https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Rsl81OWASP - User contributions [en]2026-04-26T00:17:47ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=Regular_expression_Denial_of_Service_-_ReDoS&diff=200401Regular expression Denial of Service - ReDoS2015-09-11T07:33:15Z<p>Rsl81: /* References */</p>
<hr />
<div>{{template: Attack}}<br><br />
[[Category:OWASP ASDR Project]]<br />
<br />
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''<br />
<br />
<br />
==Introduction==<br />
The '''Regular expression Denial of Service (ReDoS)''' is a [[Denial of Service]] attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.<br />
<br />
==Description==<br />
===The problematic Regex naïve algorithm===<br />
The Regular Expression naïve algorithm builds a [http://en.wikipedia.org/wiki/Nondeterministic_finite_state_machine Nondeterministic Finite Automaton (NFA)], which is a finite state machine where for each pair of state and input symbol there may be several possible next states. Then the engine starts to make transition until the end of the input. Since there may be several possible next states, a deterministic algorithm is used. This algorithm tries one by one all the possible paths (if needed) until a match is found (or all the paths are tried and fail).<br />
<br />
For example, the Regex '''''^(a+)+$''''' is represented by the following NFA:<br />
<br />
:::[[File:NFA.png]]<br />
<br />
For the input '''''aaaaX''''' there are 16 possible paths in the above graph. But for '''''aaaaaaaaaaaaaaaaX''''' there are 65536 possible paths, and the number is double for each additional '''''a'''''. This is an extreme case where the naïve algorithm is problematic, because it must pass on many many paths, and then fail.<br />
<br />
Notice, that not all algorithms are naïve, and actually Regex algorithms can be written in an efficient way. Unfortunately, most Regex engines today try to solve not only "pure" Regexes, but also "expanded" Regexes with "special additions", such as back-references that cannot be always be solved efficiently (see '''Patterns for non-regular languages''' in [http://en.wikipedia.org/wiki/Regular_expression Wiki-Regex] for some more details). So even if the Regex is not "expanded", a naïve algorithm is used.<br />
<br />
===Evil Regexes===<br />
A Regex is called "evil" if it can stuck on crafted input.<br />
<br />
'''Evil Regex pattern contains''':<br />
* Grouping with repetition<br />
* Inside the repeated group:<br />
** Repetition<br />
** Alternation with overlapping<br />
<br />
'''Examples of Evil Patterns''':<br />
* (a+)+<br />
* ([a-zA-Z]+)*<br />
* (a|aa)+<br />
* (a|a?)+<br />
* (.*a){x} | for x > 10<br />
<br />
All the above are susceptible to the input '''''aaaaaaaaaaaaaaaaaaaaaaaa!''''' (The minimum input length might change slightly, when using faster or slower machines).<br />
<br />
===Attacks===<br />
The attacker might use the above knowledge to look for applications that use Regular Expressions, containing an '''Evil Regex''', and send a well-crafted input, that will hang the system. Alternatively, if a Regex itself is affected by a user input, the attacker can inject an '''Evil Regex''', and make the system vulnerable.<br />
<br />
==Risk Factors==<br />
The Web is Regex-Based:<br />
<br />
:::[[File:RegexBasedWeb.png]]<br />
<br />
In every layer of the WEB there are Regular Expressions, that might contain an '''Evil Regex'''. An attacker can hang a WEB-browser (on a computer or potentially also on a mobile device), hang a Web Application Firewall (WAF), attack a database, and even stack a vulnerable WEB server.<br />
<br />
For example, if a programmer uses a Regex to validate the client side of a system, and the Regex contains an '''Evil Regex''', the attacker can assume the same vulnerable Regex is used in the server side, and send a well-crafted input, that stacks the WEB server.<br />
<br />
==Examples==<br />
===Vulnerable Regex in online repositories===<br />
1. [http://regexlib.com/REDetails.aspx?regexp_id=1757 ReGexLib,id=1757 (email validation)] - see bold part, which is an '''Evil Regex'''<br />
^([a-zA-Z0-9])'''(([\-.]|[_]+)?([a-zA-Z0-9]+))*'''(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$<br />
<br />
Input:<br />
aaaaaaaaaaaaaaaaaaaaaaaa!<br />
<br />
2. [[OWASP Validation Regex Repository]], Java Classname - see bold part, which is an '''Evil Regex'''<br />
^'''(([a-z])+.)+'''[A-Z]([a-z])+$<br />
<br />
Input:<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!<br />
<br />
===Web application attack===<br />
* Open a JavaScript <br />
* Find '''Evil Regex'''<br />
* Craft a malicious input for the found Regex<br />
* Submit a valid value via intercepting proxy <br />
* Change the request to contain a malicious input<br />
* You are done!<br />
<br />
===ReDoS via Regex Injection===<br />
The following example checks if the username is part of the password entered by the user.<br />
String userName = textBox1.Text;<br />
String password = textBox2.Text;<br />
Regex testPassword = new Regex(userName);<br />
Match match = testPassword.Match(password);<br />
if (match.Success)<br />
{<br />
MessageBox.Show("Do not include name in password.");<br />
}<br />
else<br />
{<br />
MessageBox.Show("Good password.");<br />
}<br />
If an attacker enters ''^(([a-z])+.)+[A-Z]([a-z])+$'' as a username and ''aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!'' as a password, the program will hang.<br />
==Related [[Threat Agents]]==<br />
TBD<br />
<br />
==Related [[Attacks]]==<br />
* [[Denial of Service]]<br />
<br />
==Related [[Vulnerabilities]]==<br />
* [[:Category: Input Validation Vulnerability]]<br />
* [[:Category: API Abuse]]<br />
<br />
==Related [[Controls]]==<br />
* [[Input Validation]]<br />
* [[Output Validation]]<br />
* [[Canonicalization]]<br />
<br />
==References ==<br />
* [http://www.cs.rice.edu/~scrosby/hash/slides/USENIX-RegexpWIP.2.ppt Regular Expression Denial Of Service / Crosby&Wallach, Usenix Security 2003]<br />
* [http://www.checkmarx.com/NewsDetails.aspx?id=23&cat=3 Regular expression Denial of Service Revisited, Sep-2009]<br />
* [[Media:20091210_VAC-REGEX_DOS-Adar_Weidman.pdf| VAC Presentation - ReDoS, OWASP-NL Chapter meeting Dec-2009]]<br />
* [[Podcast 56|OWASP podcast about ReDoS]]<br />
* [[OWASP Validation Regex Repository]]<br />
* [http://regexlib.com/ RegExLib]<br />
* Examples of ReDoS in open source applications:<br />
** [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3277 ReDoS in DataVault]<br />
** [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3275 ReDoS in EntLib]<br />
** [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3276 ReDoS in NASD CORE.NET Terelik]<br />
** [http://blog.malerisch.net/2015/09/net-mvc-redos-denial-of-service-vulnerability-cve-2015-2526.html ReDoS in .NET Framework]<br />
<br />
==Credit==<br />
{{Template:Checkmarx}}<br />
[[Category:Attack]]<br />
[[Category:Injection]]</div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106156New Zealand2011-03-02T22:23:01Z<p>Rsl81: /* OWASP NZ Members */</p>
<hr />
<div>{{Chapter Template|chaptername=New_Zealand|extra=The chapter leaders are [mailto:nick.freeman@owasp.org Nick Freeman] and [mailto:scott.bell@owasp.org Scott Bell] |mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-newzealand|emailarchives=http://lists.owasp.org/pipermail/owasp-newzealand}}<br />
<br />
[[Category:OWASP Chapter]]<br />
== Upcoming Event ==<br />
<br />
TBA<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' [http://www.owasp.org/images/5/5e/2011-03-02-OWASP.pdf I know what you did last summer: The latest from the world of web hacks]<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Nick Freeman and Scott Bell have been appointed as the new leaders of the new OWASP New Zealand Chapter<br />
* Roberto Suggi Liverani has resigned from his position as OWASP New Zealand Chapter Leader<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader - Auckland)</b> [mailto:nick.freeman(at)owasp.org Nick Freeman] 021 424 777<br />
*<b>NZ Board Memeber (Leader - Wellington)</b> [mailto:scott.bell(at)owasp.org Scott Bell] 021 776 410<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106150New Zealand2011-03-02T21:39:43Z<p>Rsl81: /* OWASP NZ Members */</p>
<hr />
<div>{{Chapter Template|chaptername=New_Zealand|extra=The chapter leaders are [mailto:nick.freeman@owasp.org Nick Freeman] and [mailto:scott.bell@owasp.org Scott Bell] |mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-newzealand|emailarchives=http://lists.owasp.org/pipermail/owasp-newzealand}}<br />
<br />
[[Category:OWASP Chapter]]<br />
== Upcoming Event ==<br />
<br />
TBA<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' [http://www.owasp.org/images/5/5e/2011-03-02-OWASP.pdf I know what you did last summer: The latest from the world of web hacks]<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Nick Freeman and Scott Bell have been appointed as the new leaders of the new OWASP New Zealand Chapter<br />
* Roberto Suggi Liverani has resigned from his position as OWASP New Zealand Chapter Leader<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader - Auckland)</b> [mailto:nick.freeman(at)owasp.org Nick Freeman] 021 424 777<br />
*<b>NZ Board Memeber (Leader - Wellington)</b> [mailto:scott.bell(at)owasp.org Scott Bell] 021 045 6672<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106147New Zealand2011-03-02T21:35:58Z<p>Rsl81: </p>
<hr />
<div>{{Chapter Template|chaptername=New_Zealand|extra=The chapter leaders are [mailto:nick.freeman@owasp.org Nick Freeman] and [mailto:scott.bell@owasp.org Scott Bell] |mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-newzealand|emailarchives=http://lists.owasp.org/pipermail/owasp-newzealand}}<br />
<br />
[[Category:OWASP Chapter]]<br />
== Upcoming Event ==<br />
<br />
TBA<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' [http://www.owasp.org/images/5/5e/2011-03-02-OWASP.pdf I know what you did last summer: The latest from the world of web hacks]<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Nick Freeman and Scott Bell have been appointed as the new leaders of the new OWASP New Zealand Chapter<br />
* Roberto Suggi Liverani has resigned from his position as OWASP New Zealand Chapter Leader<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader - Auckland)</b> [mailto:nick.freeman(at)security-assessment.com Nick Freeman] 021 424 777<br />
*<b>NZ Board Memeber (Leader - Wellington)</b> [mailto:scott.bell(at)security-assessment.com Scott Bell] 021 045 6672<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106143New Zealand2011-03-02T21:19:57Z<p>Rsl81: /* 2011 */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
TBA<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' [http://www.owasp.org/images/5/5e/2011-03-02-OWASP.pdf I know what you did last summer: The latest from the world of web hacks]<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Nick Freeman and Scott Bell have been appointed as the new leaders of the new OWASP New Zealand Chapter<br />
* Roberto Suggi Liverani has resigned from his position as OWASP New Zealand Chapter Leader<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader - Auckland)</b> [mailto:nick.freeman(at)security-assessment.com Nick Freeman] 021 424 777<br />
*<b>NZ Board Memeber (Leader - Wellington)</b> [mailto:scott.bell(at)security-assessment.com Scott Bell] 021 045 6672<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=File:2011-03-02-OWASP.pdf&diff=106142File:2011-03-02-OWASP.pdf2011-03-02T21:18:07Z<p>Rsl81: </p>
<hr />
<div></div>Rsl81https://wiki.owasp.org/index.php?title=User:Rsl81&diff=106141User:Rsl812011-03-02T21:16:13Z<p>Rsl81: </p>
<hr />
<div>Hi, my name is Roberto Suggi Liverani. I am the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand] Founder. I work as Principal Security Consultant for Security-Assessment.com. <br />
<br />
Feel free to contact me at robertosl <at> owasp <dot> org . Personal Site: [http://malerisch.net http://malerisch.net]</div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106140New Zealand2011-03-02T21:13:22Z<p>Rsl81: /* Activities */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
TBA<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' I know what you did last summer: The latest from the world of web hacks<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Nick Freeman and Scott Bell have been appointed as the new leaders of the new OWASP New Zealand Chapter<br />
* Roberto Suggi Liverani has resigned from his position as OWASP New Zealand Chapter Leader<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader - Auckland)</b> [mailto:nick.freeman(at)security-assessment.com Nick Freeman] 021 424 777<br />
*<b>NZ Board Memeber (Leader - Wellington)</b> [mailto:scott.bell(at)security-assessment.com Scott Bell] 021 045 6672<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106139New Zealand2011-03-02T21:12:51Z<p>Rsl81: /* Activities */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
TBA<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' I know what you did last summer: The latest from the world of web hacks<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Nick Freeman and Scott Bell have been appointed as the new leaders of the new OWASP New Zealand Chapter Leaders<br />
* Roberto Suggi Liverani has resigned from his position as OWASP New Zealand Chapter Leader<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader - Auckland)</b> [mailto:nick.freeman(at)security-assessment.com Nick Freeman] 021 424 777<br />
*<b>NZ Board Memeber (Leader - Wellington)</b> [mailto:scott.bell(at)security-assessment.com Scott Bell] 021 045 6672<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106138New Zealand2011-03-02T21:11:06Z<p>Rsl81: /* OWASP NZ Members */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
TBA<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' I know what you did last summer: The latest from the world of web hacks<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader - Auckland)</b> [mailto:nick.freeman(at)security-assessment.com Nick Freeman] 021 424 777<br />
*<b>NZ Board Memeber (Leader - Wellington)</b> [mailto:scott.bell(at)security-assessment.com Scott Bell] 021 045 6672<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106137New Zealand2011-03-02T21:07:35Z<p>Rsl81: /* Upcoming Event */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
TBA<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' I know what you did last summer: The latest from the world of web hacks<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106136New Zealand2011-03-02T21:06:21Z<p>Rsl81: /* Past Events */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About.<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' I know what you did last summer: The latest from the world of web hacks<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
: '''Meeting Locations:''' Auckland, 12-16 Nicholls Lane, Parnell, Level 1, Building 2 - Security-Assessment.com (Datacraft Building)<br />
: '''Meeting Locations:''' Wellington, Datacraft House, Level 1, 99-105 Customhouse Quay, Wellington 6011<br />
<br />
== Past Events ==<br />
<br />
== '''2011''' ==<br />
<br />
<!-- 2011 --><br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About..<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' I know what you did last summer: The latest from the world of web hacks<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=106064New Zealand2011-03-02T04:41:34Z<p>Rsl81: /* OWASP NZ Members */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About.<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' I know what you did last summer: The latest from the world of web hacks<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
: '''Meeting Locations:''' Auckland, 12-16 Nicholls Lane, Parnell, Level 1, Building 2 - Security-Assessment.com (Datacraft Building)<br />
: '''Meeting Locations:''' Wellington, Datacraft House, Level 1, 99-105 Customhouse Quay, Wellington 6011<br />
<br />
== Past Events == <br />
<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
Security-Assessment.com <br><br />
Level 1 - Building 2<br><br />
12-16 Nicholls Lane, Parnell, Auckland 1010<br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=105566New Zealand2011-02-22T21:01:26Z<p>Rsl81: /* Upcoming Event */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About.<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' I know what you did last summer: The latest from the world of web hacks<br />
: '''Presented By:''' Kirk Jackson, Security Consultant (Aura Software Security)<br />
: '''Meeting Locations:''' Auckland, 12-16 Nicholls Lane, Parnell, Level 1, Building 2 - Security-Assessment.com (Datacraft Building)<br />
: '''Meeting Locations:''' Wellington, Datacraft House, Level 1, 99-105 Customhouse Quay, Wellington 6011<br />
<br />
== Past Events == <br />
<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
NZ OWASP <br><br />
17 Woodberry Drive<br><br />
Dannemora, Auckland 2016 <br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=105086New Zealand2011-02-14T22:32:23Z<p>Rsl81: /* Upcoming Event */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About.<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Meeting Locations:''' Auckland, 12-16 Nicholls Lane, Parnell, Level 1, Building 2 - Security-Assessment.com (Datacraft Building)<br />
: '''Meeting Locations:''' Wellington, Datacraft House, Level 1, 99-105 Customhouse Quay, Wellington 6011<br />
<br />
== Past Events == <br />
<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
NZ OWASP <br><br />
17 Woodberry Drive<br><br />
Dannemora, Auckland 2016 <br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=105069New Zealand2011-02-14T21:55:47Z<p>Rsl81: /* Upcoming Event */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About.<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
: '''Meeting Locations:''' Auckland, 12-16 Nicholls Lane, Parnell, Level 1, Building 2 - Security-Assessment.com (Datacraft Building)<br />
: '''Meeting Locations:''' Wellington, 3rd Floor Lumley House, Hunter Street<br />
<br />
== Past Events == <br />
<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
NZ OWASP <br><br />
17 Woodberry Drive<br><br />
Dannemora, Auckland 2016 <br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=105068New Zealand2011-02-14T21:50:08Z<p>Rsl81: /* Upcoming Event */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About.<br />
: '''Presented By:''' Adrian Hayes, Security Consultant (Security-Assessment.com)<br />
<br />
== Past Events == <br />
<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
NZ OWASP <br><br />
17 Woodberry Drive<br><br />
Dannemora, Auckland 2016 <br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=105067New Zealand2011-02-14T21:49:46Z<p>Rsl81: /* Upcoming Event */</p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
; 2nd March 2011<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Crazy Insecure Web Apps Google Didn't Tell You About.<br />
: '''Presented By:''' Adrain Hayes, Security Consultant (Security-Assessment.com)<br />
<br />
== Past Events == <br />
<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
NZ OWASP <br><br />
17 Woodberry Drive<br><br />
Dannemora, Auckland 2016 <br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=File:Tales-of-the-crypto.pdf&diff=86776File:Tales-of-the-crypto.pdf2010-07-22T12:49:35Z<p>Rsl81: uploaded a new version of "File:Tales-of-the-crypto.pdf"</p>
<hr />
<div></div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86774OWASP New Zealand Day 20102010-07-22T01:47:51Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event was held on the <b>15th July 2010</b> in <b>Auckland</b> and was a great conference day. The event gathered an audience of 160 delegates including security professionals, developers, managers and students.<br><br />
For those people who missed the event or are interested in the conference material, some of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations presentations] have been published and can be downloaded from the presentations page.<br><br />
For any comments, feedback or observations, please don't hesitate to contact [mailto:robertosl@owasp.org us].<br><br />
Again, big thanks to the sponsors <b>Security-Assessment.com</b> and <b>Lateral Security</b>, the speakers and the conference committee for their contributions and support to the organisation of the event.<br />
<br />
==Blog/Coverage==<br />
<br />
Some blog coverage from Kirk Jackson:<br />
[http://pageofwords.com/blog/CategoryView,category,OWASP.aspx http://pageofwords.com/blog/CategoryView,category,OWASP.aspx]<br />
<br />
<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>[http://www.owasp.org/images/b/b5/2010_OWASP_NZ.pptx Don't Try This At Home]</b> - pptx<br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks]</b> - pdf<br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b> - pdf<br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/4/49/Hosting-and-web-apps.pdf Hosting and Web Apps - The Obscurity of Security]</b> - pdf<br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86773OWASP New Zealand Day 20102010-07-22T01:46:29Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event was held on the <b>15th July 2010</b> in <b>Auckland</b> and was a great conference day. The event gathered an audience of 160 delegates including security professionals, developers, managers and students.<br><br />
For those people who missed the event or are interested in the conference material, some of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations presentations] have been published and can be downloaded from the presentations page.<br><br />
For any comments, feedback or observations, please don't hesitate to contact [mailto:robertosl@owasp.org us].<br><br />
Again, big thanks to the sponsors <b>Security-Assessment.com</b> and <b>Lateral Security</b>, the speakers and the conference committee for their contributions and support to the organisation of the event.<br />
<br />
==Blog/Coverage==<br />
<br />
Some blog coverage from Kirk Jackson:<br />
[http://pageofwords.com/blog/CategoryView,category,OWASP.aspx http://pageofwords.com/blog/CategoryView,category,OWASP.aspx]<br />
<br />
<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>[http://www.owasp.org/images/b/b5/2010_OWASP_NZ.pptx Don't Try This At Home]</b> - PowerPoint<br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks]</b> - pdf<br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b> - pdf<br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/4/49/Hosting-and-web-apps.pdf Hosting and Web Apps - The Obscurity of Security]</b> - pdf<br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=File:2010_OWASP_NZ.pptx&diff=86772File:2010 OWASP NZ.pptx2010-07-22T01:43:43Z<p>Rsl81: </p>
<hr />
<div></div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86707OWASP New Zealand Day 20102010-07-19T22:53:48Z<p>Rsl81: /* Introduction */</p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event was held on the <b>15th July 2010</b> in <b>Auckland</b> and was a great conference day. The event gathered an audience of 160 delegates including security professionals, developers, managers and students.<br><br />
For those people who missed the event or are interested in the conference material, some of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations presentations] have been published and can be downloaded from the presentations page.<br><br />
For any comments, feedback or observations, please don't hesitate to contact [mailto:robertosl@owasp.org us].<br><br />
Again, big thanks to the sponsors <b>Security-Assessment.com</b> and <b>Lateral Security</b>, the speakers and the conference committee for their contributions and support to the organisation of the event.<br />
<br />
==Blog/Coverage==<br />
<br />
Some blog coverage from Kirk Jackson:<br />
[http://pageofwords.com/blog/CategoryView,category,OWASP.aspx http://pageofwords.com/blog/CategoryView,category,OWASP.aspx]<br />
<br />
<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks]</b> - pdf<br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b> - pdf<br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/4/49/Hosting-and-web-apps.pdf Hosting and Web Apps - The Obscurity of Security]</b> - pdf<br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86706OWASP New Zealand Day 20102010-07-19T22:52:15Z<p>Rsl81: /* Introduction */</p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event was held on the <b>15th July 2010</b> in <b>Auckland</b> and was a great conference day. The event gathered an audience of 160 delegates including security professionals, developers, managers and students.<br><br />
For those people who missed the event or are interested in the conference material, some of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations presentations] have been published and can be downloaded from the presentations page.<br><br />
For any comments, feedback or observations, please don't hesitate to contact [mailto:robertosl@owasp.org us].<br><br />
Again, big thanks to the sponsors Security-Assessment.com and Lateral Security, the speakers and the conference committee for their contributions and support to the organisation of the event.<br />
<br />
==Blog/Coverage==<br />
<br />
Some blog coverage from Kirk Jackson:<br />
[http://pageofwords.com/blog/CategoryView,category,OWASP.aspx http://pageofwords.com/blog/CategoryView,category,OWASP.aspx]<br />
<br />
<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks]</b> - pdf<br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b> - pdf<br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/4/49/Hosting-and-web-apps.pdf Hosting and Web Apps - The Obscurity of Security]</b> - pdf<br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86705OWASP New Zealand Day 20102010-07-19T22:51:18Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event was held on the <b>15th July 2010</b> in <b>Auckland</b> and was a great conference day. The event gathered an audience of 160 delegates including security professionals, developers, managers and students.<br><br />
For those people who missed the event or are interested in the conference material, the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations presentations] have been published and can be downloaded from the presentations page.<br><br />
For any comments, feedback or observations, please don't hesitate to contact [mailto:robertosl@owasp.org us].<br><br />
Again, big thanks to the sponsors Security-Assessment.com and Lateral Security, the speakers and the conference committee for their contributions and support to the organisation of the event.<br />
<br />
==Blog/Coverage==<br />
<br />
Some blog coverage from Kirk Jackson:<br />
[http://pageofwords.com/blog/CategoryView,category,OWASP.aspx http://pageofwords.com/blog/CategoryView,category,OWASP.aspx]<br />
<br />
<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks]</b> - pdf<br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b> - pdf<br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/4/49/Hosting-and-web-apps.pdf Hosting and Web Apps - The Obscurity of Security]</b> - pdf<br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=File:Hosting-and-web-apps.pdf&diff=86704File:Hosting-and-web-apps.pdf2010-07-19T22:49:39Z<p>Rsl81: </p>
<hr />
<div></div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=86681New Zealand2010-07-19T04:19:52Z<p>Rsl81: </p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
TBD<br />
<br />
== Past Events == <br />
<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 15th July 2010<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2010|OWASP New Zealand Day 2010]]<br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
NZ OWASP <br><br />
17 Woodberry Drive<br><br />
Dannemora, Auckland 2016 <br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86679OWASP New Zealand Day 20102010-07-19T03:15:05Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event was held on the <b>15th July 2010</b> in <b>Auckland</b> and was a great conference day. The event gathered an audience of 160 delegates including security professionals, developers, managers and students.<br><br />
For those people who missed the event or are interested in the conference material, the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Presentations presentations] have been published and can be downloaded from the presentations page.<br><br />
For any comments, feedback or observations, please don't hesitate to contact [mailto:robertosl@owasp.org us].<br><br />
Again, big thanks to the sponsors Security-Assessment.com and Lateral Security, the speakers and the conference committee for their contributions and support to the organisation of the event.<br />
<br />
==Blog/Coverage==<br />
<br />
Some blog coverage from Kirk Jackson:<br />
[http://pageofwords.com/blog/CategoryView,category,OWASP.aspx http://pageofwords.com/blog/CategoryView,category,OWASP.aspx]<br />
<br />
<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks]</b> - pdf<br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b> - pdf<br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86678OWASP New Zealand Day 20102010-07-19T03:14:30Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event was held on the <b>15th July 2010</b> in <b>Auckland</b> and was a great conference day. The event gathered an audience of 160 delegates including security professionals, developers, managers and students.<br><br />
For those people who missed the event or are interested in the conference material, the presentations have been published and can be downloaded from the presentations page.<br><br />
For any comments, feedback or observations, please don't hesitate to contact [mailto:robertosl@owasp.org us].<br><br />
Again, big thanks to the sponsors Security-Assessment.com and Lateral Security, the speakers and the conference committee for their contributions and support to the organisation of the event.<br />
<br />
==Blog/Coverage==<br />
<br />
Some blog coverage from Kirk Jackson:<br />
[http://pageofwords.com/blog/CategoryView,category,OWASP.aspx http://pageofwords.com/blog/CategoryView,category,OWASP.aspx]<br />
<br />
<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks]</b> - pdf<br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b> - pdf<br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86673OWASP New Zealand Day 20102010-07-19T02:38:17Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks]</b> - pdf<br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b> - pdf<br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86672OWASP New Zealand Day 20102010-07-19T02:37:14Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks] - pdf</b><br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>[http://www.owasp.org/images/c/cc/Tales-of-the-crypto.pdf Tales from the Crypt0]</b><br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=File:Tales-of-the-crypto.pdf&diff=86671File:Tales-of-the-crypto.pdf2010-07-19T02:36:10Z<p>Rsl81: </p>
<hr />
<div></div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86670OWASP New Zealand Day 20102010-07-19T02:34:15Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>[http://www.owasp.org/images/0/04/Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf Defending Against Application Level DoS Attacks] - pdf</b><br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>Tales from the Crypt0</b><br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=File:Roberto_Suggi_Liverani_OWASPNZDAY2010-Defending_against_application_DoS.pdf&diff=86669File:Roberto Suggi Liverani OWASPNZDAY2010-Defending against application DoS.pdf2010-07-19T02:30:16Z<p>Rsl81: Defending against application (L7) DoS Attacks</p>
<hr />
<div>Defending against application (L7) DoS Attacks</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86668OWASP New Zealand Day 20102010-07-19T02:26:26Z<p>Rsl81: /* Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go? */</p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Defending Against Application Level DoS Attacks</b><br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>Tales from the Crypt0</b><br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Low Scuttling Chilli Crab:NETWORK RECON 2010AD **== <br />
<br />
Network reconnaissance is an art as old as hacking, but the days of dumpster diving and fingering your away around the 'net are long in our past. In the world of Google, Wolfram|Alpha and Shodan, target acquisition is king: there's a new exploit every day, who's going down after you've finished your first cup of coffee tomorrow?<br />
<br />
In this presentation, Metlstorm examines the practicality, implementation and effect of datamining country-scale network targeting databases. Building on the experience of spending the previous year mapping the New Zealand internet for his Kiwicon 2009 talk "Do Your Fruit Hang Low", Metlstorm deploys the Low Hanging Kiwifruit toolchain against its newest target: Singapore.<br />
<br />
So, Singapore, are your networks open? How many open DSL routers are there in Singapore? Which ISP has their blade switches open for you to telnet to? Just how useful is it to full text search every SSL certificate name, 302 Redirect target and DNS entry?<br />
<br />
<b>Metlstorm</b><br />
<br />
Metlstorm is an independent unix hacker from New Zealand, where he milks both sheep and hobbits. In the brief gaps in this bucolic schedule, he finds time to organise Kiwicon - the NZ hacker con, co-host the award-winning Risky.biz weekly infosec podcast and hold down a day job as a whitehat security consultant. In true sellout style, Metl has worked the floor at Blackhat, Defcon, Kiwicon & Ruxcon, achieving minor notoriety at the latter for being the only speaker ever punched out by a member of the audience at the end of his talk. Metlstorm loves bugs that are features, carrier networks and "enterprise" unix software, because we all know that "enterprise" means "the 80s called, they want their long environment variables back".<br />
<br />
- <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk</i>.<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86667OWASP New Zealand Day 20102010-07-19T02:19:12Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Defending Against Application Level DoS Attacks</b><br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD **</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>Tales from the Crypt0</b><br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<br />
</table> <br />
</center><br />
<b>**</b> <i>replaced Scott Bell's "Web Application Vulnerabilities: How far does the rabbit hole go?" talk.</i><br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=86666OWASP New Zealand Day 20102010-07-19T02:10:56Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Presentations====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Defending Against Application Level DoS Attacks</b><br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br/><br />
<em>Paul Craig – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Low Scuttling Chilli Crab:Network Recon 2010AD</b><br /><br />
<em>Metlstorm</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>Tales from the Crypt0</b><br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
</table> <br />
</center><br />
<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=New_Zealand&diff=86452New Zealand2010-07-14T10:00:08Z<p>Rsl81: </p>
<hr />
<div>== Welcome to the OWASP New Zealand Local Chapter ==<br />
<br />
Welcome to the OWASP New Zealand chapter site. <br />
<br />
== Participation ==<br />
<br />
Get involved! All OWASP chapter meetings are free and open to anyone interested in application security and New Zealand is no different. We encourage members to give presentations on any OWASP related topic and to share their knowledge with the rest of the OWASP NZ chapter. Please also subscribe to the [https://lists.owasp.org/mailman/listinfo/owasp-newzealand OWASP NZ Mailing-list] to receive future event announcements or access previous [https://lists.owasp.org/pipermail/owasp-newzealand/ posts].<br />
<br />
== Upcoming Event ==<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
<br />
For more information, please visit: [https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010]<br />
<br />
Registration is now closed.<br />
<br />
== Past Events == <br />
<br />
<br />
== '''2010''' ==<br />
<br />
<!-- 2010 --><br />
<br />
; 4th March 2010<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' MS-SQL Injections.<br />
: '''Presented By:''' Scott Bell, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
== '''2009''' ==<br />
<br />
<!-- 2009 --><br />
<br />
; 10th November 2009<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' Testing AMF/Flex.<br />
: '''Presented By:''' Nick Freeman, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Shared Ownership", from a web security perspective.<br />
: '''Presented By:''' Quintin Russ, Technical Director (Site Host)<br />
<br />
<br />
; 13th July 2009<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 https://www.owasp.org/images/8/85/Owasp_nz_logo.jpg]<br />
: '''Co-Sponsor:''' [http://www.security-assessment.com Security-Assessment.com], [http://www.lateralsecurity.com Lateral Security], [http://www.auckland.ac.nz/ The University of Auckland]<br />
: '''Location:''' Auckland<br />
: '''Presentations:''' [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Download] <br />
: '''Event site:''' [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]]<br />
<br />
<br />
; 19th March 2009<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:ActiveXploitation_In_2009.pptx ActiveXploitation in 2009]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:OWASP_Mar09_Reversing_JavaScript.zip Reversing JavaScript]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Senior Security Consultant (Security-Assessment.com)<br />
<hr><br />
<br />
== '''2008''' ==<br />
<br />
<!-- 2008 --><br />
; 5th November 2008<br />
: '''Co-Sponsor:''' [http://www.vodafone.co.nz Vodafone New Zealand] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Common_Application_Flaws.ppt Common Application Flaws]"<br />
: '''Presented By:''' Brett Moore, Network Intrusion Specialist (Insomnia Security)<br />
: '''Presentation:''' "In your Browser, Jackin your Clicks"<br />
: '''Presented By:''' Beau Butler, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "Opera Stored Cross Site Scripting"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 3rd September 2008<br />
: '''Co-Sponsor:''' [http://www.microsoft.com/en/nz/default.aspx Microsoft] and [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Browser_security.ppt Browser Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Time_Based_SQL_Injections.ppt Time based blind SQL Injections]"<br />
: '''Presented By:''' Muhaimin Dzulfakar, Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 25th June 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "Fuzz the Web"<br />
: '''Presented By:''' Dean Jerkovich, Security Analyst (ASB)<br />
: '''Presentation:''' "Hacking The World With Flash Part #2: The Results"<br />
: '''Presented By:''' Paul Crag, Principal Security Consultant (Security-Assessment.com)<br />
<br />
<br />
; 29th April 2008<br />
: '''Co-Sponsor:''' [http://security-assessment.com Security-Assessment.com]<br />
: '''Locations:''' Wellington, Auckland<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Hacking_The_World_With_Flash.ppt Hacking The World With Flash]"<br />
: '''Presented By:''' Paul Craig, Principal Security Consultant (Security-Assessment.com)<br />
: '''Presentation:''' "[https://www.owasp.org/index.php/Image:Web_spam_techniques.ppt Web Spam Techniques] - also available in [http://malerisch.net/docs/web_spam_techniques/web_spam_techniques.html HTML] format"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-Assessment.com)<br />
<br />
; 21st February 2008<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://www.owasp.org/index.php/Image:Xpath_Injection.ppt Xpath Injection - An Overview]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
<br />
<hr><br />
<br />
== '''2007''' ==<br />
<br />
<!-- 2007 --><br />
; 5th December 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "[http://malerisch.net/docs/ajax_security/Ajax_security.ppt Ajax Security]"<br />
: '''Presented By:''' Roberto Suggi Liverani, Security Consultant (Security-assessment.com)<br />
: '''Presentation:''' "On the job browser exploitation"<br />
: '''Presented By:''' Mark Piper, Senior Security Consultant (Security-assessment.com)<br />
<br />
; 22nd May 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Press Release:''' [http://www.vedaadvantage.com/vantage/news_in_brief_and_events/host_nz_owasp_meeting.aspx VedaAdvantage.com]<br />
: '''Locations:''' Auckland<br />
: '''Presentation:''' "OWASP in New Zealand"<br />
: '''Presented By:''' Roberto Suggi Liverani / Antonio Spera<br />
<br />
; April 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
; January 2007<br />
: '''Co-Sponsor:''' [http://www.vedaadvantage.com/home/home_default.aspx Veda Advantage]<br />
: '''Locations:''' Auckland<br />
<br />
== Activities == <br />
<br />
OWASP New Zealand members actively participate in various OWASP activities. The following are some recent activities undertaken by OWASP NZ members: <br />
<br />
* Roberto Suggi Liverani will be speaking at OWASP AppSec Asia 2009 conference<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at Defcon 17<br />
* OWASP NZ Day 2009 - [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009#tab=Presentations Presentations online]<br />
* Roberto Suggi Liverani and Nick Freeman will be speaking at EUSecWest 09<br />
* Brett Moore will be speaking at [http://www.owasp.org/index.php/OWASP_AU_Conference_2009 OWASP AU Conference] about "Vulnerabilities In Action".<br />
* Roberto Suggi Liverani contributed to the [http://www.owasp.org/index.php/OWASP_Testing_Project OWASP Testing Guide v3].<br />
* Mark Piper took his "On the job browser exploitation" talk to the [http://www.owasp.org/index.php/OWASP_Australia_AppSec_2008_Conference OWASP_Australia_AppSec_2008_Conference].<br />
* Rob Munro has been appointed as OWASP Evangelist<br />
* OWASP NZ has audio/video conference capability between Auckland and Wellington<br />
<br />
== OWASP NZ Members == <br />
<br />
We are always looking for additional board members to evangelise the OWASP mission help with meetings, projects and initiatives as we all know it takes time/effort to run a chapter. Please contact us if you are interested to join the NZ OWASP board member or for any queries related to OWASP NZ.<br />
<br />
<ul><br />
*<b>NZ Board Member (Leader)</b> [mailto:robertosl(at)owasp.org Roberto Suggi Liverani] 021 928 780<br />
*<b>NZ Board Member (Evangelist)</b> [mailto:rob(at)robmunro.com Rob Munro] 021 677 785<br />
</ul><br />
<br />
<br />
<u>The chapter mailing address is:</u><br><br />
NZ OWASP <br><br />
17 Woodberry Drive<br><br />
Dannemora, Auckland 2016 <br><br />
<br><br />
<br />
== Chapter Sponsors ==<br />
<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table></div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85811OWASP New Zealand Day 20102010-07-04T11:00:31Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Agenda====<br />
<br />
<center><br />
<table width="80%" class="t"><br />
<tr><br />
<td width="7%" class="tcell3" valign="top"><div align="right">08:30</div></td><br />
<td bgcolor="#8595C2" class="tcell3"> <div align="left">Registration <br />
</div></td><br />
</tr><br />
<tr><br />
<br />
<td class="tcell2" valign="top"><div align="right">09:00</div></td> <br />
<td bgcolor="#eeeeee" class="tcell"><div align="center"><b>Welcome to OWASP New Zealand Day 2010</b><br /> <br />
<em>Roberto Suggi Liverani / Lech Janczewski - Security-Assessment.com / The University of Auckland</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">09:15</div></td> <br />
<td bgcolor="#b9c2dc" class="tcell"><div align="center"><b>Don't Try This At Home</b><br/><br />
<em>Brett Moore - Insomnia Security</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">9:50</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Defending Against Application Level DoS Attacks</b><br/><br />
<em>Roberto Suggi Liverani - Security-Assessment.com</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">10:40</div></td><br />
<td bgcolor="#D98B66" class="tcell"><div align="left">Coffee Break<br /><br />
<br /><br />
</div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">11:10</div></td><br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>Web Application Vulnerabilities: How far does the rabbit hole go?</b><br/><br />
<em>Scott Bell – Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell3" valign="top"><div align="right">12:00</div></td> <br />
<td bgcolor="#D98B66" class="tcell3"><div align="left">Lunch Break<br /><br />
<br /><br />
<br /><br />
</div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">13:30</div></td> <br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>"Oh F#!K": What To Do When You Get Pwned</b><br /><br />
<em>Paul Craig - Security-Assessment.com</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">14:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>Tales from the Crypt0</b><br/><br />
<em>Graeme Neilson / Kirk Jackson - Aura Software Security / Xero</em></div></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:00</div></td><br />
<td bgcolor="#D98B66" class="tcell">Snackie Break<br /><br />
<br /></td><br />
</tr><br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">15:30</div></td><br />
<td bgcolor="#EEEEEE" class="tcell"><div align="center"><b>Hosting and Web Apps - The Obscurity of Security</b><br/><br />
<em>Quintin Russ / Mike Jager - SiteHost / Web Drive</em></div></td><br />
</tr><br />
<br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">16:15</div></td> <br />
<td bgcolor="#B9C2DC" class="tcell"><div align="center"><b>The Ramblings of an ex-QSA</b><br /><br />
<em>Dean Carter</em></div></td><br />
</tr> <br />
<tr><br />
<td class="tcell2" valign="top"><div align="right">17:00</div></td> <br />
<td bgcolor="#B5B5B5" class="tcell"><div align="left">Panel Discussion/Conclusion<br /><br />
<br /><br />
</div></td><br />
</tr><br />
</table> <br />
</center><br />
<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85797OWASP New Zealand Day 20102010-07-03T04:13:52Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over eight years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Adobe and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85749OWASP New Zealand Day 20102010-07-01T22:48:48Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Brett Moore - Insomnia Security - "Don't Try This At Home"==<br />
<br />
During source code and application reviews a number of common issues are<br />
often seen. Developers making the same mistakes time and time again. There<br />
are also those 'unique' issues that only come up once in a while, when<br />
people handroll their own methods to solve a particular problem.<br />
<br />
Over the course of this talk, the speaker will explain and describe a number<br />
of issues that he has seen over the last 24 months in locally developed<br />
code. This is an opportunity to see what local developers are doing wrong,<br />
and why you shouldn't try this at home.<br />
<br />
<b>Brett Moore</b><br />
<br />
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over six years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
==Quintin Russ / Mike Jager - SiteHost / Web Drive - Hosting and Web Apps - The Obscurity of Security==<br />
<br />
The security of web applications has traditionally been considered to be<br />
the problem of the company whose servers they were hosted upon. However,<br />
while you can outsource the hosting of web apps, you cannot outsource<br />
the responsibility of ensuring that those apps are secure. Mike and<br />
Quintin set aside their corporate rivalry to demonstrate the gap between<br />
the way things are and the way things should be.<br />
<br />
<b>Quintin Russ</b><br />
<br />
Quintin has carved out his own niche in the .nz hosting industry, having<br />
spent a large proportion of the last few years becoming an expert in<br />
both building and defending systems. He now runs enough infrastructure<br />
to ensure he never, ever gets a good night's sleep, and sometimes<br />
doesn't even get to snooze through Sunday mornings. Quintin has a keen<br />
interest in security, especially as it relates to web hosting. This has<br />
ranged from the vicissitudes of shared hosting to code reviews of<br />
popular blogging applications. He has previously presented at ISIG and<br />
Kiwicon 2009.<br />
<br />
<b>Mike Jager</b><br />
<br />
Since his arrival at Web Drive in 2004, Mike has been sticking his<br />
fingers into the wall sockets of web hosting. Currently, he herds<br />
packets, mutters at clouds, and sneaks up on web applications, tricking<br />
them into scaling horizontally when they least expect it. Mike holds a<br />
BE in Computer Systems Engineering from the University of Auckland, and<br />
has been spotted presenting recently at NZNOG, APRICOT and the<br />
occasional ISIG meeting.<br />
<br />
<br />
==Roberto Suggi Liverani - Security-Assessment.com - Defending Against Application Level DoS Attacks==<br />
<br />
Secure code practices, system hardening, due diligence and due care principles are paramount in mitigating application level DoS attacks.<br />
These attacks often result in significant damage against unprepared and vulnerable organisations.<br />
<br />
The intent of this talk is to help organisations in strengthening their security posture against such attacks. The talk will explore most common application level DoS attacks and will provide recommendations for protecting applications, detecting attacks and how to react under stressful conditions.<br />
<br />
<b>Roberto Suggi Liverani</b><br />
<br />
Roberto Suggi Liverani is a senior security consultant for Security-Assessment.com. He is the founder and <br />
leader of the OWASP (Open Web Application Security Project) in New Zealand. Roberto has worked with <br />
companies such as Google, Oracle and Opera by reporting and helping to fix security vulnerabilities in their <br />
products. Roberto is the co-author of the most recent OWASP Testing Guide and has spoken at various <br />
security conferences around the globe.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85665OWASP New Zealand Day 20102010-06-30T00:39:33Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 30th June 2010<br />
* Contributions submission deadline: 10th July 2010 <br />
* Registration deadline: 30th June 2010<br />
* Conference Agenda due: 2nd July 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85664OWASP New Zealand Day 20102010-06-30T00:38:13Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP is now closed.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 15th June 2010<br />
* Contributions submission deadline: 25th June 2010 <br />
* Registration deadline: 20th June 2010<br />
* Conference Agenda due: 20th June 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85662OWASP New Zealand Day 20102010-06-30T00:35:26Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Registration is now closed.<br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP will close on the 30th June 2010.</b><br />
<br />
====Call For Sponsorships (CLOSED)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (CLOSED) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 15th June 2010<br />
* Contributions submission deadline: 25th June 2010 <br />
* Registration deadline: 20th June 2010<br />
* Conference Agenda due: 20th June 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85476OWASP New Zealand Day 20102010-06-27T20:48:08Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Entry to the event is '''free'''. Registration is mandatory in order to attend. To register at the conference, please click the registration link below:<br> <br />
<center><br />
[http://owaspnzday2010.eventbrite.com https://www.owasp.org/images/9/9d/Register_now.gif]<br />
</center><br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP will close on the 30th June 2010.</b><br />
<br />
====Call For Sponsorships (OPEN)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (OPEN) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 15th June 2010<br />
* Contributions submission deadline: 25th June 2010 <br />
* Registration deadline: 20th June 2010<br />
* Conference Agenda due: 20th June 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85474OWASP New Zealand Day 20102010-06-27T11:53:58Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Entry to the event is '''free'''. Registration is mandatory in order to attend. To register at the conference, please click the registration link below:<br> <br />
<center><br />
[http://owaspnzday2010.eventbrite.com https://www.owasp.org/images/9/9d/Register_now.gif]<br />
</center><br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP will close on the 30th June 2010.</b><br />
<br />
====Call For Sponsorships (OPEN)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (OPEN) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 15th June 2010<br />
* Contributions submission deadline: 25th June 2010 <br />
* Registration deadline: 20th June 2010<br />
* Conference Agenda due: 20th June 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>Department of Computer Science</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=85146OWASP New Zealand Day 20102010-06-20T23:34:09Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Entry to the event is '''free'''. Registration is mandatory in order to attend. To register at the conference, please click the registration link below:<br> <br />
<center><br />
[http://owaspnzday2010.eventbrite.com https://www.owasp.org/images/9/9d/Register_now.gif]<br />
</center><br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP will close on the 30th June 2010.</b><br />
<br />
====Call For Sponsorships (OPEN)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (OPEN) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 15th June 2010<br />
* Contributions submission deadline: 25th June 2010 <br />
* Registration deadline: 20th June 2010<br />
* Conference Agenda due: 20th June 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>Department of Computer Science<br>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=84996OWASP New Zealand Day 20102010-06-16T21:37:25Z<p>Rsl81: </p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Entry to the event is '''free'''. Registration is mandatory in order to attend. To register at the conference, please click the registration link below:<br> <br />
<center><br />
[http://owaspnzday2010.eventbrite.com https://www.owasp.org/images/9/9d/Register_now.gif]<br />
</center><br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
==Scott Bell - Web Application Vulnerabilities: How far does the rabbit hole go?== <br />
<br />
We all know SQL Injection and File Inclusion bugs are dangerous. We know they can be used to 'hack you'. But what does this really mean? Do you know the true impact of these bugs? You might think you know the answers, but do you? In this presentation, we will be covering the risk and impact of such vulnerabilities and a demonstration will be shown on how far these bugs can be leveraged.<br />
<br />
<b>Scott Bell</b><br />
<br />
Scott Bell is a security consultant at Security-Assessment.com. He has been involved with IT security for seven years and has a passion for Web Application security. Scott has a PhD in reverse-shell-ology and previously performed penetration testing at Yahoo! Inc.<br />
<br />
<br />
==Dean Carter - The Ramblings of an ex-QSA== <br />
<br />
As a QSA there were a bunch of things Dean was forbidden from discussing.<br />
<br />
As an ex QSA some of these matters will remain firmly sequestered inside his kimono - but others things, more general things, can now be shared.<br />
<br />
Dean has 30 minutes worth of handy tips, hints, lessons and some brickbats relating to PCI and secure system development that he can now share with the community.<br />
<br />
<b>Dean Carter</b><br />
<br />
Dean still remembers the day he first heard about the PCI DSS - he then spent several years trying to convince everyone that the PCI DSS was the bestest thing since the Beatles… not many people listened… they had projects to finish and settings to tweak… <br />
<br />
Then Dean joined Security-Assessment.com and became a QSA (PCI power-up!)… people listened! Organisations even paid to listen! A few organisations went so far as to demonstrate their security posture to Dean The QSA. In return he signed their Reports on Compliance. Most made great progress towards compliance… while some simply went in political circles and denied the need to make any effort.<br />
<br />
Two years on Dean, the ex-QSA, now works for financial institution where, in between other tasks, he regularly sticks his nose into PCI matters and still firmly believes that the PCI DSS is a positive thing.<br />
<br />
<br />
==Paul Craig – Security-Assessment.com - "Oh F#!K" : What To Do When You Get Pwned==<br />
<br />
If your company’s website were hacked tomorrow, would you know what to do?<br />
Forensics is not what you see on CSI, and most people have no idea what they should do in the event of a compromise. What is an appropriate incident response for a company, what do you say to your CEO, when do you involve law enforcement? Do you attempt to solve the forensic case yourself; keeping in mind any action you take may directly affect the evidence, or compromise legal judicial requirements.<br />
This presentation will demonstrate the forensic process for a compromised website, and what an organization should do when they find out they have been compromised. I will use case studies from previous incidents and demonstrate what you should and shouldn’t do when you get pwned.<br />
<br />
<b>Paul Craig</b><br />
<br />
My name is Paul Craig, I work as the lead forensic incident responder at Security-Assessment.com and I work with many New Zealand companies who have been compromised. From small websites to large corporations and government agencies, our nation is regularly being defaced and defrauded. IT Forensics is here to pick up the pieces, and it’s my job to spend long nights trying to provide answers to businesses regarding what really happened.<br />
<br />
<br />
==Graeme Neilson / Kirk Jackson - Aura Software Security / Xero - Tales from the Crypt0==<br />
<br />
Does the thought of SSL, HTTPS and S/MIME make you squeamish?<br />
Does PKI make you want to scream?<br />
Does encrypting data at rest make you want to bury yourself alive?<br />
<br />
Cryptography is an important part of most web applications these days,<br />
and developers and admins need to understand how, why and when to<br />
employ the best and appropriate techniques to secure their servers,<br />
applications, data and the livelihoods of their users.<br />
<br />
Join Graeme Neilson (Aura Software Security) and Kirk Jackson (Xero)<br />
for a series of scary stories in "Tales from the Crypt0".<br />
<br />
<b>Graeme Neilson</b><br />
<br />
Graeme Neilson is lead security researcher at Aura Software Security,<br />
a security consultancy based in Wellington with clients across the globe.<br />
<br />
<b>Kirk Jackson</b><br />
<br />
Kirk Jackson is a developer at Xero, makers of the world's easiest<br />
accounting system.<br />
<br />
<br />
<br><br><br />
<b>Please note that CFP will close on the 30th June 2010.</b><br />
<br />
====Call For Sponsorships (OPEN)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (OPEN) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 15th June 2010<br />
* Contributions submission deadline: 25th June 2010 <br />
* Registration deadline: 20th June 2010<br />
* Conference Agenda due: 20th June 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>Department of Computer Science<br>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2010&diff=83754OWASP New Zealand Day 20102010-05-20T04:39:36Z<p>Rsl81: /* Conference Sponsors */</p>
<hr />
<div>__NOTOC__<br />
====Introduction====<br />
<br />
<center>'''OWASP New Zealand Day 2010<br>15th July - Auckland'''<br />
<br />
[https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 http://www.owasp.org/images/a/a7/Owasp_nz_day_2010.jpg]<br><br><br />
</center><br />
----<br />
<br />
= Introduction =<br />
<br />
Following the success of the [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2009 OWASP New Zealand 2009] security conference which attracted more than 150 attendees, the [http://www.owasp.org/index.php/New_Zealand OWASP New Zealand Chapter] decided to organise the <b>OWASP New Zealand Day 2010</b>. The event will be held on the <b>15th July 2010</b> in <b>Auckland</b>. For those people who missed the first OWASP New Zealand Day, this is a national security conference entirely dedicated to web application security. The intent of the conference is to promote and raise web application security awareness in New Zealand. IT professionals, including security professionals, developers, managers and students are invited to partecipate to this conference.<br />
<br />
== Registration ==<br />
<br />
Entry to the event is '''free'''. Registration is mandatory in order to attend. To register at the conference, please click the registration link below:<br> <br />
<center><br />
[http://owaspnzday2010.eventbrite.com https://www.owasp.org/images/9/9d/Register_now.gif]<br />
</center><br />
<br />
==When & Where==<br />
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="top" width="33%"><b>When</b>:<br />
<br />
Thursday, July 15, 2010 from 9:00 AM - 6:00 PM (GMT+1200)<br />
<br />
Add to Calendar:<br />
* [https://login.yahoo.com/?.done=http://calendar.yahoo.com/%3Fv%3D60%26view%3Dd%26type%3D20%26title%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26st%3D20100714T210000Z%26dur%3D0900%26desc%3DFor%2Bdetails,%2Blink%2Bhere:%2Bhttp://owaspnzday2010.eventbrite.com%26in_loc%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Yahoo Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=outlook Outlook Calendar]<br />
* [https://www.google.com/accounts/ServiceLogin?service=cl&passive=1209600&continue=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand&followup=http://www.google.com/calendar%3Faction%3DTEMPLATE%26text%3DOWASP%2BNew%2BZealand%2BDay%2B2010%26dates%3D20100714T210000Z%252F20100715T060000Z%26details%3DFor%2Bdetails%252C%2Blink%2Bhere%253A%2Bhttp%253A%252F%252Fowaspnzday2010.eventbrite.com%26location%3DThe%2BUniversity%2Bof%2BAuckland%2BBusiness%2BSchool%2B-%2BOwen%2BG.%2BGlenn%2BBuilding%2B-%2B12%2BGrafton%2BRoad%2B-%2BAuckland%2B-%2BNew%2BZealand Google Calendar]<br />
* [http://www.eventbrite.com/calendar.ics?eid=678083165&calendar=ical iCal Calendar]</td><br />
<td valign="top" width="33%"><b>Where</b>:<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br></td><br />
<td valign="top">[[Image:Auckland_business_school_small2.jpg]]</td><br />
</tr><br />
<br />
</table><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
==Conference structure and schedule==<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Speakers====<br />
<br />
Speakers will be announced at the end of June 2010.<br />
<br><br />
<b>Please note that [http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010#tab=Call_for_Paper_.28OPEN.29_and_review_process CFP] is now open.</b><br />
<br />
====Call For Sponsorships (OPEN)====<br />
<br />
The aims of OWASP - New Zealand community is to guarantee access to the conference for free in order to allow for wide participation and empower the community itself. As so the OWASP - New Zealand community encourages Industries, Research Institutions and Individuals to sponsor their activities and events.<br />
<br />
Three types of sponsorships are available:<br />
<br><br><br />
* <b>Support Sponsorships</b>: n/a - company covers expenses for international speaker / media company that provides article/coverage on the event<br />
<br />
- Publication of the sponsor logo on the event web site.<br />
<br><br> <br />
* <b>Silver sponsorship</b>: 1500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference.<br><br />
<br> <br />
* <b>Gold Sponsorship</b>: 3500 NZD<br />
<br />
- Publication of the sponsor logo on the event web site;<br><br />
- Publication of the sponsor logo on the OWASP New Zealand Chapter page;<br><br />
- The publication of the sponsor logo in the event site, in the agenda, on the flyers, brochure and in all the official communications with the attendees at the conference;<br><br />
- The possibility to distribute the company brochures, CDs or other materials to the participants during the event;<br><br />
- Sponsor dedicated space at the conference (sponsor booth) to show products/services to the attendees during coffee breaks, lunch and snack breaks.<br><br />
<br><br />
Those who are interested in sponsoring OWASP New Zealand 2010 Conference can contact the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
Sponsors can also make us of the following PayPal button to make payments. Donations are also more than welcome from the NZ community.<br />
<br />
<table width="100%" border="2" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td bordercolor="#FF6600" bgcolor="#FFFFFF" valign="top"><div align="center"><paypal>OWASP New Zealand Day 2010</paypal></div></td><br />
</tr><br />
</table><br />
<br />
====Call for Paper (OPEN) and review process====<br />
<br />
OWASP solicit contributions on the above topics, or general matters of interest to the community. Those who are interested in participating as speakers to the conference can submit an abstract of the speech to the [mailto:robertosl@owasp.org OWASP New Zealand Board].<br><br />
The email subject must be “OWASP New Zealand 2010: CFP” and the email body must contains the following information/sections:<br />
<br />
* Name and Surname<br />
* Affiliation <br />
* Address <br />
* Telephone number<br />
* Email address<br />
* List of the author’s previous papers/articles/speeches on the same topics <br />
* Title of the contribution <br />
* Type of contribution: Technical or Informative <br />
* Abstract (max one A4 style page)<br />
* Why the contribution is relevant for OWASP New Zealand 2010<br />
* If you are not from New Zealand, will your company support your expenses - Yes/No<br />
<br />
The submission will be reviewed by the OWASP New Zealand Board and the most interesting ones will be selected and invited for presentation.<br />
<br />
Due to limited budget available, expenses for international speakers cannot be covered.<br />
If your company is willing to cover travel and accomodation costs, the company will become "Support Sponsor" of the event.<br />
<br />
====Conference====<br />
<br />
==Conference Venue==<br />
<br />
The University of Auckland Business School<br><br />
Owen G Glenn Building<br><br />
Room: OGGB 260-073 (OGGB4)<br><br />
Address: 12 Grafton Road<br><br />
Auckland<br><br />
New Zealand<br><br />
[http://maps.google.com/maps?oe=UTF-8&ie=UTF8&q=auckland+business+school&fb=1&split=1&cid=0,0,12303692579639430581&ei=6WeqSZr_OZLFkAWR--zbDQ&ll=-36.852308,174.770916&spn=0.01056,0.020621&z=16&iwloc=A Map]<br><br />
<center>[[Image:Auckland_business_school_small2.jpg]] [[Image:Room_hall.jpg]]</center><br />
<br />
==Topics==<br />
<br />
The OWASP Days have always offered a forum for discussion and exchange of ideas among researchers and practitioners who present their experiences and discuss issues related to Web Application Security from a higher level to a technical point of view.<br />
<br />
Conference topics include, but are not limited to:<br />
<br />
* OWASP Project presentation (i.e Tool Updates/Project Status etc);<br />
* Threat modelling of web applications;<br />
* Privacy concerns with applications and data storage;<br />
* Vulnerability analysis of web applications (code review, pentest, static analysis, scanning);<br />
* Baseline or metrics for web application security;<br />
* Countermeasures for web application vulnerabilities;<br />
* Web application security;<br />
* Platform or language (e.g. Java, .NET) security features that help secure web applications;<br />
* Secure application development;<br />
* How to use databases securely in web applications;<br />
* Security of Service Oriented Architectures;<br />
* Access control in web applications;<br />
* Web services security;<br />
* Browser security;<br />
* PCI.<br />
<br />
<br />
<br />
===Conference structure and schedule===<br />
<br />
OWASP New Zealand Day 2010 will be all day Conference. The conference aims to provide a workshop-like atmosphere in which contributions can be presented and then time is allowed for constructive discussion of their results and processes. It will be structured in a single stream. During the conference two coffee breaks (one in the morning and one in the afternoon) and the lunch are in program. These might be offered by the sponsors. The detailed agenda of the conference will be available on the web site before the event.<br />
<br />
====Conference dates====<br />
<br />
* CFP close: 15th June 2010<br />
* Contributions submission deadline: 25th June 2010 <br />
* Registration deadline: 20th June 2010<br />
* Conference Agenda due: 20th June 2010 <br />
* Conference date: 15th July 2010 <br />
<br />
====Conference Committee====<br />
<br />
'''OWASP New Zealand Day 2010 Organising Committee:'''<br />
<br />
* Roberto Suggi Liverani – OWASP New Zealand Leader<br />
* Rob Munro – OWASP New Zealand Evangelist<br />
* Lech Janczewski - Associate Professor - University of Auckland<br />
<br />
<headertabs/><br />
<br />
==Conference Sponsors==<br />
<table width="100%" border="0" cellspacing="1" cellpadding="1"><br />
<tr><br />
<td valign="bottom" width="50%"><center>[http://www.auckland.ac.nz/ https://www.owasp.org/images/8/82/University_of_Auckland_crest_small.png]</center></td><br />
<td valign="bottom" width="50%"><center>[http://www.security.org.nz/NZISF_NZISForumContent.php https://www.owasp.org/images/5/5a/Nz_information_security_forum.png]</center></td><br />
</tr><br />
<tr><br />
<td valign="top" width="50%"><center>Department of Computer Science<br>ICT and Department of Information Systems and Operations Management</center></td><br />
<td valign="top" width="50%">&nbsp;</td><br />
</tr><br />
</table><br />
<br />
<br />
'''Gold Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.security-assessment.com https://www.owasp.org/images/a/a4/Security-assessment_com.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.security-assessment.com www.security-assessment.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Silver Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ https://www.owasp.org/images/f/f4/Lateral_security.jpeg]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.lateralsecurity.com/ www.lateralsecurity.com]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
</table><br />
<br />
'''Support Sponsors:'''<br />
<table width="100%" border="0" cellspacing="0" cellpadding="0"><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ http://www.owasp.org/images/1/1d/Netguide-logo.png]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<tr><br />
<td><center>[http://www.techday.co.nz/netguide/ www.techday.co.nz/netguide]</center></td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
<td>&nbsp;</td><br />
</tr><br />
<br />
<br />
</table><br />
<br />
[[Category:OWASP AppSec Conference]]</div>Rsl81https://wiki.owasp.org/index.php?title=File:Netguide-logo.png&diff=83753File:Netguide-logo.png2010-05-20T04:30:19Z<p>Rsl81: uploaded a new version of "File:Netguide-logo.png"</p>
<hr />
<div></div>Rsl81