2011-03-31T17:54:36Z

Ryan W Smith:

{{Chapter Template|chaptername=Dallas|extra=The chapter leaders are [mailto:Ryan.Smith@OWASP.org Ryan W Smith], [mailto:andrea.wendeln@gmail.com Andrea Wendeln], [mailto:Don.McMillian@acs-inc.com Don McMillian] and Leah Teutsch (currently on leave).|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dallas|emailarchives=http://lists.owasp.org/pipermail/owasp-dallas}}

== Get Connected and Stay Connected ==

The Dallas OWASP chapter is proud to announce several new ways to keep in touch with the leadership and other members of the chapter and greater organization.

In addition to our [http://bit.ly/fWT3pN Mailing List] we also have a [http://bit.ly/eHEW6O Dallas OWASP Twitter Feed] a [http://on.fb.me/fHr5XY Dallas OWASP Facebook Page] and a [http://linkd.in/g3WxGG Dallas OWASP Linkedin Group]. We invite you to join or follow whichever groups suit you, get involved with your fellow Dallas OWASP Chapter members, and we'll keep them all up to date with the latest official news and announcements from the chapter leadership.

'''Click any of the links below to visit the corresponding Dallas OWASP social networking groups:'''

{| cellspacing="15"
|-
| [[Image:Join the list.png|150px|link=http://bit.ly/fWT3pN]]
| [[Image:Follow-us-on-twitter.png|175px|link=http://bit.ly/eHEW6O]]
| [[Image:Join-us-on-Facebook.jpg|175px|link=http://on.fb.me/fHr5XY]]
| [[Image:Linkedin-button.gif|135px|link=http://linkd.in/g3WxGG]]
|}

'''[http://www.eventbrite.com/event/1287249197 Click here to RSVP for March 2nd (FREE)]'''

==== Announcements ====

'''The rumors are true, Dallas OWASP is back in full swing with monthly meetings on the first Wednesday of every month''' 
'''we're keeping it going on April 6th, 2011 with Peter Perfetti of Impact Security presenting: "Checklist for Application Security, Systems, Internetworking, and Engineering".'''
 
'''RSVP:''' '''[http://owaspdallasmtg.eventbrite.com/ Click here to RSVP for the April 6th Chapter Meeting (FREE)]'''
 
<paypal>Dallas Chapter</paypal>
 
== Next Meeting on April 6, 2011 ==

===**RECENT UPDATES**===

* **UPDATE** - Fortify will be sponsoring the lunch for this meeting, if your company is interested in sponsoring future meetings, please email [mailto:Ryan.Smith@OWASP.org Ryan.Smith@OWASP.org]

'''Make sure to sign up for any of the social media network links above to get future announcements.'''
 

=== Sponsors: ===

[[Image:FortifyHP.png‎|link=http://www.fortify.com]]

We would like to thank Fortify for sponsoring the lunch for this meeting.

[[Image:Screen_shot_2011-02-24_at_10.47.51_AM.png|link=http://www.smu.edu]]

We would like to thank SMU for agreeing to host us until May, 2011

 
==Meeting Details:==

'''Title''': Breaking the Paradigm of AppSec as a Disruptive Cost Center

'''Speaker''': Peter Perfetti, Impact Security

'''Date''': April 6, 2011

'''Time''': 11:30AM - 1:00 PM

'''Location''': Southern Methodist University 6425 Boaz Lane Dallas TX 75205

'''Room details:''' 
'''Building:''' Hughes-Trigg Student Center
'''Room:''' Atrium A&B

'''Directions:'''
For campus direction please visit [http://smu.edu/maps/directions.asp http://smu.edu/maps/directions.asp]

'''Parking:'''
For parking, guests have few options, they can use '''Moody Parking Garage for $5''', the machine takes cash or plastic. Otherwise, they can look for free parking spots on '''University Boulevard''' or '''Mcfarlin Boulevard'''.

'''Campus Map:'''
An interactive campus map can be found at [http://smu.edu/maps/flash/ http://smu.edu/maps/flash/]
Printable map:

'''Cost:''' Always Free

'''RSVP:''' '''[http://owaspdallasmtg.eventbrite.com/ Click here to RSVP for April 6th (FREE)]''' or Email [mailto:RyanWSmith@gmail.com Ryan.Smith@OWASP.org]
This will help expedite the check-in process. Thanks.

'''Abstract''':

This presentation outlines the primary risk concerns for application security, audit, and compliance then expands on those topics to create a "Checklist for Application Security, Systems, Internetworking, and Engineering". The presentation begins with understanding the types of risks involved, the current pitfalls (and in some cases pratfalls) companies struggle to endure, and what we can do to fix them. The presenter outlines the basic foundation on how to build a program for success, debunking the myth that you can’t have operational stability, security, and compliance while reducing operating costs, and how using this approach helps to achieve this goal.

Applications are currently a major attack vector as well as being difficult to keep stable, secure, and compliant. But securing only the applications, or just the infrastructure can lead to compromise; and audit, compliance, and legal problems. By applying the author's philosophy and checklists to your organization, staff from support, engineering, application development, up to CISOs can more effectively work together to improve security and meet Executive Management’s tolerance for business risk while achieving business objectives. This presentation highlights the issues, demonstrates how the entire enterprise works together, and finally outlines a basic checklist and a methodology for CISOs, Developers, Administrators, and Engineers alike to ensure business and technology risk management work in concert with all technology areas, including audit and compliance.The method draws its strengths from proven frameworks such as OWASP, SAMM, Visible Ops, FFIEC, CoBIT, and ITIL.

'''Speaker Bio''':

Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Vulnerability & Risk Assessment; developing, enhancing, and implementing Security and Risk Management programs; and Incident & Audit Response, Prevention, and Recovery.

==== Presentation Archives ====

This is a new program, we will start collecting our speakers' presentation materials and make them available for viewing and download here.

==March 2, 2011==

'''Title''': OWASP WTE: Application Pen Testing '''your''' way.

'''Speaker''': Matt Tesauro, [http://bit.ly/fQGqIk OWASP] Board Member, Project Lead for the [http://bit.ly/hIbx9c OWASP WTE Live CD project], and VP of Services at [http://bit.ly/fNj64E Praetorian]

'''Slides''': [[Media:OWASP-Dallas-Chapter-Mar-2011-1.pdf]]

==== Past Meetings Archive ====

== March 2, 2011 ==

===**RECENT UPDATES**===

* **UPDATE** - Matt Tesauro will be bringing a professionally bound copy of the OWASP 2010 Top 10, signed by the authors Jeff Williams (http://www.owasp.org/index.php/User:Jeff_Williams) and Dave Wichers (http://www.owasp.org/index.php/User:Wichers) that he picked up at the Summit. We'll raffle this at the end of the meeting for all who've registered*. * must be present to win
* We have posted the room and building information below, as well as information about parking and maps of the SMU Campus (2/9/11)
* We have added an official EventBright RSVP page. '''[http://www.eventbrite.com/event/1287249197 Please Click here to RSVP for March 2nd (FREE)]''' (2/8/11)
* We have confirmed that Southern Methodist University will host our upcoming meeting on March 2nd. (2/7/11)

'''Make sure to sign up for any of the social media network links above to get future announcements.'''
 

=== Sponsors: ===
[[Image:Veracode_logo_2color_OWASP.jpg|link=http://veracode.com]]

[[Image:Screen_shot_2011-02-24_at_10.47.51_AM.png|link=http://www.smu.edu]]

We would like to thanks Veracode for providing a light deli lunch for this meeting, and of course SMU for hosting it.

===Meeting Details:===

'''Title''': OWASP WTE: Application Pen Testing '''your''' way.

'''Speaker''': Matt Tesauro, [http://bit.ly/fQGqIk OWASP] Board Member, Project Lead for the [http://bit.ly/hIbx9c OWASP WTE Live CD project], and VP of Services at [http://bit.ly/fNj64E Praetorian]

'''Date''': March 2, 2011

'''Time''': 11:30AM - 1:00 PM

'''Location''': '''**Recently Updated**''' Southern Methodist University 6425 Boaz Lane Dallas TX 75205

We will meet at: '''Huitt Zollars room''' located at the '''Embrey building''' at '''SMU Main Campus (Dallas)'''.

'''Directions:'''
For campus direction please visit [http://smu.edu/maps/directions.asp http://smu.edu/maps/directions.asp]

'''Parking:'''
For parking, guests have few options, they can use '''Moody Parking Garage for $5''', the machine takes cash or plastic. Otherwise, they can look for free parking spots on '''University Boulevard''' or '''Mcfarlin Boulevard'''.

'''Campus Map:'''
An interactive campus map can be found at [http://smu.edu/maps/flash/ http://smu.edu/maps/flash/]
Printable map:

'''Cost:''' Always Free

'''RSVP:''' Email [mailto:RyanWSmith@gmail.com RyanWSmith@gmail.com] or '''[http://www.eventbrite.com/event/1287249197 Click here to RSVP for March 2nd (FREE)]'''
This will help expedite the check-in process. Thanks.

'''Abstract''':

One of the pain points of application penetration testing is keeping all your tools up to date and installed on whatever computer you happen to have with you. After several successful releases of the OWASP Live CD, I had a bit of a think and decided that there was a better way. After a bunch of re-tooling (the fancy word is refactoring), OWASP WTE is ready for prime time. OWASP Web Testing Environment is a project to package application testing tools and make them available in a variety of ways - you pick what works for you: Live CD, Virtual Machine, ala carte installations on your existing Ubuntu system, or maybe even attack tools in the cloud. The choice is yours with WTE.

In this talk I will cover where OWASP WTE is currently, what features are available and what the future holds. The overall project goal is to make testing tools as widely available and easily usable as possible.

'''Speaker Bio''':

Matt is currently on the board of the [http://bit.ly/fQGqIk OWASP Foundation] and highly involved in many OWASP projects and committees. Matt is the project leader of the [http://bit.ly/hIbx9c OWASP WTE] (Web Testing Environment) which is the source of theOWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.

Matt has been involved in the Information Technology industry for more than 10 years. Matt is currently serving as the VP of services at [http://bit.ly/fNj64E Praetorian], leveraging his experience in application security and consulting. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.

Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.

Linkedin Profile: http://www.linkedin.com/in/matttesauro

 '''======================================================'''

'''When:''' Tuesday, September 21, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Securing the Smart Grid's Software

'''Who:''' Andy Bochman

Andy Bochman is Energy Security Lead for IBM's Rational Division, where the focus is on securing the software that runs the Smart Grid. Andy is a contributor to industry and national security working groups on energy security and cyber security. He lives in Boston, is an active member of the MIT Energy Club, and is the founder of the Smart Grid Security and DOD Energy Blogs.

'''Where:''' CoreLogic, 1 CoreLogic Drive, Westlake, TX 76262 (@15 min from DFW Airport)

From Dallas: Take 183-West to 114-West (Toward Grapevine) Exit on Solana/Kirkwood Blvd Turn Left onto Kirkwood Blvd Turn Right onto Campus Circle (You will see the CoreLogic sign)

From Fort Worth: Take I-35W North Take exit 70 toward Dallas/Bridgeport/Tx-114 Turn Right onto 114 East Exit on Solana Blvd Turn Right onto Kirkwood Blvd Turn Right onto Campus Circle (You will see the CoreLogic sign)

Link to Directions (Please Note: CoreLogic (formerly First American) is still listed on Google Maps and other applications as “First American”)

 '''Parking:''' Upon arrival at Circle Drive, please pull into the Visitor Kiosk to your right where you will be issued a Visitor’s Parking Pass. Once parked, proceed to Building 5 for your Visitor Badge. The Southlake conference room is located in Building 4, Floor 1.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at the Café in Building 7.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

 '''When:''' Tuesday, June 29, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Protecting Your Applications from Backdoors: How to Security Your Business Critical Applications from Time Bombs, BAckdoors & More

With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. In this session we will cover; • Prevalence of backdoors and malicious code in third party attacks • Definitions and classifications of backdoors and their impact on your applications • Methods to identify, track and remediate these vulnerabilities

 '''Who:''' Clint Pollock, Senior Solutions Architect, Veracode

Mr. Pollock is a Senior Solutions Architect at Veracode. Since 1997, he has also created security solutions for large-scale enterprise environments on behalf of CREDANT Technologies and Netegrity. In his current role, Clint helps globally distributed organizations evaluate, track, and mitigate their application security risk. Clint’s greatest strengths are his enthusiasm, experience and determination to help customers succeed in maintaining secure, compliant systems, and avoid the consequences and bad headlines that come with application security breaches. Clint resides in Chicago, IL.

'''Where:''' University of Texas at Dallas Campus - School of Management (SOM), Executive Dining Room A, 800 W. Campbell Rd., Richardson, TX 75080

'''Parking:''' Park in lot M. I will send a permit to those who have RSVP'd by Monday, June 29. Those who do not have the permit will need to stop at the Visitor Center on University Parkway to pick up a pass. Place the permit on the dash.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch or come early and purchase lunch at one of the many fast-food restaurants located on the top floor of the Student Union. We are meeting in a differnt building than for previous meetings so be sure to check the on-line map for construction changes. http://www.utdallas.edu/maps/

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

'''When:''' Thursday, May 20, 2010 6:00 PM

'''Topic: ''' Spring 2010 Networking Event - Network With Your Peers

FREE EVENT!!! Your Dallas OWASP Chapter is pleased to host a networking event open to all those involved in OWASP. Our friends at Fortify Software are sponsoring this happy hour.

• Mix and mingle with fellow OWASP chapter members • Bring your business cards and resume • Appetizers will be served, and drinks will be free • Enter to win prizes and great gifts (must be present to win)

Dallas OWASP Website: http://www.owasp.org/index.php/Dallas

Don't miss the first Spring 2010 Networking event! We look forward to seeing you there!

'''Where:''' Humperdink's at Loop 12 and NW HWY, 2208 W NW Hwy, Dallas, TX 75220, (214) 358-4159

'''Cost:''' Always Free

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu]

'''======================================================'''

'''When:''' Thursday, March 4, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In

This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.

'''Who:''' Peter Perfetti, IMPACT Security LLC

Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high-performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.

'''Where:''' University of Texas at Dallas Campus - Galaxy Room C of the Student Union, 800 W. Campbell Rd., Richardson, TX 75080

'''Parking:''' Park in lot C. I will send a permit to those who have RSVP'd by Tuesday, March 2nd. Those who do not have the permit will need to stop at the Visitor Center on University Parkway to pick up a pass. Place the permit on the dash.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at one of the many fast-food restaurants located on the top floor of the Student Union.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

 '''When:''' September 15, 2009, 11:30am - 1:30pm

'''Topic: ''' Detective Work for Testers. Finding Workflow-based Defects.

Workflow-based security defects in Web applications are especially difficult to identify because they evade traditional, point-and-scan vulnerability detection techniques. Understanding these potential defects and why black-box scanners typically miss them, are key to creating a testing strategy for successful detection and mitigation. Rafal Los describes the critical role that testers play in assessing application work flows and how business process-based testing techniques can uncover these flaws. Rafal demystifies the two main types of workflow-based application vulnerabilities-business process logic vulnerabilities and parameter-based vulnerabilities-and provides you with a sound basis to improve your testing strategies. Become a security testing sleuth and learn to find the workflow-based security defects before your system is compromised.

'''Who:''' Rafal Los, Sr. Web Security Specialist, HP Software

Senior Security Specialist with Hewlett-Packard’s Application Security Center (ASC), Rafal Los has more than thirteen years of experience in network and system design, security policy and process design, risk analysis, penetration testing, and consulting. For the past eight years, he has focused on information security and risk management, leading security architecture teams, and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously, Rafal spent three years in-house with GE Consumer Finance, leading its web application security programs.

'''Where:''' The First American Co, 1 First American Way, Westlake, TX 76262 (@15 min from DFW Airport)

'''Parking:''' Upon arrival at Circle Drive, please pull into the Visitor Kiosk to your right where you will be issued a Visitor’s Parking Pass. Once parked, proceed to Building 5 for your Visitor Badge. See Map for Directions. [http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=1+first+american+way,+westlake,+tx&sll=37.0625,-95.677068&sspn=48.641855,78.837891&ie=UTF8&mrt=rblall&ll=32.980777,-97.174437&spn=0.006336,0.009624&z=17&iwloc=A Link to Directions].

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at the Café in Building 7.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

'''When:''' Dallas February 25, 2009 11:30am – 1:30pm

'''Topic:''' Vulnerability Management in an Application Security World. Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.

'''Who:''' Dan Cornell, Principal, Denim Group Dan Cornell has over ten years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. He is also the primary author of sprajax, Denim Group’s open source tool for assessing the security of AJAX-enabled web applications.

'''Where:''' UTD Campus - Galaxy Room of the Student Union, Room SU 2.602 Doors open at 11:00 am.

 Dallas OWASP Chapter: February 2009 Meeting

Topic: "Vulnerability Management in an Application Security World."

Presenter: Dan Cornell, Principal, Denim Group

Date: February 25, 2009 11:30am – 1:30pm

Location: UTD Campus - Galaxy Room of the Student Union, Room SU 2.602 Doors open at 11:00 am.

Abstract:

Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.

Presenter Bio:

Dan Cornell has over ten years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. He is also the primary author of sprajax, Denim Group’s open source tool for assessing the security of AJAX-enabled web applications.

[[Dallas OWASP Flyer.pdf]]

==== Dallas OWASP Chapter Leaders ====

'''The Dallas OWASP chapter leaders are:'''

[mailto:Ryan.Smith@OWASP.org Ryan W Smith]

[mailto:andrea.wendeln@gmail.com Andrea Wendeln]

[mailto:Don.McMillian@acs-inc.com Don McMillian]

Leah Teutsch (currently on leave)

__NOTOC__ <headertabs />

2011-03-08T17:13:45Z

Ryan W Smith:

{{Chapter Template|chaptername=Dallas|extra=The chapter leaders are [mailto:Ryan.Smith@OWASP.org Ryan W Smith], [mailto:andrea.wendeln@gmail.com Andrea Wendeln], [mailto:Don.McMillian@acs-inc.com Don McMillian] and Leah Teutsch (currently on leave).|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dallas|emailarchives=http://lists.owasp.org/pipermail/owasp-dallas}}

== Get Connected and Stay Connected ==

The Dallas OWASP chapter is proud to announce several new ways to keep in touch with the leadership and other members of the chapter and greater organization.

In addition to our [http://bit.ly/fWT3pN Mailing List] we also have a [http://bit.ly/eHEW6O Dallas OWASP Twitter Feed] a [http://on.fb.me/fHr5XY Dallas OWASP Facebook Page] and a [http://linkd.in/g3WxGG Dallas OWASP Linkedin Group]. We invite you to join or follow whichever groups suit you, get involved with your fellow Dallas OWASP Chapter members, and we'll keep them all up to date with the latest official news and announcements from the chapter leadership.

'''Click any of the links below to visit the corresponding Dallas OWASP social networking groups:'''

{| cellspacing="15"
|-
| [[Image:Join the list.png|150px|link=http://bit.ly/fWT3pN]]
| [[Image:Follow-us-on-twitter.png|175px|link=http://bit.ly/eHEW6O]]
| [[Image:Join-us-on-Facebook.jpg|175px|link=http://on.fb.me/fHr5XY]]
| [[Image:Linkedin-button.gif|135px|link=http://linkd.in/g3WxGG]]
|}

'''[http://www.eventbrite.com/event/1287249197 Click here to RSVP for March 2nd (FREE)]'''

==== Announcements ====

'''The rumors are true, Dallas OWASP is back in full swing with monthly meetings on the first Wednesday of every month''' 
'''we're keeping it going on April 6th, 2011 with Peter Profetti of Imapct Security presenting: "Checklist for Application Security, Systems, Internetworking, and Engineering".'''
 
 
<paypal>Dallas Chapter</paypal>
 
== Next Meeting on April 6, 2011 ==

===**RECENT UPDATES**===

* **UPDATE** - We're currently looking for a sponsor for the lunch, if your company is interested in sponsoring, please email [mailto:Ryan.Smith@OWASP.org Ryan.Smith@OWASP.org]

'''Make sure to sign up for any of the social media network links above to get future announcements.'''
 

=== Sponsors: ===
[[Image:Screen_shot_2011-02-24_at_10.47.51_AM.png|link=http://www.smu.edu]]

We would like to thanks SMU for agreeing to host us until May, 2011

* '''We're currently looking for a sponsor for the lunch, if your company is interested in sponsoring, please email [mailto:Ryan.Smith@OWASP.org Ryan.Smith@OWASP.org] '''
 
==Meeting Details:==

'''Title''': Checklist for Application Security, Systems, Internetworking, and Engineering

'''Speaker''': Peter Perfetti, Impact Security

'''Date''': April 6, 2011

'''Time''': 11:30AM - 1:00 PM

'''Location''': Southern Methodist University 6425 Boaz Lane Dallas TX 75205

'''Room details are TBD - Stay Tuned For Updates'''

'''Directions:'''
For campus direction please visit [http://smu.edu/maps/directions.asp http://smu.edu/maps/directions.asp]

'''Parking:'''
For parking, guests have few options, they can use '''Moody Parking Garage for $5''', the machine takes cash or plastic. Otherwise, they can look for free parking spots on '''University Boulevard''' or '''Mcfarlin Boulevard'''.

'''Campus Map:'''
An interactive campus map can be found at [http://smu.edu/maps/flash/ http://smu.edu/maps/flash/]
Printable map:

'''Cost:''' Always Free

'''RSVP:''' '''[http://www.eventbrite.com/event/1287249197 Click here to RSVP for March 2nd (FREE)]''' or Email [mailto:RyanWSmith@gmail.com Ryan.Smith@OWASP.org]
This will help expedite the check-in process. Thanks.

'''Abstract''':

This presentation outlines the primary risk concerns for application security, audit, and compliance then expands on those topics to create a "Checklist for Application Security, Systems, Internetworking, and Engineering". The presentation begins with understanding the types of risks involved, the current pitfalls (and in some cases pratfalls) companies struggle to endure, and what we can do to fix them. The presenter outlines the basic foundation on how to build a program for success, debunking the myth that you can’t have operational stability, security, and compliance while reducing operating costs, and how using this approach helps to achieve this goal.

Applications are currently a major attack vector as well as being difficult to keep stable, secure, and compliant. But securing only the applications, or just the infrastructure can lead to compromise; and audit, compliance, and legal problems. By applying the author's philosophy and checklists to your organization, staff from support, engineering, application development, up to CISOs can more effectively work together to improve security and meet Executive Management’s tolerance for business risk while achieving business objectives. This presentation highlights the issues, demonstrates how the entire enterprise works together, and finally outlines a basic checklist and a methodology for CISOs, Developers, Administrators, and Engineers alike to ensure business and technology risk management work in concert with all technology areas, including audit and compliance.The method draws its strengths from proven frameworks such as OWASP, SAMM, Visible Ops, FFIEC, CoBIT, and ITIL.

'''Speaker Bio''':

Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Vulnerability & Risk Assessment; developing, enhancing, and implementing Security and Risk Management programs; and Incident & Audit Response, Prevention, and Recovery.

==== Presentation Archives ====

This is a new program, we will start collecting our speakers' presentation materials and make them available for viewing and download here.

==March 2, 2011==

'''Title''': OWASP WTE: Application Pen Testing '''your''' way.

'''Speaker''': Matt Tesauro, [http://bit.ly/fQGqIk OWASP] Board Member, Project Lead for the [http://bit.ly/hIbx9c OWASP WTE Live CD project], and VP of Services at [http://bit.ly/fNj64E Praetorian]

'''Slides''':

==== Past Meetings Archive ====

== March 2, 2011 ==

===**RECENT UPDATES**===

* **UPDATE** - Matt Tesauro will be bringing a professionally bound copy of the OWASP 2010 Top 10, signed by the authors Jeff Williams (http://www.owasp.org/index.php/User:Jeff_Williams) and Dave Wichers (http://www.owasp.org/index.php/User:Wichers) that he picked up at the Summit. We'll raffle this at the end of the meeting for all who've registered*. * must be present to win
* We have posted the room and building information below, as well as information about parking and maps of the SMU Campus (2/9/11)
* We have added an official EventBright RSVP page. '''[http://www.eventbrite.com/event/1287249197 Please Click here to RSVP for March 2nd (FREE)]''' (2/8/11)
* We have confirmed that Southern Methodist University will host our upcoming meeting on March 2nd. (2/7/11)

'''Make sure to sign up for any of the social media network links above to get future announcements.'''
 

=== Sponsors: ===
[[Image:Veracode_logo_2color_OWASP.jpg|link=http://veracode.com]]

[[Image:Screen_shot_2011-02-24_at_10.47.51_AM.png|link=http://www.smu.edu]]

We would like to thanks Veracode for providing a light deli lunch for this meeting, and of course SMU for hosting it.

===Meeting Details:===

'''Title''': OWASP WTE: Application Pen Testing '''your''' way.

'''Speaker''': Matt Tesauro, [http://bit.ly/fQGqIk OWASP] Board Member, Project Lead for the [http://bit.ly/hIbx9c OWASP WTE Live CD project], and VP of Services at [http://bit.ly/fNj64E Praetorian]

'''Date''': March 2, 2011

'''Time''': 11:30AM - 1:00 PM

'''Location''': '''**Recently Updated**''' Southern Methodist University 6425 Boaz Lane Dallas TX 75205

We will meet at: '''Huitt Zollars room''' located at the '''Embrey building''' at '''SMU Main Campus (Dallas)'''.

'''Directions:'''
For campus direction please visit [http://smu.edu/maps/directions.asp http://smu.edu/maps/directions.asp]

'''Parking:'''
For parking, guests have few options, they can use '''Moody Parking Garage for $5''', the machine takes cash or plastic. Otherwise, they can look for free parking spots on '''University Boulevard''' or '''Mcfarlin Boulevard'''.

'''Campus Map:'''
An interactive campus map can be found at [http://smu.edu/maps/flash/ http://smu.edu/maps/flash/]
Printable map:

'''Cost:''' Always Free

'''RSVP:''' Email [mailto:RyanWSmith@gmail.com RyanWSmith@gmail.com] or '''[http://www.eventbrite.com/event/1287249197 Click here to RSVP for March 2nd (FREE)]'''
This will help expedite the check-in process. Thanks.

'''Abstract''':

One of the pain points of application penetration testing is keeping all your tools up to date and installed on whatever computer you happen to have with you. After several successful releases of the OWASP Live CD, I had a bit of a think and decided that there was a better way. After a bunch of re-tooling (the fancy word is refactoring), OWASP WTE is ready for prime time. OWASP Web Testing Environment is a project to package application testing tools and make them available in a variety of ways - you pick what works for you: Live CD, Virtual Machine, ala carte installations on your existing Ubuntu system, or maybe even attack tools in the cloud. The choice is yours with WTE.

In this talk I will cover where OWASP WTE is currently, what features are available and what the future holds. The overall project goal is to make testing tools as widely available and easily usable as possible.

'''Speaker Bio''':

Matt is currently on the board of the [http://bit.ly/fQGqIk OWASP Foundation] and highly involved in many OWASP projects and committees. Matt is the project leader of the [http://bit.ly/hIbx9c OWASP WTE] (Web Testing Environment) which is the source of theOWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.

Matt has been involved in the Information Technology industry for more than 10 years. Matt is currently serving as the VP of services at [http://bit.ly/fNj64E Praetorian], leveraging his experience in application security and consulting. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.

Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.

Linkedin Profile: http://www.linkedin.com/in/matttesauro

 '''======================================================'''

'''When:''' Tuesday, September 21, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Securing the Smart Grid's Software

'''Who:''' Andy Bochman

Andy Bochman is Energy Security Lead for IBM's Rational Division, where the focus is on securing the software that runs the Smart Grid. Andy is a contributor to industry and national security working groups on energy security and cyber security. He lives in Boston, is an active member of the MIT Energy Club, and is the founder of the Smart Grid Security and DOD Energy Blogs.

'''Where:''' CoreLogic, 1 CoreLogic Drive, Westlake, TX 76262 (@15 min from DFW Airport)

From Dallas: Take 183-West to 114-West (Toward Grapevine) Exit on Solana/Kirkwood Blvd Turn Left onto Kirkwood Blvd Turn Right onto Campus Circle (You will see the CoreLogic sign)

From Fort Worth: Take I-35W North Take exit 70 toward Dallas/Bridgeport/Tx-114 Turn Right onto 114 East Exit on Solana Blvd Turn Right onto Kirkwood Blvd Turn Right onto Campus Circle (You will see the CoreLogic sign)

Link to Directions (Please Note: CoreLogic (formerly First American) is still listed on Google Maps and other applications as “First American”)

 '''Parking:''' Upon arrival at Circle Drive, please pull into the Visitor Kiosk to your right where you will be issued a Visitor’s Parking Pass. Once parked, proceed to Building 5 for your Visitor Badge. The Southlake conference room is located in Building 4, Floor 1.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at the Café in Building 7.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

 '''When:''' Tuesday, June 29, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Protecting Your Applications from Backdoors: How to Security Your Business Critical Applications from Time Bombs, BAckdoors & More

With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. In this session we will cover; • Prevalence of backdoors and malicious code in third party attacks • Definitions and classifications of backdoors and their impact on your applications • Methods to identify, track and remediate these vulnerabilities

 '''Who:''' Clint Pollock, Senior Solutions Architect, Veracode

Mr. Pollock is a Senior Solutions Architect at Veracode. Since 1997, he has also created security solutions for large-scale enterprise environments on behalf of CREDANT Technologies and Netegrity. In his current role, Clint helps globally distributed organizations evaluate, track, and mitigate their application security risk. Clint’s greatest strengths are his enthusiasm, experience and determination to help customers succeed in maintaining secure, compliant systems, and avoid the consequences and bad headlines that come with application security breaches. Clint resides in Chicago, IL.

'''Where:''' University of Texas at Dallas Campus - School of Management (SOM), Executive Dining Room A, 800 W. Campbell Rd., Richardson, TX 75080

'''Parking:''' Park in lot M. I will send a permit to those who have RSVP'd by Monday, June 29. Those who do not have the permit will need to stop at the Visitor Center on University Parkway to pick up a pass. Place the permit on the dash.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch or come early and purchase lunch at one of the many fast-food restaurants located on the top floor of the Student Union. We are meeting in a differnt building than for previous meetings so be sure to check the on-line map for construction changes. http://www.utdallas.edu/maps/

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

'''When:''' Thursday, May 20, 2010 6:00 PM

'''Topic: ''' Spring 2010 Networking Event - Network With Your Peers

FREE EVENT!!! Your Dallas OWASP Chapter is pleased to host a networking event open to all those involved in OWASP. Our friends at Fortify Software are sponsoring this happy hour.

• Mix and mingle with fellow OWASP chapter members • Bring your business cards and resume • Appetizers will be served, and drinks will be free • Enter to win prizes and great gifts (must be present to win)

Dallas OWASP Website: http://www.owasp.org/index.php/Dallas

Don't miss the first Spring 2010 Networking event! We look forward to seeing you there!

'''Where:''' Humperdink's at Loop 12 and NW HWY, 2208 W NW Hwy, Dallas, TX 75220, (214) 358-4159

'''Cost:''' Always Free

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu]

'''======================================================'''

'''When:''' Thursday, March 4, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In

This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.

'''Who:''' Peter Perfetti, IMPACT Security LLC

Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high-performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.

'''Where:''' University of Texas at Dallas Campus - Galaxy Room C of the Student Union, 800 W. Campbell Rd., Richardson, TX 75080

'''Parking:''' Park in lot C. I will send a permit to those who have RSVP'd by Tuesday, March 2nd. Those who do not have the permit will need to stop at the Visitor Center on University Parkway to pick up a pass. Place the permit on the dash.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at one of the many fast-food restaurants located on the top floor of the Student Union.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

 '''When:''' September 15, 2009, 11:30am - 1:30pm

'''Topic: ''' Detective Work for Testers. Finding Workflow-based Defects.

Workflow-based security defects in Web applications are especially difficult to identify because they evade traditional, point-and-scan vulnerability detection techniques. Understanding these potential defects and why black-box scanners typically miss them, are key to creating a testing strategy for successful detection and mitigation. Rafal Los describes the critical role that testers play in assessing application work flows and how business process-based testing techniques can uncover these flaws. Rafal demystifies the two main types of workflow-based application vulnerabilities-business process logic vulnerabilities and parameter-based vulnerabilities-and provides you with a sound basis to improve your testing strategies. Become a security testing sleuth and learn to find the workflow-based security defects before your system is compromised.

'''Who:''' Rafal Los, Sr. Web Security Specialist, HP Software

Senior Security Specialist with Hewlett-Packard’s Application Security Center (ASC), Rafal Los has more than thirteen years of experience in network and system design, security policy and process design, risk analysis, penetration testing, and consulting. For the past eight years, he has focused on information security and risk management, leading security architecture teams, and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously, Rafal spent three years in-house with GE Consumer Finance, leading its web application security programs.

'''Where:''' The First American Co, 1 First American Way, Westlake, TX 76262 (@15 min from DFW Airport)

'''Parking:''' Upon arrival at Circle Drive, please pull into the Visitor Kiosk to your right where you will be issued a Visitor’s Parking Pass. Once parked, proceed to Building 5 for your Visitor Badge. See Map for Directions. [http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=1+first+american+way,+westlake,+tx&sll=37.0625,-95.677068&sspn=48.641855,78.837891&ie=UTF8&mrt=rblall&ll=32.980777,-97.174437&spn=0.006336,0.009624&z=17&iwloc=A Link to Directions].

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at the Café in Building 7.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

'''When:''' Dallas February 25, 2009 11:30am – 1:30pm

'''Topic:''' Vulnerability Management in an Application Security World. Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.

'''Who:''' Dan Cornell, Principal, Denim Group Dan Cornell has over ten years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. He is also the primary author of sprajax, Denim Group’s open source tool for assessing the security of AJAX-enabled web applications.

'''Where:''' UTD Campus - Galaxy Room of the Student Union, Room SU 2.602 Doors open at 11:00 am.

 Dallas OWASP Chapter: February 2009 Meeting

Topic: "Vulnerability Management in an Application Security World."

Presenter: Dan Cornell, Principal, Denim Group

Date: February 25, 2009 11:30am – 1:30pm

Location: UTD Campus - Galaxy Room of the Student Union, Room SU 2.602 Doors open at 11:00 am.

Abstract:

Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.

Presenter Bio:

Dan Cornell has over ten years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. He is also the primary author of sprajax, Denim Group’s open source tool for assessing the security of AJAX-enabled web applications.

[[Dallas OWASP Flyer.pdf]]

==== Dallas OWASP Chapter Leaders ====

'''The Dallas OWASP chapter leaders are:'''

[mailto:Ryan.Smith@OWASP.org Ryan W Smith]

[mailto:andrea.wendeln@gmail.com Andrea Wendeln]

[mailto:Don.McMillian@acs-inc.com Don McMillian]

Leah Teutsch (currently on leave)

__NOTOC__ <headertabs />

File:OWASPDallasMarch2Directions.pdf

2011-03-01T17:54:39Z

Ryan W Smith:

Dallas

2011-02-25T19:43:58Z

Ryan W Smith:

{{Chapter Template|chaptername=Dallas|extra=The chapter leaders are [mailto:teutsch@utdallas.edu Leah Teutsch], [mailto:andrea.wendeln@gmail.com Andrea Wendeln], [mailto:Don.McMillian@acs-inc.com Don McMillian] and [mailto:Ryan.W.Smith@Praetorian.com Ryan W Smith].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-dallas|emailarchives=http://lists.owasp.org/pipermail/owasp-dallas}}

== Get Connected and Stay Connected ==

The Dallas OWASP chapter is proud to announce several new ways to keep in touch with the leadership and other members of the chapter and greater organization.

In addition to our [http://bit.ly/fWT3pN Mailing List] we also have a [http://bit.ly/eHEW6O Dallas OWASP Twitter Feed] a [http://on.fb.me/fHr5XY Dallas OWASP Facebook Page] and a [http://linkd.in/g3WxGG Dallas OWASP Linkedin Group]. We invite you to join or follow whichever groups suit you, get involved with your fellow Dallas OWASP Chapter members, and we'll keep them all up to date with the latest official news and announcements from the chapter leadership.

'''Click any of the links below to visit the corresponding Dallas OWASP social networking groups:'''

{| cellspacing="15"
|-
| [[Image:Join the list.png|150px|link=http://bit.ly/fWT3pN]]
| [[Image:Follow-us-on-twitter.png|175px|link=http://bit.ly/eHEW6O]]
| [[Image:Join-us-on-Facebook.jpg|175px|link=http://on.fb.me/fHr5XY]]
| [[Image:Linkedin-button.gif|135px|link=http://linkd.in/g3WxGG]]
|}

'''[http://www.eventbrite.com/event/1287249197 Click here to RSVP for March 2nd (FREE)]'''

==== Local News ====

<paypal>Dallas Chapter</paypal>

 

== Next Meeting on March 2nd ==

The rumors are true, Dallas OWASP is back in full swing with monthly meetings on the first Wednesday of every month starting with OWASP's own Matt Tesauro on March 2nd, 2011.

===**RECENT UPDATES**===

* **UPDATE** - Matt Tesauro will be bringing a professionally bound copy of the OWASP 2010 Top 10, signed by the authors Jeff Williams (http://www.owasp.org/index.php/User:Jeff_Williams) and Dave Wichers (http://www.owasp.org/index.php/User:Wichers) that he picked up at the Summit. We'll raffle this at the end of the meeting for all who've registered*. * must be present to win
* We have posted the room and building information below, as well as information about parking and maps of the SMU Campus (2/9/11)
* We have added an official EventBright RSVP page. '''[http://www.eventbrite.com/event/1287249197 Please Click here to RSVP for March 2nd (FREE)]''' (2/8/11)
* We have confirmed that Southern Methodist University will host our upcoming meeting on March 2nd. (2/7/11)

'''Make sure to sign up for any of the social media network links above to get future announcements.'''
 

=== Sponsors: ===
[[Image:Veracode_logo_2color_OWASP.jpg|link=http://veracode.com]]

[[Image:Screen_shot_2011-02-24_at_10.47.51_AM.png|link=http://www.smu.edu]]

We would like to thanks Veracode for providing a light deli lunch for this meeting, and of course SMU for hosting it.

===Meeting Details:===

'''Title''': OWASP WTE: Application Pen Testing '''your''' way.

'''Speaker''': Matt Tesauro, [http://bit.ly/fQGqIk OWASP] Board Member, Project Lead for the [http://bit.ly/hIbx9c OWASP WTE Live CD project], and VP of Services at [http://bit.ly/fNj64E Praetorian]

'''Date''': March 2, 2011

'''Time''': 11:30AM - 1:00 PM

'''Location''': '''**Recently Updated**''' Southern Methodist University 6425 Boaz Lane Dallas TX 75205

We will meet at: '''Huitt Zollars room''' located at the '''Embrey building''' at '''SMU Main Campus (Dallas)'''.

'''Directions:'''
For campus direction please visit [http://smu.edu/maps/directions.asp http://smu.edu/maps/directions.asp]

'''Parking:'''
For parking, guests have few options, they can use '''Moody Parking Garage for $5''', the machine takes cash or plastic. Otherwise, they can look for free parking spots on '''University Boulevard''' or '''Mcfarlin Boulevard'''.

'''Campus Map:'''
An interactive campus map can be found at [http://smu.edu/maps/flash/ http://smu.edu/maps/flash/]
Printable map:

'''Cost:''' Always Free

'''RSVP:''' Email [mailto:RyanWSmith@gmail.com RyanWSmith@gmail.com] or '''[http://www.eventbrite.com/event/1287249197 Click here to RSVP for March 2nd (FREE)]'''
This will help expedite the check-in process. Thanks.

'''Abstract''':

One of the pain points of application penetration testing is keeping all your tools up to date and installed on whatever computer you happen to have with you. After several successful releases of the OWASP Live CD, I had a bit of a think and decided that there was a better way. After a bunch of re-tooling (the fancy word is refactoring), OWASP WTE is ready for prime time. OWASP Web Testing Environment is a project to package application testing tools and make them available in a variety of ways - you pick what works for you: Live CD, Virtual Machine, ala carte installations on your existing Ubuntu system, or maybe even attack tools in the cloud. The choice is yours with WTE.

In this talk I will cover where OWASP WTE is currently, what features are available and what the future holds. The overall project goal is to make testing tools as widely available and easily usable as possible.

'''Speaker Bio''':

Matt is currently on the board of the [http://bit.ly/fQGqIk OWASP Foundation] and highly involved in many OWASP projects and committees. Matt is the project leader of the [http://bit.ly/hIbx9c OWASP WTE] (Web Testing Environment) which is the source of theOWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.

Matt has been involved in the Information Technology industry for more than 10 years. Matt is currently serving as the VP of services at [http://bit.ly/fNj64E Praetorian], leveraging his experience in application security and consulting. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.

Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.

Linkedin Profile: http://www.linkedin.com/in/matttesauro

 

==== Upcoming Meetings ====

'''Mark your calendars, Dallas OWASP is now meeting on the first wednesday of every month from 11:30AM to 1:00PM at venues TBD'''

== Next Meeting on March 2nd ==

The rumors are true, Dallas OWASP is back in full swing with monthly meetings on the first Wednesday of every month starting with OWASP's own Matt Tesauro on March 2nd, 2011.

===**RECENT UPDATES**===

* **UPDATE** - Matt Tesauro will be bringing a professionally bound copy of the OWASP 2010 Top 10, signed by the authors Jeff Williams (http://www.owasp.org/index.php/User:Jeff_Williams) and Dave Wichers (http://www.owasp.org/index.php/User:Wichers) that he picked up at the Summit. We'll raffle this at the end of the meeting for all who've registered*. * must be present to win
* We have posted the room and building information below, as well as information about parking and maps of the SMU Campus (2/9/11)
* We have added an official EventBright RSVP page. '''[http://www.eventbrite.com/event/1287249197 Please Click here to RSVP for March 2nd (FREE)]''' (2/8/11)
* We have confirmed that Southern Methodist University will host our upcoming meeting on March 2nd. (2/7/11)

'''Make sure to sign up for any of the social media network links above to get future announcements.'''

=== Sponsors: ===
[[Image:Veracode_logo_2color_OWASP.jpg|link=http://veracode.com]]

[[Image:Screen_shot_2011-02-24_at_10.47.51_AM.png|link=http://www.smu.edu]]

We would like to thanks Veracode for providing a light deli lunch for this meeting, and of course SMU for hosting it.

===Meeting Details:===

'''Title''': OWASP WTE: Application Pen Testing '''your''' way.

'''Speaker''': Matt Tesauro, [http://bit.ly/fQGqIk OWASP] Board Member, Project Lead for the [http://bit.ly/hIbx9c OWASP WTE Live CD project], and VP of Services at [http://bit.ly/fNj64E Praetorian]

'''Date''': March 2, 2011

'''Time''': 11:30AM - 1:00 PM

'''Location''': '''**Recently Updated**''' Southern Methodist University 6425 Boaz Lane Dallas TX 75205

We will meet at: '''Huitt Zollars room''' located at the '''Embrey building''' at '''SMU Main Campus (Dallas)'''.

'''Directions:'''
For campus direction please visit [http://smu.edu/maps/directions.asp http://smu.edu/maps/directions.asp]

'''Parking:'''
For parking, guests have few options, they can use '''Moody Parking Garage for $5''', the machine takes cash or plastic. Otherwise, they can look for free parking spots on '''University Boulevard''' or '''Mcfarlin Boulevard'''.

'''Campus Map:'''
An interactive campus map can be found at [http://smu.edu/maps/flash/ http://smu.edu/maps/flash/]
Printable map:

'''Cost:''' Always Free

'''RSVP:''' Email [mailto:RyanWSmith@gmail.com RyanWSmith@gmail.com] or '''[http://www.eventbrite.com/event/1287249197 Click here to RSVP for March 2nd (FREE)]'''
This will help expedite the check-in process. Thanks.

'''Abstract''':

One of the pain points of application penetration testing is keeping all your tools up to date and installed on whatever computer you happen to have with you. After several successful releases of the OWASP Live CD, I had a bit of a think and decided that there was a better way. After a bunch of re-tooling (the fancy word is refactoring), OWASP WTE is ready for prime time. OWASP Web Testing Environment is a project to package application testing tools and make them available in a variety of ways - you pick what works for you: Live CD, Virtual Machine, ala carte installations on your existing Ubuntu system, or maybe even attack tools in the cloud. The choice is yours with WTE.

In this talk I will cover where OWASP WTE is currently, what features are available and what the future holds. The overall project goal is to make testing tools as widely available and easily usable as possible.

'''Speaker Bio''':

Matt is currently on the board of the [http://bit.ly/fQGqIk OWASP Foundation] and highly involved in many OWASP projects and committees. Matt is the project leader of the [http://bit.ly/hIbx9c OWASP WTE] (Web Testing Environment) which is the source of theOWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.

Matt has been involved in the Information Technology industry for more than 10 years. Matt is currently serving as the VP of services at [http://bit.ly/fNj64E Praetorian], leveraging his experience in application security and consulting. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.

Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.

Linkedin Profile: http://www.linkedin.com/in/matttesauro
 

==== Presentation Archives ====

This is a new program, we will start collecting our speakers' presentation materials and make them available for viewing and download here.

==== Past Meetings Archive ====

'''When:''' Tuesday, September 21, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Securing the Smart Grid's Software

'''Who:''' Andy Bochman

Andy Bochman is Energy Security Lead for IBM's Rational Division, where the focus is on securing the software that runs the Smart Grid. Andy is a contributor to industry and national security working groups on energy security and cyber security. He lives in Boston, is an active member of the MIT Energy Club, and is the founder of the Smart Grid Security and DOD Energy Blogs.

'''Where:''' CoreLogic, 1 CoreLogic Drive, Westlake, TX 76262 (@15 min from DFW Airport)

From Dallas: Take 183-West to 114-West (Toward Grapevine) Exit on Solana/Kirkwood Blvd Turn Left onto Kirkwood Blvd Turn Right onto Campus Circle (You will see the CoreLogic sign)

From Fort Worth: Take I-35W North Take exit 70 toward Dallas/Bridgeport/Tx-114 Turn Right onto 114 East Exit on Solana Blvd Turn Right onto Kirkwood Blvd Turn Right onto Campus Circle (You will see the CoreLogic sign)

Link to Directions (Please Note: CoreLogic (formerly First American) is still listed on Google Maps and other applications as “First American”)

 '''Parking:''' Upon arrival at Circle Drive, please pull into the Visitor Kiosk to your right where you will be issued a Visitor’s Parking Pass. Once parked, proceed to Building 5 for your Visitor Badge. The Southlake conference room is located in Building 4, Floor 1.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at the Café in Building 7.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

 '''When:''' Tuesday, June 29, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Protecting Your Applications from Backdoors: How to Security Your Business Critical Applications from Time Bombs, BAckdoors & More

With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. In this session we will cover; • Prevalence of backdoors and malicious code in third party attacks • Definitions and classifications of backdoors and their impact on your applications • Methods to identify, track and remediate these vulnerabilities

 '''Who:''' Clint Pollock, Senior Solutions Architect, Veracode

Mr. Pollock is a Senior Solutions Architect at Veracode. Since 1997, he has also created security solutions for large-scale enterprise environments on behalf of CREDANT Technologies and Netegrity. In his current role, Clint helps globally distributed organizations evaluate, track, and mitigate their application security risk. Clint’s greatest strengths are his enthusiasm, experience and determination to help customers succeed in maintaining secure, compliant systems, and avoid the consequences and bad headlines that come with application security breaches. Clint resides in Chicago, IL.

'''Where:''' University of Texas at Dallas Campus - School of Management (SOM), Executive Dining Room A, 800 W. Campbell Rd., Richardson, TX 75080

'''Parking:''' Park in lot M. I will send a permit to those who have RSVP'd by Monday, June 29. Those who do not have the permit will need to stop at the Visitor Center on University Parkway to pick up a pass. Place the permit on the dash.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch or come early and purchase lunch at one of the many fast-food restaurants located on the top floor of the Student Union. We are meeting in a differnt building than for previous meetings so be sure to check the on-line map for construction changes. http://www.utdallas.edu/maps/

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

'''When:''' Thursday, May 20, 2010 6:00 PM

'''Topic: ''' Spring 2010 Networking Event - Network With Your Peers

FREE EVENT!!! Your Dallas OWASP Chapter is pleased to host a networking event open to all those involved in OWASP. Our friends at Fortify Software are sponsoring this happy hour.

• Mix and mingle with fellow OWASP chapter members • Bring your business cards and resume • Appetizers will be served, and drinks will be free • Enter to win prizes and great gifts (must be present to win)

Dallas OWASP Website: http://www.owasp.org/index.php/Dallas

Don't miss the first Spring 2010 Networking event! We look forward to seeing you there!

'''Where:''' Humperdink's at Loop 12 and NW HWY, 2208 W NW Hwy, Dallas, TX 75220, (214) 358-4159

'''Cost:''' Always Free

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu]

'''======================================================'''

'''When:''' Thursday, March 4, 2010 11:30 AM – 1:00 PM

'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In

This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.

'''Who:''' Peter Perfetti, IMPACT Security LLC

Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high-performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.

'''Where:''' University of Texas at Dallas Campus - Galaxy Room C of the Student Union, 800 W. Campbell Rd., Richardson, TX 75080

'''Parking:''' Park in lot C. I will send a permit to those who have RSVP'd by Tuesday, March 2nd. Those who do not have the permit will need to stop at the Visitor Center on University Parkway to pick up a pass. Place the permit on the dash.

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at one of the many fast-food restaurants located on the top floor of the Student Union.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

 '''When:''' September 15, 2009, 11:30am - 1:30pm

'''Topic: ''' Detective Work for Testers. Finding Workflow-based Defects.

Workflow-based security defects in Web applications are especially difficult to identify because they evade traditional, point-and-scan vulnerability detection techniques. Understanding these potential defects and why black-box scanners typically miss them, are key to creating a testing strategy for successful detection and mitigation. Rafal Los describes the critical role that testers play in assessing application work flows and how business process-based testing techniques can uncover these flaws. Rafal demystifies the two main types of workflow-based application vulnerabilities-business process logic vulnerabilities and parameter-based vulnerabilities-and provides you with a sound basis to improve your testing strategies. Become a security testing sleuth and learn to find the workflow-based security defects before your system is compromised.

'''Who:''' Rafal Los, Sr. Web Security Specialist, HP Software

Senior Security Specialist with Hewlett-Packard’s Application Security Center (ASC), Rafal Los has more than thirteen years of experience in network and system design, security policy and process design, risk analysis, penetration testing, and consulting. For the past eight years, he has focused on information security and risk management, leading security architecture teams, and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously, Rafal spent three years in-house with GE Consumer Finance, leading its web application security programs.

'''Where:''' The First American Co, 1 First American Way, Westlake, TX 76262 (@15 min from DFW Airport)

'''Parking:''' Upon arrival at Circle Drive, please pull into the Visitor Kiosk to your right where you will be issued a Visitor’s Parking Pass. Once parked, proceed to Building 5 for your Visitor Badge. See Map for Directions. [http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=1+first+american+way,+westlake,+tx&sll=37.0625,-95.677068&sspn=48.641855,78.837891&ie=UTF8&mrt=rblall&ll=32.980777,-97.174437&spn=0.006336,0.009624&z=17&iwloc=A Link to Directions].

'''Cost:''' Always Free

'''Lunch:''' Bring your own lunch or purchase lunch at the Café in Building 7.

'''RSVP:''' [mailto:OWASPDallas@utdallas.edu OWASPDallas@utdallas.edu] This will help expedite the check-in process. Thanks.

 '''======================================================'''

'''When:''' Dallas February 25, 2009 11:30am – 1:30pm

'''Topic:''' Vulnerability Management in an Application Security World. Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.

'''Who:''' Dan Cornell, Principal, Denim Group Dan Cornell has over ten years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. He is also the primary author of sprajax, Denim Group’s open source tool for assessing the security of AJAX-enabled web applications.

'''Where:''' UTD Campus - Galaxy Room of the Student Union, Room SU 2.602 Doors open at 11:00 am.

 Dallas OWASP Chapter: February 2009 Meeting

Topic: "Vulnerability Management in an Application Security World."

Presenter: Dan Cornell, Principal, Denim Group

Date: February 25, 2009 11:30am – 1:30pm

Location: UTD Campus - Galaxy Room of the Student Union, Room SU 2.602 Doors open at 11:00 am.

Abstract:

Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.

Presenter Bio:

Dan Cornell has over ten years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. He is also the primary author of sprajax, Denim Group’s open source tool for assessing the security of AJAX-enabled web applications.

[[Dallas OWASP Flyer.pdf]]

==== Dallas OWASP Chapter Leaders ====

'''The Dallas OWASP chapter leaders are:'''

[mailto:teutsch@utdallas.edu Leah Teutsch]

[mailto:andrea.wendeln@gmail.com Andrea Wendeln]

[mailto:Don.McMillian@acs-inc.com Don McMillian]

[mailto:Ryan.W.Smith@Praetorian.com Ryan W Smith] __NOTOC__ <headertabs />

2011-02-02T04:57:27Z

Ryan W Smith:

Dallas

2011-02-01T23:10:33Z

Ryan W Smith:

Dallas

2011-02-01T22:49:45Z

Ryan W Smith:

Dallas

2011-02-01T22:47:26Z

Ryan W Smith:

File:Join the list.png

2011-02-01T22:38:32Z

Ryan W Smith: join the mailing list

join the mailing list

Dallas

2011-02-01T22:38:08Z

Ryan W Smith:

File:Join-us-on-Facebook.jpg

2011-02-01T22:10:20Z

Ryan W Smith: join us on facebook button

join us on facebook button

File:Linkedin-button.gif

2011-02-01T22:09:51Z

Ryan W Smith: join us on linkedin button

join us on linkedin button

File:Follow-us-on-twitter.png

2011-02-01T22:08:48Z

Ryan W Smith: twitter follow button

twitter follow button

Dallas

2011-02-01T22:07:40Z

Ryan W Smith: