few years as well as the success and results of those efforts." <br />
<br />
<br />
"He holds local chapter meeting(we call OWASP Night), and every event is full capacity and good topics. And he organized successful event, which is OWASP APAC 2014 in this year."<br />
<br />
<br />
"Rio has done an amazing job building up our Japan chapters. <br />
Over the last few years with huge community meetings, new chapters in Japan and a lot of community activity. <br />
This is truely outstanding!"<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Ron Perris]||align="center"|[https://www.owasp.org/index.php/ Orange County]||align="center"|"Ron relaunched the OWASP Orange County Chapter. Grew the chapter leadership organization to five chapter leaders from three. Increased meeting frequency from bi-yearly to monthly. Held 13 meetings in the last twelve months. Attracted 140 new attendees to chapter meetings. Established a culture of vendor neutrality and speaker selection based on merit."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Sebastien Deleersnyder]||align="center"|[https://www.owasp.org/index.php/ Belgium]||align="center"|"He does a lot of work, not only for the chapter meetings but also for the BeNeLux days. He is very approachable and open for suggestions."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Jonathan Marcil]||align="center"|[https://www.owasp.org/index.php/ Montreal]||align="center"|""I would like to nominate Jonathan for his involvement in:<br />
1) Successfully leading the Montreal Chapter. Even when personally absent and traveling on another continent, Jonathan has remotely managed the overall execution of the local chapter meetings.<br />
2) His valuable contribution to the OWASP Media project, that undoubtedly brings the ""O"" of OWASP to audiences unable to attend meetings<br />
3) Jonathan has contributed and invested efforts on the ""outreach"" objective, announced by the board as a core objective for 2013-2014."<br />
|-<br />
|}<br />
<br />
*Best Project Leader<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | Project <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Jeremy Long]||align="center"|[https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency Check]||align="center"|"Reasons Jeremy Long and his Dependency Check deserve a WASPY award:<br />
<br />
- His OWASP Dependency Check is a solution to the problem of third party libraries that needed to be solved. <br />
- Jeremy's work on D.C. is steady. He has put a lot of work into this project<br />
- Jeremy has successfully involved others to help work on the project. It is a model open source project.<br />
- He has been responsive and helpful to questions and created a nice community of users."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Achim Hoffmann]||align="center"|[https://www.owasp.org/index.php/O-Saft OWASP O-Saft]||align="center"|"Achim is the project leader of O-Saft (https://www.owasp.org/index.php/O-Saft). O-Saft is a tool to analyze the SSL configuration of a web or mail server. It is a tool with a very specific focus, not a swiss army knife but there is a need for exactly this tool. Achim started the development at the beginning of the big SSL-crisis (concerns about weak ciphers, cipher orders, perfect forward secrecy, ). Without a specialized tool it is impossible to find out the SSL behaviour of a given server. Achim's interest was focused on facts only. The outcome of the tool is not a subjective rating, score or grade, only facts about the config. Achim goals were exactness, comprehensiveness and impartiality which he achieved with his project. He was open to suggestions and could win additional highly motivated and skilled contributors. He is not a marketing driven project leader instead of that he gives talks and trainings about SSL and O-Saft (Munich Chapter, OWASP AppSec EU 2014 Cambridge) to share his knowledge.<br />
<br />
I would like to nominate Achim for the OWASP Project Leader 2014 because his project fulfills the OWASP mission in a perfect way. It makes the security of SSL servers visible. There is no free avaiblabe tool beside O-Saft with a comparable comprehensive scope and ability to execute. It is completely free of commercial interests or commercial ""added values"", distributed under a GPL."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Tokuji Akamine]||align="center"|[https://www.owasp.org/index.php/OWASP_XSecurity_Project OWASP XSecurity Project]||align="center"|"The idea(feature) of this security tool is excellent, especially these two points below.<br />
Usually security is difficult and burdensome. But this security tool makes security much easier and less burdensome to iOS app developers.<br />
1. Provide developer friendly security features on top of Xcode to assist developers to learn iOS app security.(Quick Security Help with built-in Security Guidelines)<br />
2. Avoid making vulnerabilities during development.(Real-time Vulnerability Notifications)"<br />
<br />
<br />
"He provides to assist iOS developers to develop secure iOS apps and a security plugin for Xcode plus clang static analyzer checkers for iOS application development. This plugin will be to reduce the vulnerability made during development by detecting the vulnerability."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Matteo Meucci]||align="center"|[https://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Project]||align="center"|"Matteo collaborates in OWASP from 2002.He founded the Italian Chapter in 2005.He candidates for the Autum of Code in 2006 to start a new project regarding the Testing Guide. He leads the OWASP Testing from 2006 (v2) to now with the publishing of Testing Guide v4 in the next weeks. He was capable to attract and manage more than 50 people to create the new Guide. Nowadays the Testing Guide is the most recognized project of OWASP with great contents and high quality delivery."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: John Melton]||align="center"|[https://www.owasp.org/index.php/OWASP_AppSensor OWASP AppSensor]||align="center"|"John has working tirelessly, and mostly invisible behind the scenes in developing the OWASP AppSensor project. While others have lead the charge on the OWASP AppSensor documentation project, for the most part, John has been the sole contributor to the OWASP AppSensor source code."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Spyros Gasteratos]||align="center"|[https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project OWASP Hackademic Challenges Project]||align="center"|"Spyros has been involved in OWASP since 2010, contributing more and more time as years go by. He began by volunteering for OWASP AppSec Research 2012, where he was in charge for coordinating a team of more than 20 volunteers. For the past 1.5 year he as been co-leading the OWASP Hackademic Challenges Project. During that time he has managed to take the project into the next level both by producing code and by mentoring GSOC students. Spyros has spent a tremendous amount of time in coding, fixing bugs, setting up and maintaining a live version of Hackademic. Undoubtedly, without his efforts the project would have become dormant.Furthermore, he is also helping in other OWASP initiatives, e.g. by participating in the Open Source Showcase, presenting Hackademic and OWASP at the FOSDEM conference in Belgium and by setting up the new ""OWASP Code Wind"" project that aims to bring more student contributions to OWASP."<br />
|-<br />
|}<br />
<br />
*Best Mission Outreach<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User:Brennan Tom Brennan]||align="center"|[https://www.owasp.org/index.php/NYC New York City][https://www.owasp.org/index.php/AppSecUSA_2013 AppSecUSA 2013]||align="center"|"Tom has worked very hard and exceptionally successful on bring OWASP to the community in his role as chapter lead for NYC and running the biggest and most successful AppSecUS in all times. With exceptionally strong local chapter meetings in NY area."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Mostafa Siraj]||align="center"|[https://www.owasp.org/index.php/Cairo Cairo Chapter]||align="center"|"Mostafa did a great job helping our chapter (Cairo Chapter), here are summary of his contribution: - He had a great talk in the latest chapter event, he talk about AppSec US summarizing the conference technical sessions (Mostafa attended the 2013 conference and won the technical competition there), - Mostafa is one of the main members of a small group of AppSec expertise from Cairo chapter, this group is engaged now for preparing security awareness training program for all governmental developers in Egypt, I highly recommend him,"<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Jonathan Marcil]||align="center"|[https://www.owasp.org/index.php/Category:OWASP_Video OWASP Videos]||align="center"|"Because he is helping spread OWASP message through this videos and live streaming events"<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Eoin Keary]||align="center"|[http://owasp.com/index.php/Projects_Reboot_2012 Project 2012 Reboot]||align="center"|"Eoin has had a busy year: Said NO to RSA and took a stand against erosion of software security. Donated training to OWASP and delivered training to 100's of people. Raised funds via Project Reboot to help many projects."<br />
|-<br />
|}<br />
<br />
*Best New Community Supporter<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: AppSec APAC 2014 Team]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=TEAM AppSec Asia Pac 2014]||align="center"|"Despite it being the first time that AppSec was held in Japan and despite the lack of experience in planning and organizing a large scale international conference, the volunteers on the AppSec APAC 2014 team came together and went above and beyond their responsibilities to make AppSec APAC 2014 in Tokyo a stunning success. It was by far the most successful AppSec in the Asia Pacific region and achieved an unprecedented level of profitability. The vast majority of the sponsors were Japanese companies and many of the attendees were Japanese. The ability to achieve this despite the relatively low level of awareness of the OWASP brand in Japan was definitely due to the hard work and dedication of the AppSec APAC 2014 team who worked around the clock to make the event a success. Considering that there were no applicants to hold AppSec APAC 2015 despite the tremendous success in Tokyo, recognizing the contributions of the AppSec APAC 2015 team would definitely give a strong message motivating the Asia Pacific community and facilitate future OWASP initiatives in the region."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Robert Dracea]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=WELCOME AppSec Asia Pac 2014] [https://www.owasp.org/index.php/Japan Japan]||align="center"|"His contribution has been excellent, since we have started preparation for the Global AppSec APAC2014. Based on his passion to promote valuable information regards to information security in Japan, he contributed his bilingual ability to prepare and preside AppSec APAC in Tokyo. He committed the local committee by attended every weekly meeting for more than 9 months from his office and his home. Surely, thanks to his help, potential language barrier were completely broken in the conference. This experience of us will be a good example for OWASP organizers especially in Asia Pacific area."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Takanori Nakanowatari]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=TEAM AppSec Asia Pac 2014][https://www.owasp.org/index.php/Japan Japan]||align="center"|"His contribution has been awesome, since we have started preparation for the Global AppSec APAC2014. His experience which attended a few AppSecs were very helpful to organize the newly AppSec in Tokyo, and he committee the local committee by attended every weekly meeting for more than 9 months from his office and his home. Moreover, thanks to his advice, 2 OWASP ZAP evangelists were born in Japan at the timing of AppSec APAC 2014."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Beth Guth]||align="center"|[https://www.owasp.org/index.php/New_Jersey_South South New Jersey]||align="center"|"She started South New Jersey chapter with energy and enthusiasm bringing together people from builders, breakers and defenders. Self-starter"<br />
|-</div>Ron Perrishttps://wiki.owasp.org/index.php?title=WASPY_Awards_2014&diff=178104WASPY Awards 20142014-07-07T16:18:44Z<p>Ron Perris: Fixed typo and updated Citation.</p>
<hr />
<div>[[File:WASPY-BANNER-2014.jpg]]<br />
<br />
<br />
<br />
<font size="6">'''Web Application Security People of the Year Awards 2014'''</font><br />
<br />
Every year a group of individuals including researchers, developers, security professionals and others work to ensure the security of web applications. Some of these individuals are featured in news stories or at conferences as recognized experts. But there are many other ‘unsung heroes’ that work every day to improve web application security and yet are rarely recognized. <br />
<br />
<br />
=='''Timeline'''==<br />
<br />
June 10 - Call for Nominees '''Now Open!''' Submit your nominee [http://www.tfaforms.com/284578 here]<br />
<br />
June 23 - Reminder Email Will be Sent For Call for Nominees<br />
<br />
June 30 - Call for Nominees Closes<br />
<br />
July 7 - Announcement of Nominees Per Category<br />
<br />
July 15 - Deadline For Profile Picture and Bio to be Submitted<br />
<br />
July 31 - Paid Membership Deadline - '''NOT SURE IF YOU ARE A CURRENT MEMBER?''' <br />
<br />
August 8 - Voting Opens<br />
<br />
August 26 - Voting Closes<br />
<br />
August 27 - Announcement of Winners<br />
<br />
September 16-19 - Awards Ceremony at AppSecUSA 2014 in Denver, CO<br />
<br />
<br />
=='''Categories'''==<br />
<br />
1. Best Chapter Leader - active chapter leader to be recognized for their contributions to the growth and organization of the chapter.<br />
<br />
2. Best Project Leader - active project leader to be recognized for the development of their project.<br />
<br />
3. Best Mission Outreach - individual who contributed to the growth of the organization through outreach to the community. <br />
<br />
4. Best New Community Supporter "Rookie of the Year" - individual (no requirement to be a leader) who has contributed to any chapter, project, initiative, or other OWASP activity.<br />
<br />
5. Best Platform Supporter - (OWASP Staff Vote) individual who positively contributes to the reinforcement of the OWASP platform.<br />
<br />
=='''Rules:==<br />
<br />
1. Board members can NOT be nominated<br />
<br />
2. Paid staff can NOT be nominated<br />
<br />
3. Must be a paid member to vote.<br />
<br />
4. All nominees will remain anonymous until July 7, 2014<br />
<br />
5. Anyone can nominate any individual<br />
<br />
6. One person per category may be nominated <br />
<br />
=='''Sponsorship Opportunities'''==<br />
The support from our sponsors, is what makes these awards truly successful! To learn more about how you can support these awards please see our [http://owasp.com/images/1/1a/2014_WASPY_Sponsorship_Doc.pdf '''Sponsorship Opportunities'''.]<br />
<br />
'''Become involved and support the WASPY Awards today!'''<br />
<br />
=='''And the Nominees Are...'''==<br />
'''Categories:'''<br />
<br />
*Best Chapter Leader<br />
<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | Chapter <br />
! scope="col" align="center" width="800" | Citation<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Sen Ueno]||align="center"|[https://www.owasp.org/index.php/Japan Japan]||align="center"|"He is OWASP Japan Co-Chapter leader and leading OWASP AppSec APAC."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User:Brennan Tom Brennan]||align="center"|[https://www.owasp.org/index.php/ New York City]||align="center"|"Tom Brennan has consistently invested the time and effort into making the NYC chapter one of the best organizations to which I belong. Due to Tom's hard work there are regular chapter meetings with great speakers from whom to learn cutting edge techniques, free food, non-pushy sponsors, and networking opportunities. His passion for the industry, desire to make a difference, and inclusiveness comes through when you hear him speak at any chapter event. When I speak with colleagues in other OWASP chapters and other organizations (ISSA, ISACA, Infragard, Secret Service Electronic Crimes Task Force, etc.), they are amazed at the quantity and quality of OWASP NYC chapter events. This is why I think Tom Brennan deserves to be recognized as the Best Chapter Leader."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Riotaro Okada]||align="center"|[https://www.owasp.org/index.php/Japan Japan]||align="center"|"The foundation of the OWASP Japan local chapter, its rapid growth to reaching over 2,000 participants in local chapter meetings in the first 2 years and the massive success of AppSec APAC 2014 in Tokyo would not have been possible without the passion and full commitment to the OWASP cause demonstrated by Rio. He is definitely a role model for the OWASP community, especially in the Asia Pacific region which in general is lacking strong and effective leadership, and there is no doubt in my mind he is the most suited candidate for Best Chapter Leader based on the efforts he's contributed in the past few years as well as the success and results of those efforts." <br />
<br />
<br />
"He holds local chapter meeting(we call OWASP Night), and every event is full capacity and good topics. And he organized successful event, which is OWASP APAC 2014 in this year."<br />
<br />
<br />
"Rio has done an amazing job building up our Japan chapters. <br />
Over the last few years with huge community meetings, new chapters in Japan and a lot of community activity. <br />
This is truely outstanding!"<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Ron Perris]||align="center"|[https://www.owasp.org/index.php/ Orange County]||align="center"|"Ron relaunched the OWASP Orange County Chapter. Grew the chapter leadership organization to five chapter leaders from three. Increased meeting frequency from bi-yearly to monthly. Held 13 meetings in the last twelve months. Attracted 140 new attendees to chapter meetings. Established a culture of vendor neutrality and speakers selection based on merit."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Sebastien Deleersnyder]||align="center"|[https://www.owasp.org/index.php/ Belgium]||align="center"|"He does a lot of work, not only for the chapter meetings but also for the BeNeLux days. He is very approachable and open for suggestions."<br />
|-<br />
|align="center"| [https://www.owasp.org/index.php/User: Jonathan Marcil]||align="center"|[https://www.owasp.org/index.php/ Montreal]||align="center"|""I would like to nominate Jonathan for his involvement in:<br />
1) Successfully leading the Montreal Chapter. Even when personally absent and traveling on another continent, Jonathan has remotely managed the overall execution of the local chapter meetings.<br />
2) His valuable contribution to the OWASP Media project, that undoubtedly brings the ""O"" of OWASP to audiences unable to attend meetings<br />
3) Jonathan has contributed and invested efforts on the ""outreach"" objective, announced by the board as a core objective for 2013-2014."<br />
|-<br />
|}<br />
<br />
*Best Project Leader<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | Project <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Jeremy Long]||align="center"|[https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency Check]||align="center"|"Reasons Jeremy Long and his Dependency Check deserve a WASPY award:<br />
<br />
- His OWASP Dependency Check is a solution to the problem of third party libraries that needed to be solved. <br />
- Jeremy's work on D.C. is steady. He has put a lot of work into this project<br />
- Jeremy has successfully involved others to help work on the project. It is a model open source project.<br />
- He has been responsive and helpful to questions and created a nice community of users."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Achim Hoffmann]||align="center"|[https://www.owasp.org/index.php/O-Saft OWASP O-Saft]||align="center"|"Achim is the project leader of O-Saft (https://www.owasp.org/index.php/O-Saft). O-Saft is a tool to analyze the SSL configuration of a web or mail server. It is a tool with a very specific focus, not a swiss army knife but there is a need for exactly this tool. Achim started the development at the beginning of the big SSL-crisis (concerns about weak ciphers, cipher orders, perfect forward secrecy, ). Without a specialized tool it is impossible to find out the SSL behaviour of a given server. Achim's interest was focused on facts only. The outcome of the tool is not a subjective rating, score or grade, only facts about the config. Achim goals were exactness, comprehensiveness and impartiality which he achieved with his project. He was open to suggestions and could win additional highly motivated and skilled contributors. He is not a marketing driven project leader instead of that he gives talks and trainings about SSL and O-Saft (Munich Chapter, OWASP AppSec EU 2014 Cambridge) to share his knowledge.<br />
<br />
I would like to nominate Achim for the OWASP Project Leader 2014 because his project fulfills the OWASP mission in a perfect way. It makes the security of SSL servers visible. There is no free avaiblabe tool beside O-Saft with a comparable comprehensive scope and ability to execute. It is completely free of commercial interests or commercial ""added values"", distributed under a GPL."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Tokuji Akamine]||align="center"|[https://www.owasp.org/index.php/OWASP_XSecurity_Project OWASP XSecurity Project]||align="center"|"The idea(feature) of this security tool is excellent, especially these two points below.<br />
Usually security is difficult and burdensome. But this security tool makes security much easier and less burdensome to iOS app developers.<br />
1. Provide developer friendly security features on top of Xcode to assist developers to learn iOS app security.(Quick Security Help with built-in Security Guidelines)<br />
2. Avoid making vulnerabilities during development.(Real-time Vulnerability Notifications)"<br />
<br />
<br />
"He provides to assist iOS developers to develop secure iOS apps and a security plugin for Xcode plus clang static analyzer checkers for iOS application development. This plugin will be to reduce the vulnerability made during development by detecting the vulnerability."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Matteo Meucci]||align="center"|[https://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Project]||align="center"|"Matteo collaborates in OWASP from 2002.He founded the Italian Chapter in 2005.He candidates for the Autum of Code in 2006 to start a new project regarding the Testing Guide. He leads the OWASP Testing from 2006 (v2) to now with the publishing of Testing Guide v4 in the next weeks. He was capable to attract and manage more than 50 people to create the new Guide. Nowadays the Testing Guide is the most recognized project of OWASP with great contents and high quality delivery."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: John Melton]||align="center"|[https://www.owasp.org/index.php/OWASP_AppSensor OWASP AppSensor]||align="center"|"John has working tirelessly, and mostly invisible behind the scenes in developing the OWASP AppSensor project. While others have lead the charge on the OWASP AppSensor documentation project, for the most part, John has been the sole contributor to the OWASP AppSensor source code."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Spyros Gasteratos]||align="center"|[https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project OWASP Hackademic Challenges Project]||align="center"|"Spyros has been involved in OWASP since 2010, contributing more and more time as years go by. He began by volunteering for OWASP AppSec Research 2012, where he was in charge for coordinating a team of more than 20 volunteers. For the past 1.5 year he as been co-leading the OWASP Hackademic Challenges Project. During that time he has managed to take the project into the next level both by producing code and by mentoring GSOC students. Spyros has spent a tremendous amount of time in coding, fixing bugs, setting up and maintaining a live version of Hackademic. Undoubtedly, without his efforts the project would have become dormant.Furthermore, he is also helping in other OWASP initiatives, e.g. by participating in the Open Source Showcase, presenting Hackademic and OWASP at the FOSDEM conference in Belgium and by setting up the new ""OWASP Code Wind"" project that aims to bring more student contributions to OWASP."<br />
|-<br />
|}<br />
<br />
*Best Mission Outreach<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User:Brennan Tom Brennan]||align="center"|[https://www.owasp.org/index.php/NYC New York City][https://www.owasp.org/index.php/AppSecUSA_2013 AppSecUSA 2013]||align="center"|"Tom has worked very hard and exceptionally successful on bring OWASP to the community in his role as chapter lead for NYC and running the biggest and most successful AppSecUS in all times. With exceptionally strong local chapter meetings in NY area."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Mostafa Siraj]||align="center"|[https://www.owasp.org/index.php/Cairo Cairo Chapter]||align="center"|"Mostafa did a great job helping our chapter (Cairo Chapter), here are summary of his contribution: - He had a great talk in the latest chapter event, he talk about AppSec US summarizing the conference technical sessions (Mostafa attended the 2013 conference and won the technical competition there), - Mostafa is one of the main members of a small group of AppSec expertise from Cairo chapter, this group is engaged now for preparing security awareness training program for all governmental developers in Egypt, I highly recommend him,"<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Jonathan Marcil]||align="center"|[https://www.owasp.org/index.php/Category:OWASP_Video OWASP Videos]||align="center"|"Because he is helping spread OWASP message through this videos and live streaming events"<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Eoin Keary]||align="center"|[http://owasp.com/index.php/Projects_Reboot_2012 Project 2012 Reboot]||align="center"|"Eoin has had a busy year: Said NO to RSA and took a stand against erosion of software security. Donated training to OWASP and delivered training to 100's of people. Raised funds via Project Reboot to help many projects."<br />
|-<br />
|}<br />
<br />
*Best New Community Supporter<br />
{| border="1" cellpadding="2"<br />
! scope="col" align="center" width="150" | Name<br />
! scope="col" align="center" width="120" | <br />
! scope="col" align="center" width="800" | Citation<br />
<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: AppSec APAC 2014 Team]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=TEAM AppSec Asia Pac 2014]||align="center"|"Despite it being the first time that AppSec was held in Japan and despite the lack of experience in planning and organizing a large scale international conference, the volunteers on the AppSec APAC 2014 team came together and went above and beyond their responsibilities to make AppSec APAC 2014 in Tokyo a stunning success. It was by far the most successful AppSec in the Asia Pacific region and achieved an unprecedented level of profitability. The vast majority of the sponsors were Japanese companies and many of the attendees were Japanese. The ability to achieve this despite the relatively low level of awareness of the OWASP brand in Japan was definitely due to the hard work and dedication of the AppSec APAC 2014 team who worked around the clock to make the event a success. Considering that there were no applicants to hold AppSec APAC 2015 despite the tremendous success in Tokyo, recognizing the contributions of the AppSec APAC 2015 team would definitely give a strong message motivating the Asia Pacific community and facilitate future OWASP initiatives in the region."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Robert Dracea]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=WELCOME AppSec Asia Pac 2014] [https://www.owasp.org/index.php/Japan Japan]||align="center"|"His contribution has been excellent, since we have started preparation for the Global AppSec APAC2014. Based on his passion to promote valuable information regards to information security in Japan, he contributed his bilingual ability to prepare and preside AppSec APAC in Tokyo. He committed the local committee by attended every weekly meeting for more than 9 months from his office and his home. Surely, thanks to his help, potential language barrier were completely broken in the conference. This experience of us will be a good example for OWASP organizers especially in Asia Pacific area."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Takanori Nakanowatari]||align="center"|[https://www.owasp.org/index.php/AppSecAsiaPac2014#tab=TEAM AppSec Asia Pac 2014][https://www.owasp.org/index.php/Japan Japan]||align="center"|"His contribution has been awesome, since we have started preparation for the Global AppSec APAC2014. His experience which attended a few AppSecs were very helpful to organize the newly AppSec in Tokyo, and he committee the local committee by attended every weekly meeting for more than 9 months from his office and his home. Moreover, thanks to his advice, 2 OWASP ZAP evangelists were born in Japan at the timing of AppSec APAC 2014."<br />
|-<br />
|align="center"|[https://www.owasp.org/index.php/User: Beth Guth]||align="center"|[https://www.owasp.org/index.php/New_Jersey_South South New Jersey]||align="center"|"She started South New Jersey chapter with energy and enthusiasm bringing together people from builders, breakers and defenders. Self-starter"<br />
|-</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=169477Orange County2014-03-05T04:46:47Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
Meeting information can be found at the link below.<br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= Past Meetings = <br />
<br />
THIS PAGE IS NO LONGER UPDATED. <br />
<br />
Check out our meetup.com page for recent chapter history. '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Organization =<br />
<br />
'''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=164837Orange County2013-12-17T21:22:09Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
Meeting information can be found at the link below.<br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= Past Meetings = <br />
<br />
THIS PAGE IS NO LONGER UPDATED. <br />
<br />
Check out our meetup.com page for recent chapter history. '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Organization =<br />
<br />
*<b>Co-organizer and Chapter Leader</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Co-organizer and Board Member</b> [mailto:adam.brand@protiviti.com Adam Brand]<br />
*<b>Co-organizer and Board Member</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Co-organizer and Board Member</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Co-organizer and Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=164836Orange County2013-12-17T21:20:48Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
Meeting information can be found at the link below.<br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
THIS PAGE IS NO LONGER UPDATED. <br />
<br />
Check out our meetup.com page for recent chapter history. '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Organization =<br />
<br />
*<b>Co-organizer and Chapter Leader</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Co-organizer and Board Member</b> [mailto:adam.brand@protiviti.com Adam Brand]<br />
*<b>Co-organizer and Board Member</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Co-organizer and Board Member</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Co-organizer and Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=164835Orange County2013-12-17T21:20:19Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
Meeting information can be found at the link below.<br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
THIS PAGE IS NO LONGER UPDATED. <br />
<br />
Check out our meetup.com page for recent chapter history. '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Organization =<br />
<br />
*<b>Co-organizer and Chapter Leader</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Co-organizer and Board Member</b> [mailto:adam.brand@protiviti.com Adam Brand]<br />
*<b>Co-organizer and Board Member</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Co-organizer and Board Member</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=164834Orange County2013-12-17T21:18:15Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
Meeting information can be found at the link below.<br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Organization =<br />
<br />
*<b>Co-organizer and Chapter Leader</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Co-organizer and Board Member</b> [mailto:adam.brand@protiviti.com Adam Brand]<br />
*<b>Co-organizer and Board Member</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Co-organizer and Board Member</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=160870Orange County2013-10-15T17:43:08Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Organization =<br />
<br />
*<b>Co-organizer and Chapter Leader</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Co-organizer and Board Member</b> [mailto:adam.brand@protiviti.com Adam Brand]<br />
*<b>Co-organizer and Board Member</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Co-organizer and Board Member</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=160869Orange County2013-10-15T17:42:10Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Co-organizer and Chapter Leader</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Co-organizer and Board Member</b> [mailto:adam.brand@protiviti.com Adam Brand]<br />
*<b>Co-organizer and Board Member</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Co-organizer and Board Member</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=160867Orange County2013-10-15T17:10:31Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== September 17th 2013 ====<br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter: Jerry Hoff'''<br><br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=159996Orange County2013-10-08T21:51:16Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156904Orange County2013-08-16T16:44:10Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
'''Topic: Do VLANs allow for good application security?'''<br />
<br />
'''Presenter: David M. N. Bryan'''<br />
<br />
'''Summary:''' Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
'''Speaker Bio:'''<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
'''Schedule:''' <br />
<br />
7:30 - <br />
<br />
'''Where:''' We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
====Thursday December 17th 2009====<br />
<br />
'''Topic: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
'''Presenter:''' Michael Sutton <br />
<br />
'''Summary:'''<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Speaker Bio:'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
'''Schedule:'''<br />
<br />
7:30 PM - <br />
<br />
'''Where:'''<br />
<br />
UC Irvine Campus, Room AIRB 1020<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156903Orange County2013-08-16T16:38:44Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:'''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
RSVP: [https://www.regonline.com/owasp_oc_jan Here]<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156902Orange County2013-08-16T16:37:15Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Topic: Threat Modeling at Symantec'''<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
'''Presenter: Edward Bonver'''<br />
<br />
'''Summary:''' Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
'''Speaker Bio:''' Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
'''Schedule:''<br />
<br />
1 PM - 5PM<br />
<br />
'''Where:'''<br />
5151 California Ave<br />
Irvine, California 92617<br />
United States. <br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156900Orange County2013-08-16T16:32:54Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker Bio:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker Bio:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker Bio:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker Bio:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Speaker Bio:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
====January 28th, 2011====<br />
<br />
'''Topic: Online Privacy and the Evercookie'''<br />
<br />
'''Presenter: Samy Kamkar''' <br />
<br />
'''Speaker Bio:''' Samy Kamkar has lectured on computer security issues in over a dozen countries, and his work has been featured on the front page of the New York Times. As a grey-hat hacker, he makes and breaks computer security for tech companies. In addition to his independent security research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
'''Topic: Back to Basics, Defensive Coding Principles for Web Development 101'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' The application security community is in deep need of prescriptive solutions for developers. This talk will review the world of Web Application Security from a "builder" point of view, focusing on critical controls that all developers must master if they wish to build low risk web applications today.<br />
<br />
'''Speaker Bio:''' Jim Manico is the chair of the OWASP Connections committee where he focuses on producing and hosting the OWASP Podcast. Jim also is a co-manager of the OWASP ESAPI Open Source project. Professionally, Jim is an independent application security architect specializing in the construction of low-risk web applications. Jim is also an application security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156899Orange County2013-08-16T16:20:17Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 ====<br />
<br />
'''Topic: Brakeman, a Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
Topic: Friendly_id + ancestry'<br />
<br />
Presenter: Neil Matatall<br />
<br />
Topic: Guard, spork, BDD<br />
<br />
Presenter: Drew Deponte<br />
<br />
'''Where:''' Irvine<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
<br />
8:00 - 8:15: Lightning Rounds<br />
<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
==== June 29th 2011 ====<br />
<br />
'''Topic: Global Security Report 2011'''<br />
<br />
'''Presenter: Charles Henderson'''<br />
<br />
''Summary:''' Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security. The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
'''Where:''' HireRight Offices<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''RSVP:''' [http://owaspoc.eventbrite.com/ Here]<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.'''<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
'''Speaker:''' Charles Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services. Prior to joining SpiderLabs, Henderson ran his own boutique application security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe. Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156898Orange County2013-08-16T16:11:57Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic:''' Top Ten Web Defenses<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
'''Topic: Brakeman: Ruby on Rails Vulnerability Scanner''' <br />
<br />
'''Presenter: Brakeman with Justin Collins'''<br />
<br />
'''Summary:''' While the popular Ruby on Rails web framework provides built-in protection for many security vulnerabilities, it is still possible to misuse these features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
'''Lightning Talks:'''<br />
<br />
'''Topic: Friendly_id + ancestry'''<br />
<br />
'''Presenter: Neil Matatall'''<br />
<br />
'''Topic: Guard, spork, BDD'''<br />
<br />
'''Presenter: Drew Deponte'''<br />
<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156897Orange County2013-08-16T16:00:25Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic:''' Top Ten Web Defenses<br />
<br />
'''Presenter: Jim Manico'''<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Speaker:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br />
<br />
'''Presenter: Neil Matatall and Justin Collins'''<br />
<br />
'''Summary:''' "With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br />
<br />
'''Where:''' Crescent Solutions <br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== March 28th 2012 ====<br />
<br />
'''Topic: WebGoat.NET'''<br />
<br />
'''Presenter: Jerry Hoff'''<br />
<br />
'''Summary:''' Jerry Hoff will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
'''Speaker:''' Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
'''Where:'''<br />
Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
'''Schedule:'''<br />
<br />
7:00 - 7:30: Introduction and networking<br />
<br />
7:30 - 8:30: Presentation<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
When: Wednesday September 17th 7pm<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
Brakeman with Justin Collins: <br />
While the popular Ruby on Rails web framework provides built-in protection <br />
for many security vulnerabilities, it is still possible to misuse these<br />
features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, <br />
Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
Lightning Rounds:<br />
<br />
Neil Matatall: Friendly_id + ancsetry<br />
<br />
Drew Deponte: Guard, spork, BDD<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156896Orange County2013-08-16T15:50:20Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br />
<br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br />
<br />
'''Summary:''' The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic:''' Top Ten Web Defenses<br />
<br />
'''Summary:''' We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
'''Presenter:''' Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br />
<br />
'''Where:''' Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:30: Presentation<br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br><br />
'''Presenter: Neil Matatall and Justin Collins<br>'''<br />
'''Summary:''' <br><br />
"With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:10: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== OWASP LA Event: Security Summit: April 25, 2012, 3:00PM - 8PM ====<br />
<br />
(Note different time and location)<br><br />
<br />
<br />
'''Jerry Hoff VP, Static Code Analysis Division at WhiteHat Security, will be speaking about Webgoat. Shakeel Tufail, Federal Practice Director for HP Enterprise Security Solutions, will be speaking on securing software. Noa Bar Yosef, Senior Security Strategist at Imperva, will be speaking on "De-Anonymizing Anonymous". A concluding panel, moderated by Richard Greenberg, Information Security Officer for LA County Public Health, will have the speakers joined by Adnan Masood, a Software Engineer and Architect.<br />
<br />
<br />
<br />
==== March 28th 2012 7PM ====<br />
<br />
When: March 28th 7pm<br />
<br />
Where: Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:30: Presentation<br />
<br />
===="WebGoat.NET"====<br />
<br />
Abstract:<br />
Jerry Hoff, the project leader of the OWASP Appsec Tutorial Series, and VP of the Static Code Analysis Division at WhiteHat Security, will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
====Speaker Bio:====<br />
Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
When: Wednesday September 17th 7pm<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
Brakeman with Justin Collins: <br />
While the popular Ruby on Rails web framework provides built-in protection <br />
for many security vulnerabilities, it is still possible to misuse these<br />
features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, <br />
Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
Lightning Rounds:<br />
<br />
Neil Matatall: Friendly_id + ancsetry<br />
<br />
Drew Deponte: Guard, spork, BDD<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156876Orange County2013-08-16T07:18:35Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br />
<br />
'''Summary:''' Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br><br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br><br />
'''Summary'''<br><br />
The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
Where: Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
Schedule:<br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br><br />
'''Presenter: Jim Manico<br>'''<br />
'''Summary:''' <br><br />
Title: Top Ten Web Defenses<br />
<br />
We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
<br />
<br />
BIO: Jim Manico is the VP of Security Architecture for WhiteHat <br />
Security, a web security firm. He authors and delivers developer <br />
security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br><br />
6:30 - 7:30: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br><br />
'''Presenter: Neil Matatall and Justin Collins<br>'''<br />
'''Summary:''' <br><br />
"With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:10: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== OWASP LA Event: Security Summit: April 25, 2012, 3:00PM - 8PM ====<br />
<br />
(Note different time and location)<br><br />
<br />
<br />
'''Jerry Hoff VP, Static Code Analysis Division at WhiteHat Security, will be speaking about Webgoat. Shakeel Tufail, Federal Practice Director for HP Enterprise Security Solutions, will be speaking on securing software. Noa Bar Yosef, Senior Security Strategist at Imperva, will be speaking on "De-Anonymizing Anonymous". A concluding panel, moderated by Richard Greenberg, Information Security Officer for LA County Public Health, will have the speakers joined by Adnan Masood, a Software Engineer and Architect.<br />
<br />
<br />
<br />
==== March 28th 2012 7PM ====<br />
<br />
When: March 28th 7pm<br />
<br />
Where: Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:30: Presentation<br />
<br />
===="WebGoat.NET"====<br />
<br />
Abstract:<br />
Jerry Hoff, the project leader of the OWASP Appsec Tutorial Series, and VP of the Static Code Analysis Division at WhiteHat Security, will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
====Speaker Bio:====<br />
Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
When: Wednesday September 17th 7pm<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
Brakeman with Justin Collins: <br />
While the popular Ruby on Rails web framework provides built-in protection <br />
for many security vulnerabilities, it is still possible to misuse these<br />
features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, <br />
Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
Lightning Rounds:<br />
<br />
Neil Matatall: Friendly_id + ancsetry<br />
<br />
Drew Deponte: Guard, spork, BDD<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156875Orange County2013-08-16T07:17:59Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Summary:''' <br><br />
<br />
Developers cannot defend against unknown threats. Understanding vulnerabilities and security controls is an absolute necessity – not only for developers, but for Architects, QA and anyone else involved in the creation of software. This talk starts by making a strong argument for developer education, and how it fits into any organization’s SDLC. From there, we discuss other OWASP resources and projects dedicated to developer education, and an in-depth discussion of OWASP WebGoat.NET – an ASP.NET specific re-design of OWASP which meets the needs and addresses the challenges of modern application security training programs.<br />
<br />
'''Speaker:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br><br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br><br />
'''Summary'''<br><br />
The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
Where: Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
Schedule:<br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br><br />
'''Presenter: Jim Manico<br>'''<br />
'''Summary:''' <br><br />
Title: Top Ten Web Defenses<br />
<br />
We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
<br />
<br />
BIO: Jim Manico is the VP of Security Architecture for WhiteHat <br />
Security, a web security firm. He authors and delivers developer <br />
security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br><br />
6:30 - 7:30: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br><br />
'''Presenter: Neil Matatall and Justin Collins<br>'''<br />
'''Summary:''' <br><br />
"With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:10: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== OWASP LA Event: Security Summit: April 25, 2012, 3:00PM - 8PM ====<br />
<br />
(Note different time and location)<br><br />
<br />
<br />
'''Jerry Hoff VP, Static Code Analysis Division at WhiteHat Security, will be speaking about Webgoat. Shakeel Tufail, Federal Practice Director for HP Enterprise Security Solutions, will be speaking on securing software. Noa Bar Yosef, Senior Security Strategist at Imperva, will be speaking on "De-Anonymizing Anonymous". A concluding panel, moderated by Richard Greenberg, Information Security Officer for LA County Public Health, will have the speakers joined by Adnan Masood, a Software Engineer and Architect.<br />
<br />
<br />
<br />
==== March 28th 2012 7PM ====<br />
<br />
When: March 28th 7pm<br />
<br />
Where: Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:30: Presentation<br />
<br />
===="WebGoat.NET"====<br />
<br />
Abstract:<br />
Jerry Hoff, the project leader of the OWASP Appsec Tutorial Series, and VP of the Static Code Analysis Division at WhiteHat Security, will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
====Speaker Bio:====<br />
Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
When: Wednesday September 17th 7pm<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
Brakeman with Justin Collins: <br />
While the popular Ruby on Rails web framework provides built-in protection <br />
for many security vulnerabilities, it is still possible to misuse these<br />
features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, <br />
Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
Lightning Rounds:<br />
<br />
Neil Matatall: Friendly_id + ancsetry<br />
<br />
Drew Deponte: Guard, spork, BDD<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156874Orange County2013-08-16T07:17:20Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Summary:'''<br />
<br />
'''Speaker:''' Jerry Hoff, Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br><br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br><br />
'''Summary'''<br><br />
The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
Where: Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
Schedule:<br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br><br />
'''Presenter: Jim Manico<br>'''<br />
'''Summary:''' <br><br />
Title: Top Ten Web Defenses<br />
<br />
We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
<br />
<br />
BIO: Jim Manico is the VP of Security Architecture for WhiteHat <br />
Security, a web security firm. He authors and delivers developer <br />
security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br><br />
6:30 - 7:30: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br><br />
'''Presenter: Neil Matatall and Justin Collins<br>'''<br />
'''Summary:''' <br><br />
"With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:10: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== OWASP LA Event: Security Summit: April 25, 2012, 3:00PM - 8PM ====<br />
<br />
(Note different time and location)<br><br />
<br />
<br />
'''Jerry Hoff VP, Static Code Analysis Division at WhiteHat Security, will be speaking about Webgoat. Shakeel Tufail, Federal Practice Director for HP Enterprise Security Solutions, will be speaking on securing software. Noa Bar Yosef, Senior Security Strategist at Imperva, will be speaking on "De-Anonymizing Anonymous". A concluding panel, moderated by Richard Greenberg, Information Security Officer for LA County Public Health, will have the speakers joined by Adnan Masood, a Software Engineer and Architect.<br />
<br />
<br />
<br />
==== March 28th 2012 7PM ====<br />
<br />
When: March 28th 7pm<br />
<br />
Where: Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:30: Presentation<br />
<br />
===="WebGoat.NET"====<br />
<br />
Abstract:<br />
Jerry Hoff, the project leader of the OWASP Appsec Tutorial Series, and VP of the Static Code Analysis Division at WhiteHat Security, will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
====Speaker Bio:====<br />
Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
When: Wednesday September 17th 7pm<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
Brakeman with Justin Collins: <br />
While the popular Ruby on Rails web framework provides built-in protection <br />
for many security vulnerabilities, it is still possible to misuse these<br />
features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, <br />
Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
Lightning Rounds:<br />
<br />
Neil Matatall: Friendly_id + ancsetry<br />
<br />
Drew Deponte: Guard, spork, BDD<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156873Orange County2013-08-16T07:16:31Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter:'''<br><br />
<br />
'''Summary:'''<br />
<br />
'''Speaker:''' Jerry Hoff <br><br />
<br />
Whitehat Security, VP, Static Code Analysis Division; Managing Partner / Co-Founder, INFRARED SECURITY; Former Developer Security Consulting & FTE Across The Board; Over 10,000 Hours Delivering Technical Training; MS In Computer Science, Washington University<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br><br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br><br />
'''Summary'''<br><br />
The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
Where: Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
Schedule:<br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br><br />
'''Presenter: Jim Manico<br>'''<br />
'''Summary:''' <br><br />
Title: Top Ten Web Defenses<br />
<br />
We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
<br />
<br />
BIO: Jim Manico is the VP of Security Architecture for WhiteHat <br />
Security, a web security firm. He authors and delivers developer <br />
security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br><br />
6:30 - 7:30: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br><br />
'''Presenter: Neil Matatall and Justin Collins<br>'''<br />
'''Summary:''' <br><br />
"With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:10: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== OWASP LA Event: Security Summit: April 25, 2012, 3:00PM - 8PM ====<br />
<br />
(Note different time and location)<br><br />
<br />
<br />
'''Jerry Hoff VP, Static Code Analysis Division at WhiteHat Security, will be speaking about Webgoat. Shakeel Tufail, Federal Practice Director for HP Enterprise Security Solutions, will be speaking on securing software. Noa Bar Yosef, Senior Security Strategist at Imperva, will be speaking on "De-Anonymizing Anonymous". A concluding panel, moderated by Richard Greenberg, Information Security Officer for LA County Public Health, will have the speakers joined by Adnan Masood, a Software Engineer and Architect.<br />
<br />
<br />
<br />
==== March 28th 2012 7PM ====<br />
<br />
When: March 28th 7pm<br />
<br />
Where: Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:30: Presentation<br />
<br />
===="WebGoat.NET"====<br />
<br />
Abstract:<br />
Jerry Hoff, the project leader of the OWASP Appsec Tutorial Series, and VP of the Static Code Analysis Division at WhiteHat Security, will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
====Speaker Bio:====<br />
Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
When: Wednesday September 17th 7pm<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
Brakeman with Justin Collins: <br />
While the popular Ruby on Rails web framework provides built-in protection <br />
for many security vulnerabilities, it is still possible to misuse these<br />
features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, <br />
Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
Lightning Rounds:<br />
<br />
Neil Matatall: Friendly_id + ancsetry<br />
<br />
Drew Deponte: Guard, spork, BDD<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156872Orange County2013-08-16T07:15:49Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Topic: Demonstration of Common Web Vulnerabilities using WebGoat.NET'''<br><br />
<br />
'''Presenter:'''<br><br />
<br />
'''Summary:'''<br />
<br />
'''Speaker:'''<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br><br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br><br />
'''Summary'''<br><br />
The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
Where: Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
Schedule:<br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br><br />
'''Presenter: Jim Manico<br>'''<br />
'''Summary:''' <br><br />
Title: Top Ten Web Defenses<br />
<br />
We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
<br />
<br />
BIO: Jim Manico is the VP of Security Architecture for WhiteHat <br />
Security, a web security firm. He authors and delivers developer <br />
security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br><br />
6:30 - 7:30: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br><br />
'''Presenter: Neil Matatall and Justin Collins<br>'''<br />
'''Summary:''' <br><br />
"With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:10: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== OWASP LA Event: Security Summit: April 25, 2012, 3:00PM - 8PM ====<br />
<br />
(Note different time and location)<br><br />
<br />
<br />
'''Jerry Hoff VP, Static Code Analysis Division at WhiteHat Security, will be speaking about Webgoat. Shakeel Tufail, Federal Practice Director for HP Enterprise Security Solutions, will be speaking on securing software. Noa Bar Yosef, Senior Security Strategist at Imperva, will be speaking on "De-Anonymizing Anonymous". A concluding panel, moderated by Richard Greenberg, Information Security Officer for LA County Public Health, will have the speakers joined by Adnan Masood, a Software Engineer and Architect.<br />
<br />
<br />
<br />
==== March 28th 2012 7PM ====<br />
<br />
When: March 28th 7pm<br />
<br />
Where: Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:30: Presentation<br />
<br />
===="WebGoat.NET"====<br />
<br />
Abstract:<br />
Jerry Hoff, the project leader of the OWASP Appsec Tutorial Series, and VP of the Static Code Analysis Division at WhiteHat Security, will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
====Speaker Bio:====<br />
Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
When: Wednesday September 17th 7pm<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
Brakeman with Justin Collins: <br />
While the popular Ruby on Rails web framework provides built-in protection <br />
for many security vulnerabilities, it is still possible to misuse these<br />
features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, <br />
Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
Lightning Rounds:<br />
<br />
Neil Matatall: Friendly_id + ancsetry<br />
<br />
Drew Deponte: Guard, spork, BDD<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perrishttps://wiki.owasp.org/index.php?title=Orange_County&diff=156871Orange County2013-08-16T07:13:32Z<p>Ron Perris: </p>
<hr />
<div>= Next Meeting = <br />
<br />
'''Tuesday, September 17, 2013''' <br />
<br />
'''Demonstration of Common Web Vulnerabilities using WebGoat.NET '''<br><br />
<br />
RSVP: '''[http://www.meetup.com/OWASP-OC https://www.owasp.org/images/8/82/Meetup_logo3.jpg]'''<br />
<br />
= About OWASP Orange County =<br />
<br />
The OWASP Orange County email list can be found here [http://lists.owasp.org/mailman/listinfo/owasp-Orange_County http://lists.owasp.org/mailman/listinfo/owasp-Orange_County]. <br />
<br />
The chapter leader is [mailto:ron.perris@owasp.org Ron Perris].<br />
<br />
= Past Meetings = <br />
<br />
==== August 15th 2013 ====<br />
<br />
'''Topic: Teaching your WAF new tricks'''<br><br />
<br />
'''Presenter: Robert Rowley, Security Researcher'''<br><br />
<br />
'''Summary:''' Not your uncle's "What's a WAF?" talk. I discuss basic of mod_security and how to extend your rule sets with lua scripts. Implementing automated response systems, better analytics on attacks and introducing counterintelligence tools all using an open source WAF.<br />
<br />
'''Speaker:''' A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).<br />
<br />
'''Where:''' Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
<br />
'''Schedule:'''<br />
<br />
6:00 - 6:30: Introduction and networking<br />
<br />
6:30 - 7:10: Presentation <br />
<br />
'''RSVP:''' '''[http://www.meetup.com/OWASP-OC http://img1.meetupstatic.com/892670376411449149876/img/header/logo.png]'''<br />
<br />
==== July 18th 2013====<br />
<br />
'''Topic: BSIMM'''<br><br />
'''Presenter: Carl Schwarcz, Managing Consulting Cigital, Inc.'''<br><br />
'''Summary'''<br><br />
The presentation will discuss the nature and application of BSIMM, a software security maturity model in use by many major companies. It will cover how BSIMM came about, how it is applied, and how companies use the results to increase their software security budgets and strengthen their software security programs.<br />
<br />
Where: Crescent Solutions 17871 Mitchell N # 100, Irvine, CA<br />
Schedule:<br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:30: Presentation <br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br />
==== May 21th 2013====<br />
<br />
'''Topic: Top Ten Web Defenses'''<br><br />
'''Presenter: Jim Manico<br>'''<br />
'''Summary:''' <br><br />
Title: Top Ten Web Defenses<br />
<br />
We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Citigroup, PBS, Sega, Nintendo, Gawker, AT&T, the CIA, the US Senate, NASA, Nasdaq, the NYSE, Zynga, and thousands of others have something in common – all have had websites compromised in the last year. No company or industry is immune. Programmers need to learn to build websites differently. This talk will review the top coding techniques developers need to master in order to build a low-risk, high-security web application.<br />
<br />
<br />
<br />
BIO: Jim Manico is the VP of Security Architecture for WhiteHat <br />
Security, a web security firm. He authors and delivers developer <br />
security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br><br />
6:30 - 7:30: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== January 17th 2013====<br />
<br />
'''Topic: Putting your robots to work: security automation at Twitter'''<br><br />
'''Presenter: Neil Matatall and Justin Collins<br>'''<br />
'''Summary:''' <br><br />
"With daily code releases and a growing infrastructure, manually reviewing code changes and protecting against security regressions quickly becomes impractical. Even when using security tools, whether commercial or open source, the difficult work of integrating them into the development and security cycles remains. We need to use an automated approach to push these tools as close to when the code is written as possible, allowing us to prevent potential vulnerabilities before they are shipped. We worked with development, operations, and release teams to create a targeted suite of tools focused on specific security concerns that are effective and don’t introduce any noise. This presentation will give an overview of what we’ve done over the past year, what we have learned along the way, and will provide advice for anyone else going down this road as well as the philosophy that guided us along the way."<br><br />
<br />
Where: Crescent Solutions<br />
17871 Mitchell N # 100, Irvine, CA<br><br />
<br />
Schedule:<br><br />
6:00 - 6:30: Introduction and networking<br />
6:30 - 7:10: Presentation<br />
<br><br />
<br />
'''RSVP here http://www.meetup.com/OWASP-OC'''<br />
<br><br><br />
<br />
==== OWASP LA Event: Security Summit: April 25, 2012, 3:00PM - 8PM ====<br />
<br />
(Note different time and location)<br><br />
<br />
<br />
'''Jerry Hoff VP, Static Code Analysis Division at WhiteHat Security, will be speaking about Webgoat. Shakeel Tufail, Federal Practice Director for HP Enterprise Security Solutions, will be speaking on securing software. Noa Bar Yosef, Senior Security Strategist at Imperva, will be speaking on "De-Anonymizing Anonymous". A concluding panel, moderated by Richard Greenberg, Information Security Officer for LA County Public Health, will have the speakers joined by Adnan Masood, a Software Engineer and Architect.<br />
<br />
<br />
<br />
==== March 28th 2012 7PM ====<br />
<br />
When: March 28th 7pm<br />
<br />
Where: Irvine - 5151 California Ave, Irvine, CA 92617<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:30: Presentation<br />
<br />
===="WebGoat.NET"====<br />
<br />
Abstract:<br />
Jerry Hoff, the project leader of the OWASP Appsec Tutorial Series, and VP of the Static Code Analysis Division at WhiteHat Security, will be discussing his newest OWASP project, WebGoat.NET. For many years, the Java version of WebGoat has been available as a fantastic tool for learning application security from the Java perspective. Jerry has now created a parallel tool for ASP.NET developers to learn about application security. Jerry will be discussing how this tool can be used in a learning environment, and other issues related to application security education.<br />
<br />
====Speaker Bio:====<br />
Jerry Hoff is vice president of the Static Code Analysis division at WhiteHat Security. In this role, he oversees the development of WhiteHats cloud-based static application security testing (SAST) service. Prior to WhiteHat, Mr. Hoff was co-founder and managing partner ofInfrared Security, a leading application security professional services firm. Mr. Hoff is an experienced application security consultant with years of professional development and training delivery. He is also the lead of the OWASP AppSec Tutorial Series. <br />
<br />
<br />
==== September 14th 2011 7PM ====<br />
<br />
When: Wednesday September 17th 7pm<br />
Where: TBD (Irvine)<br />
http://www.meetup.com/ocrails/events/30043551/<br />
<br />
Loose Schedule:<br />
7:00 - 7:30: Introduction and networking<br />
7:30 - 8:00: Brakeman with Justin Collins<br />
8:00 - 8:15: Lightning Rounds<br />
8:15 - 8:30: Brakeman Demo<br />
<br />
<br />
Brakeman with Justin Collins: <br />
While the popular Ruby on Rails web framework provides built-in protection <br />
for many security vulnerabilities, it is still possible to misuse these<br />
features or introduce other vulnerabilities to an application. Brakeman is a static code analysis tool designed specifically to find vulnerabilities and configuration issues in Ruby on Rails applications. Since it works at the source code level, Brakeman can be used at any point in development without the need for deploying the full application stack. To make it even simpler, <br />
Brakeman can be integrated with Hudson/Jenkins to provide automatic monitoring of Brakeman results as code is committed. This talk will discuss how to use Brakeman and how it can help you create safer Rails applications.<br />
<br />
Lightning Rounds:<br />
<br />
Neil Matatall: Friendly_id + ancsetry<br />
<br />
Drew Deponte: Guard, spork, BDD<br />
<br />
==== June 29th 2011 7PM ====<br />
<br />
[[http://owaspoc.eventbrite.com/ Registration Link]]<br />
<br />
'''When''': Wednesday june 29th, 2011 7pm<br />
<br />
'''Where: HireRight Offices'''<br />
5151 California Avenue<br />
Irvine, CA 92617<br />
<br />
'''Pizza and refreshments will be provided by the sponsors of this meeting.<br />
'''<br />
<br />
===== Meeting Sponsors =====<br />
<br />
Food and refreshments:<br />
[[File:AppSecDC2010-Sponsor-trustwave.gif]]<br />
<br />
Meeting location:<br />
[[File:Hireright.png]]<br />
<br />
===== Presentation Topic: =====<br />
Featuring analysis of more than 220 data breach investigations and more than 2,300 penetration tests conducted by Trustwave's SpiderLabs, the Global Security Report 2011 identifies the top vulnerabilities business encountered in 2010 as well as a list of strategic initiatives to help your business improve its overall security.<br />
<br />
The data gathered from these engagements is substantial and comprehensive. This presentation will be a summary of the results of the analysis of the data gathered during 2010. The results will be presented both technical and business impact analysis.<br />
<br />
<br />
<br />
===== Charles Henderson, Director of Application Security Services of SpiderLabs at Trustwave =====<br />
<br />
Henderson began his career in computer security in 1993, specializing in penetration testing as well as security and vulnerability research. As Director of Application Security Services at SpiderLabs, he leads the team responsible for Application Penetration Testing, Code Review, Secure Development Training, and other elite application security consulting services.<br />
<br />
Prior to joining SpiderLabs, Henderson ran his own boutique application<br />
security testing firm. Henderson’s firm provided offensive security services to a wide variety of clients in the United States and Europe.<br />
<br />
Henderson speaks frequently at major industry events and conferences, including BlackHat, DEF CON, AppSec US, AppSec EU, SOURCE, and the International Association of Financial Crime Investigators convention.<br />
<br />
<br />
<br />
====January 28th, 2011====<br />
<br />
'''Registration link: [https://www.regonline.com/owasp_oc_jan]'''<br />
<br />
'''Time:''' 1 PM - 5PM<br />
<br />
'''Location: '''<br />
<br />
[http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=5151+California+Ave&sll=33.621597,-117.740797&sspn=0.010489,0.019011&ie=UTF8&hq=&hnear=5151+California+Ave,+Irvine,+Orange,+California+92617&z=16&iwloc=A Hireright] <br />
<br />
5151 California Ave<br />
<br />
Irvine, California 92617<br />
<br />
United States. <br />
<br />
'''Topics:''' Threat Modeling, Application Security<br />
<br />
'''Food:''' Provided<br />
<br />
Speakers: <br />
<br />
'''Samy Kamkar'''<br />
<br />
Online Privacy and the Evercookie<br />
<br />
Bio:<br />
<br />
Samy Kamkar has lectured on computer security issues in over a dozen<br />
countries, and his work has been featured on the front page of the New<br />
York Times. As a grey-hat hacker, he makes and breaks computer<br />
security for tech companies. In addition to his independent security<br />
research, he co-founded Fonality, an IP PBX company.<br />
<br />
'''Jim Manico'''<br />
<br />
Back to Basics: Defensive Coding Principles for Web Development 101<br />
<br />
The application security community is in deep need of prescriptive<br />
solutions for developers. This talk will review the world of Web<br />
Application Security from a "builder" point of view, focusing on<br />
critical controls that all developers must master if they wish to build<br />
low risk web applications today.<br />
<br />
Bio:<br />
<br />
Jim Manico is the chair of the OWASP Connections committee where he<br />
focuses on producing and hosting the OWASP Podcast. Jim also is a<br />
co-manager of the OWASP ESAPI Open Source project. Professionally, Jim<br />
is an independent application security architect specializing in the<br />
construction of low-risk web applications. Jim is also an application<br />
security educator and assessment specialist.<br />
<br />
'''Edward Bonver'''<br />
Talk Title:<br />
<br />
Threat Modeling at Symantec<br />
[[File:OWASP-WWW-2011-Edward-Bonver-Threat-Modelint-at-Symantec.pptx]]<br />
<br />
Abstract:<br />
<br />
Threat Modeling is one of the most important security activities that a development/QA team needs to perform as part of a Security Development Lifecycle. This activity allows the team to build a complete security profile of the system being built. Threat Modeling is not always easy to get going for a team that has little or no security experience. In this presentation we’ll take a look at why Threat Modeling is so important; we’ll explore the process behind it, and how the process is being implemented and followed across Symantec.<br />
<br />
Bio:<br />
<br />
Edward Bonver is a principal software engineer on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Edward is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures and tools for secure coding and security testing. Within Symantec, Edward teaches secure coding and security testing classes for Symantec engineers, and also leads the company’s QA Security Task Force, which he founded. Prior to joining Symantec, Edward held software engineering and QA roles at Digital Equipment Corporation, Nbase and Zuma Networks. <br />
<br />
<br />
Edward is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology. Edward is a Ph.D. student at NOVA Southeastern University.<br />
<br />
<br />
====Thursday, January 21st 2010====<br />
<br />
Time: 7:30<br />
Location: We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building. http://www.oit.uci.edu/computing/labs/training.html Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdfBD<br />
<br />
For those who would like to avoid paying for parking, you can park in the University Center and take the campus shuttle: http://www.shuttle.uci.edu/maincampus/index.php<br />
<br />
The shuttle runs until 10:45PM. The shuttle costs $1 per ride, but fees are rarely collected ;)<br />
<br />
Title: Do VLANs allow for good application security? <br />
<br />
Virtual Local Area Networks (VLANs) are not a new concept, and can help<br />
any organization better control network access. I will present some of<br />
the previous issues identified, what was the root cause, and how these<br />
have been fixed in current technology. In addition we will talk about<br />
how this can help to enhance security in your environment, and what<br />
controls must be in place in order to implement such an environment. We<br />
will also touch on how this can complicate your application environment,<br />
but improve overall security.<br />
<br />
I will touch on the controls that need to be reviewed and audited when<br />
working with VMware, VLANs, and web applications, to ensure that these<br />
networks are secure, and what to look for to potentially pass audit<br />
criteria. I will also talk about where and how these controls have been<br />
implemented in order to protect thousands of users while accessing one<br />
of the most hostile networks in the world.<br />
<br />
David M. N. Bryan <br />
Senior Security Consultant <br />
<br />
David has over 9+ years of computer security experience including,<br />
consulting, engineering and administration. He has performed security<br />
assessment projects for health care, nuclear, manufacturing,<br />
pharmaceutical, banking and educational sectors. As an active<br />
participant in the information security community, he volunteers at<br />
DEFCON where he designs and implements the Firewall and Network for what<br />
is said to be the most hostile network environment in the world. <br />
<br />
He is also an active participant in the local Minneapolis security<br />
groups both as a board member of OWASP MSP and DC612. His roots and<br />
experience come from working for a large enterprise banks, designing and<br />
managing enterprise security systems. In the more recent years he has<br />
been working as an Information Security Consultant to review the<br />
security and architecture of information computing environments.<br />
<br />
<br />
====Thursday December 17th 2009====<br />
<br />
7:30 PM, UC Irvine Campus, Room AIRB 1020<br />
<br />
<br />
We will be meeting in the Anteater Instruction and Research Building on the UC Irvine campus. The building itself is inside of the Anteater Parking Structure at the corner of E. Peltason Dr and Anteater Dr and is room number 1020. Parking is $7 but feel free to park off campus and walk to the building.<br />
http://www.oit.uci.edu/computing/labs/training.html<br />
Buliding #653 in quadrant H9 on the campus map - http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf<br />
<br />
'''Abstract'''<br />
<br />
'''Title: Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications'''<br />
<br />
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as [http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage Gears (formerly Google Gears) and the Database Storage] functionality included in the emerging [http://dev.w3.org/html5/spec/Overview.html HTML 5 specification]. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.<br />
<br />
Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting and client-side SQL injection.<br />
<br />
'''Bio'''<br />
<br />
'''Michael Sutton'''<br />
'''Vice President, Security Research – Zscaler'''<br />
<br />
Michael Sutton has spent more than a decade in the security industry conducting leading-edge research, building teams of world-class researchers and educating others on a variety of security topics. As VP of Security Research, Michael heads Zscaler Labs, the research and development arm of the company. Zscaler Labs is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. The team is comprised of researchers with a wealth of experience in the security industry. <br />
<br />
Prior to joining Zscaler, Michael was the Security Evangelist for SPI Dynamics where, as an industry expert, he was responsible for researching, publishing and presenting on various security issues. In 2007, SPI Dynamics was acquired by Hewlett-Packard. Previously, Michael was a Research Director at iDefense where he led iDefense Labs, a team responsible for discovering and researching security vulnerabilities in a variety of technologies. iDefense was acquired by VeriSign in 2005. Michael is a frequent speaker at major information security conferences; he is regularly quoted by the media on various information security topics, has authored numerous articles and is the co-author of Fuzzing: Brute Force Vulnerability Discovery, an Addison-Wesley publication.<br />
<br />
<br />
====Thursday, November 19th 2009====<br />
<br />
When: November 19th 2009, 7:30PM<br />
Where: Gina's Pizza, Irvine<br />
Topics: Facebook privacy, web application firewalls, penetration testing, the reluctance for hackers to execute attacks, and random new technology. Announced OWASP OC/LAs intention to submit a proposal for AppSec 2010.<br />
<br />
====Wednesday, October 14th 2009====<br />
<br />
Separate meetings will be held for OWASP OC and OWASP@UCI (student group).<br />
<br />
When: Wednesday 10/14 7:30PM<br />
Where: Steelhead Brewery<br />
Topics: News, Ideas, Chit-chat<br />
<br />
This is a restaurant/bar with plenty of seating, but room for a projector is out of the question so this would be an informal round table discussion.<br />
<br />
I have a presentation I'm working on regarding WAFs and Vulnerability Assessment Tools. If it pleases the group, I'd love to go over the presentation and discuss everyone's experiences. Also, it's a great way to get feedback :)<br />
<br />
Neil<br />
<br />
I'm open to suggestions of any kind: location, time, topics, etc<br />
<br />
====Thursday, September 17th, 2009 7:30PM ====<br />
'''Location:''' UC Irvine <br />
Building: Calit2 building,building number 325 in quadrant H8 on the [http://today.uci.edu/pdf/UCI_09_map_campus_core.pdf UC Irvine Map]<br />
Room: 3008<br />
<br />
Parking will be $7.<br />
Please park in the [http://maps.google.com/maps?li=d&hl=en&f=d&iwstate1=dir:to&daddr=Parking+Structure+for+CalIT2%4033.643082,+-117.837593&geocode=CSJ9b4xJxrzxFUpaAQId5_D5-A&iwloc=1&dq=calit2,+uc+irvine,+ca&cid=33643082,-117837593,16505793731713499531&ei=v3bvSabfO6LejAOR2pjgAQ Anteater Parking Structure]<br />
<br />
I can only unofficially say that if you park in the nearby shopping centers and walk, you may be able to park for free.<br />
<br />
* <b>The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks</b><br />
<br />
<br />
<br />
====Apr 30, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Our fourth OC OWASP meeting will be an informal, roundtable discussion of current application security issues. Feel free to bring some ideas, code, slides, etc to contribute to the discussion. Hope to see everyone there!<br />
<br />
====Feb 19, 2009 6:30PM-8:30PM====<br />
Brooklyn Pizza Works, 1235 East Imperial Highway, Placentia, CA<br />
<br />
[http://maps.google.com/maps?q=1235+East+Imperial+Highway,+placentia,+ca&oe=utf-8&client=firefox-a&ie=UTF8&split=0&gl=us&z=16&iwloc=addr Google Map]<br />
<br />
Come talk application security at the third OWASP OC meeting. We'll discuss current application security topics and chapter issues over pizza. We have a room booked for 15-20 people so we'll be able to rant without disturbing the patrons :) See you there! [https://www.owasp.org/images/5/58/Cloud_Computing_Security.pdf Presentation Slides]<br />
<br />
<br />
====Dec 17, 2008 6PM - 9PM====<br />
Microsoft Campus<br />
Room MPR1, 3 Park Plaza, Suite 1600, Irvine, CA, 92614<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=microsoft,+Irvine,+CA,+92614&sll=33.678479,-117.838368&sspn=0.009892,0.022745&g=3+Park+Plaza,+Irvine,+CA,+92614&ie=UTF8&ei=sCFJSfKPEo3UNc2ZmCc&cd=1&cid=33728042,-117783305,17507068988286890825&li=lmd&ll=33.731835,-117.78142&spn=0.039545,0.090981&z=14&iwloc=A Google Map]<br />
<br />
This meeting will be a roundtable discussion of application security news, plus a few OWASP-themed challenges with prizes. Pizza will be provided and we'll head to the Yard House after the meeting.<br />
<br />
<br />
====Aug 27, 2008, 7 PM - 9 PM====<br />
Penny Saver<br />
<br />
603 Valencia, Brea, CA 92822<br />
<br />
[http://maps.google.com/maps?f=q&hl=en&geocode=&q=603+valencia,+Brea,+CA+92822&sll=33.911348,-117.851629&sspn=0.009865,0.022745&ie=UTF8&ll=33.909478,-117.852917&spn=0.009866,0.022745&z=16&iwloc=addr Google Map]<br />
<br />
Come meet up with web security professionals, have some pizza, and offer your thoughts for the direction of the OC chapter at our inaugural meeting! We are looking for speakers and venue sponsors for the next meeting. If you are interested, please contact the chapter leaders. Everyone is welcome to join us at our chapter meetings.<br />
<br />
[[Category:OWASP Chapter]]<br />
<br />
= Orange County OWASP Board Members =<br />
<br />
*<b>Orange County President</b> [mailto:ron.perris@owasp.org Ron Perris]<br />
*<b>Orange County Vice-President</b> [mailto:shong.chong@owasp.org Shong Chong]<br />
*<b>Orange County Membership Director:</b> [mailto:ryan@captiveeight.com Ryan Heiserman]<br />
*<b>Orange County Board Member</b> [mailto:neil@owasp.org Neil Matatall]<br />
<br />
__NOTOC__ <br />
<headertabs /><br />
<br />
[[Category:California]]</div>Ron Perris