OWASP - User contributions [en]

Rochester

2012-09-10T17:36:48Z

Sir W: Removed Andrea from the local officers

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Mozilla's Content Security Policy Presentation ==

Here is a copy of a presentation on Mozilla's Content Security Policy which was presented originally at the Rochester Security Summit 2011 and updated for Mercury Networks Security Summit 2012 by Lou Leone

[[Media:2012 CSP.pptx]]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: Vacant
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:rd@rd1.net Ralph Durkee]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: Vacant
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@owasp.org Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@owasp.org Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Locations for formal meetings will be announced with the corresponding meeting so please check here or the mailing [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announcement] list for specific meeting location details.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]
 
Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

== Past Events ==
;May 2011 Meeting
Michael Coates webinar on Attack-Aware Applications. 
https://owasp.webex.com/owasp/ldr.php?AT=pb&SP=MC&rID=87764002&rKey=14191b8f8c73dabc

;May 5, 2011
MercuryFest
Speakers: Ralph Durkee, Andrea Cogliati, Duane Peifer
Topic: SSL Man-in-the-Middle and Spoofing Attacks

;March 2011 Meeting
Topic: Pastebin Scrapping 
Speaker: Silas Cutler, Global Crossing, Security Architect

;January 2011 Meeting
Topic: State of OWASP and the State of Web Application Security 
Speaker: Ralph Durkee, Durkee Consulting

;August Meeting 2010
Topic: Man in the Middle Attacks: SSL Spoofing 
Speaker: Duane Peifer, UberGuard Information Security and Ralph Durkee, Durkee Consulting

;June Meeting 2010
Topic: Client Side Exploits 101 
Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and Information Assurance, RIT 2008; CISSP; MCSE, CSS

;May Meeting 2010
Topic: New Techniques in Application Intrusion Detection 
Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

;February Meeting 2010
Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
Mercury Networks Security Symposium May 2012 I'll see your cross site scripting and raise you a Content Security Policy by Lou Leone [[Media:https://www.owasp.org/images/9/95/2012_CSP.pptx|PPTX]]

January Meeting 2011 State of OWASP and the State of Web Application Security by Ralph Durkee [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.ppt‎|PPT]] [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.pdf|PDF]] 

August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Duane Peifer [[Media:SSL_Spoofing.ppt‎|PPT]] [[Media:SSL_Spoofing.pdf|PDF]] 
August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Ralph Durkee [[Media:Ralph_Durkee_SSL_MITM_v1.ppt‎|PPT]] [[Media:Ralph_Durkee_SSL_MITM_v1.pdf|PDF]] 

May Meeting 2010 New Techniques in Application Intrusion Detection by Al Huizenga [[Media:OWASP may17-10.pptx|PPTX]] [[Media:OWASP may17-10.pdf|PDF]] 
May Meeting 2010 Identity Federation and Claim-based Security by Andrea Cogliati [[Media:SAML and Claims-Based Security.pdf|PDF]]

February Meeting 2010 DC AppSec Conference Recap by Ralph Durkee [[Media:OWASP Rochester 2010 Feb.ppt|PPT]]

October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2012-05-04T16:19:42Z

Sir W: /* Meeting Dates & Location */

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@owasp.org Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@owasp.org Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Locations for formal meetings will be announced with the corresponding meeting so please check here or the mailing [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announcement] list for specific meeting location details.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]
 
Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

== Past Events ==
;May 2011 Meeting
Michael Coates webinar on Attack-Aware Applications. 
https://owasp.webex.com/owasp/ldr.php?AT=pb&SP=MC&rID=87764002&rKey=14191b8f8c73dabc

;May 5, 2011
MercuryFest
Speakers: Ralph Durkee, Andrea Cogliati, Duane Peifer
Topic: SSL Man-in-the-Middle and Spoofing Attacks

;March 2011 Meeting
Topic: Pastebin Scrapping 
Speaker: Silas Cutler, Global Crossing, Security Architect

;January 2011 Meeting
Topic: State of OWASP and the State of Web Application Security 
Speaker: Ralph Durkee, Durkee Consulting

;August Meeting 2010
Topic: Man in the Middle Attacks: SSL Spoofing 
Speaker: Duane Peifer, UberGuard Information Security and Ralph Durkee, Durkee Consulting

;June Meeting 2010
Topic: Client Side Exploits 101 
Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and Information Assurance, RIT 2008; CISSP; MCSE, CSS

;May Meeting 2010
Topic: New Techniques in Application Intrusion Detection 
Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

;February Meeting 2010
Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
Mercury Networks Security Symposium May 2012 I'll see your cross site scripting and raise you a Content Security Policy by Lou Leone [[Media:https://www.owasp.org/images/9/95/2012_CSP.pptx|PPTX]]

January Meeting 2011 State of OWASP and the State of Web Application Security by Ralph Durkee [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.ppt‎|PPT]] [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.pdf|PDF]] 

August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Duane Peifer [[Media:SSL_Spoofing.ppt‎|PPT]] [[Media:SSL_Spoofing.pdf|PDF]] 
August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Ralph Durkee [[Media:Ralph_Durkee_SSL_MITM_v1.ppt‎|PPT]] [[Media:Ralph_Durkee_SSL_MITM_v1.pdf|PDF]] 

May Meeting 2010 New Techniques in Application Intrusion Detection by Al Huizenga [[Media:OWASP may17-10.pptx|PPTX]] [[Media:OWASP may17-10.pdf|PDF]] 
May Meeting 2010 Identity Federation and Claim-based Security by Andrea Cogliati [[Media:SAML and Claims-Based Security.pdf|PDF]]

February Meeting 2010 DC AppSec Conference Recap by Ralph Durkee [[Media:OWASP Rochester 2010 Feb.ppt|PPT]]

October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2012-05-04T16:19:02Z

Sir W: Added Lou's presentation at Mercury Networks Security Symposium

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@owasp.org Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@owasp.org Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Locations for formal meetings will be announced with the corresponding meeting so please check here or the mailing [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announcement] list for specific meeting location details.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]
 
Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''OWASP at Mercury Network Security Symposium'''

OWASP will be at the [http://mercurynetworkssecurity.com Mercury Networks Security Symposium] again this year. Come visit us at the [http://maps.google.com/maps?q=Doubletree+Hotel+Rochester,+1111+Jefferson+Road,+Rochester,+NY&hl=en&sll=43.086364,-77.607272&sspn=0.014449,0.018089&oq=Doubletree+hotel+1111+jef&hq=Doubletree+Hotel&hnear=1111+Jefferson+Rd,+Rochester,+New+York+14623&t=m&z=17 Doubletree Hotel, Rochester, NY] on May 3rd, from 7:45am to 12:30pm.

Our chapter evangelist, Lou Leone, will also give a technical presentation at 8:30: "I'll see your cross site scripting and raise you a Content Security Policy"

The event is free for IT Professional. Please register for the event at [http://mercurynetworkssecurity.com/Register.html http://mercurynetworkssecurity.com/Register.html]

See you there!

'''March Meeting'''

What: Joint ISSA and OWASP meeting - De-Anonymizing Anonymous

When: Thursday, March 29th at 5:30pm

Location: Nixon Peabody LLP - 1300 Clinton Square, Susan B. Anthony 14th Floor Conference Room - Rochester, NY 14604

Abstract: What do you see when you take the Guy Fawkes mask off? In 2011, Imperva managed to witness an assault by hacktivist group Anonymous including the use of social media for communications and, most importantly, their attack methods. Since Anonymous' targets are highly variable, anyone can fall victim and security professionals need to know how to prepare.

This talk will give a walk-through the key stages of an Anonymous campaign:

* Recruitment and communication: We show how Anonymous leverages social networks to recruit its members and pick a target.
* Application attack: We detail and sequence the steps Anonymous hackers deploy to take data and bring down websites.
* DDoS: In this final stage, we shed light on the DDoS techniques deployed to take down websites.

Finally, we recommend key mitigation steps that organizations need to take if they ever become a target.

Speaker: Noa is a senior security strategist at Imperva. In this role Noa researches and analyzes the trends in the threat landscape. She is a frequent contributor to different security magazines, comments on security-breaking news, and is regularly invited to speak at industry events. Currently, Noa also writes a bi-weekly column on hacker trends and techniques for SecurityWeek. Previously, she held the position of a senior security researcher for Imperva's Application Defense Center. She holds a MSc degree (specializing in information security) from Tel-Aviv University.

Please RSVP to [mailto:info@rocissa.org info@rocissa.org] by Friday, March 23 so we can get a headcount.

Directions:

From the East:

* Take I-490 west towards Rochester
* Take the Clinton Avenue exit
* Clinton Square Building is about two blocks down on left
* Go through Broad Street/Clinton intersection, passing Clinton Square Building on the left
* Entrance to parking garage is on left just after Broad Street
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

From the West:

* Take I-490 East towards Rochester
* Stay in the right lane to cross the Troup-Howell bridge. Take exit 15 for South Ave./Rte. 15
* Turn left at 2nd light
* Turn left at light onto Clinton
* Stay in second lane from the left
* Clinton Square Building (corner of Clinton & Broad) is about two blocks down on left
* Go through Broad Street/Clinton intersection, pass Clinton Square Building on the left, and take first driveway on left to enter Clinton Square Parking garage
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

== Past Events ==
;May 2011 Meeting
Michael Coates webinar on Attack-Aware Applications. 
https://owasp.webex.com/owasp/ldr.php?AT=pb&SP=MC&rID=87764002&rKey=14191b8f8c73dabc

;May 5, 2011
MercuryFest
Speakers: Ralph Durkee, Andrea Cogliati, Duane Peifer
Topic: SSL Man-in-the-Middle and Spoofing Attacks

;March 2011 Meeting
Topic: Pastebin Scrapping 
Speaker: Silas Cutler, Global Crossing, Security Architect

;January 2011 Meeting
Topic: State of OWASP and the State of Web Application Security 
Speaker: Ralph Durkee, Durkee Consulting

;August Meeting 2010
Topic: Man in the Middle Attacks: SSL Spoofing 
Speaker: Duane Peifer, UberGuard Information Security and Ralph Durkee, Durkee Consulting

;June Meeting 2010
Topic: Client Side Exploits 101 
Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and Information Assurance, RIT 2008; CISSP; MCSE, CSS

;May Meeting 2010
Topic: New Techniques in Application Intrusion Detection 
Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

;February Meeting 2010
Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
Mercury Networks Security Symposium May 2012 I'll see your cross site scripting and raise you a Content Security Policy by Lou Leone [[Media:https://www.owasp.org/images/9/95/2012_CSP.pptx|PPTX]]

January Meeting 2011 State of OWASP and the State of Web Application Security by Ralph Durkee [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.ppt‎|PPT]] [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.pdf|PDF]] 

August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Duane Peifer [[Media:SSL_Spoofing.ppt‎|PPT]] [[Media:SSL_Spoofing.pdf|PDF]] 
August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Ralph Durkee [[Media:Ralph_Durkee_SSL_MITM_v1.ppt‎|PPT]] [[Media:Ralph_Durkee_SSL_MITM_v1.pdf|PDF]] 

May Meeting 2010 New Techniques in Application Intrusion Detection by Al Huizenga [[Media:OWASP may17-10.pptx|PPTX]] [[Media:OWASP may17-10.pdf|PDF]] 
May Meeting 2010 Identity Federation and Claim-based Security by Andrea Cogliati [[Media:SAML and Claims-Based Security.pdf|PDF]]

February Meeting 2010 DC AppSec Conference Recap by Ralph Durkee [[Media:OWASP Rochester 2010 Feb.ppt|PPT]]

October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

File:2012 CSP.pptx

2012-05-04T16:14:50Z

Sir W: "I'll see your cross site scripting and raise you a Content Security Policy" by Lou Leone

"I'll see your cross site scripting and raise you a Content Security Policy" by Lou Leone

Rochester

2012-04-23T17:56:36Z

Sir W: Added Mercury Networks Security Symposium

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@owasp.org Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@owasp.org Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Locations for formal meetings will be announced with the corresponding meeting so please check here or the mailing [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announcement] list for specific meeting location details.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]
 
Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''OWASP at Mercury Network Security Symposium'''

OWASP will be at the [http://mercurynetworkssecurity.com Mercury Networks Security Symposium] again this year. Come visit us at the [http://maps.google.com/maps?q=Doubletree+Hotel+Rochester,+1111+Jefferson+Road,+Rochester,+NY&hl=en&sll=43.086364,-77.607272&sspn=0.014449,0.018089&oq=Doubletree+hotel+1111+jef&hq=Doubletree+Hotel&hnear=1111+Jefferson+Rd,+Rochester,+New+York+14623&t=m&z=17 Doubletree Hotel, Rochester, NY] on May 3rd, from 7:45am to 12:30pm.

Our chapter evangelist, Lou Leone, will also give a technical presentation at 8:30: "I'll see your cross site scripting and raise you a Content Security Policy"

The event is free for IT Professional. Please register for the event at [http://mercurynetworkssecurity.com/Register.html http://mercurynetworkssecurity.com/Register.html]

See you there!

'''March Meeting'''

What: Joint ISSA and OWASP meeting - De-Anonymizing Anonymous

When: Thursday, March 29th at 5:30pm

Location: Nixon Peabody LLP - 1300 Clinton Square, Susan B. Anthony 14th Floor Conference Room - Rochester, NY 14604

Abstract: What do you see when you take the Guy Fawkes mask off? In 2011, Imperva managed to witness an assault by hacktivist group Anonymous including the use of social media for communications and, most importantly, their attack methods. Since Anonymous' targets are highly variable, anyone can fall victim and security professionals need to know how to prepare.

This talk will give a walk-through the key stages of an Anonymous campaign:

* Recruitment and communication: We show how Anonymous leverages social networks to recruit its members and pick a target.
* Application attack: We detail and sequence the steps Anonymous hackers deploy to take data and bring down websites.
* DDoS: In this final stage, we shed light on the DDoS techniques deployed to take down websites.

Finally, we recommend key mitigation steps that organizations need to take if they ever become a target.

Speaker: Noa is a senior security strategist at Imperva. In this role Noa researches and analyzes the trends in the threat landscape. She is a frequent contributor to different security magazines, comments on security-breaking news, and is regularly invited to speak at industry events. Currently, Noa also writes a bi-weekly column on hacker trends and techniques for SecurityWeek. Previously, she held the position of a senior security researcher for Imperva's Application Defense Center. She holds a MSc degree (specializing in information security) from Tel-Aviv University.

Please RSVP to [mailto:info@rocissa.org info@rocissa.org] by Friday, March 23 so we can get a headcount.

Directions:

From the East:

* Take I-490 west towards Rochester
* Take the Clinton Avenue exit
* Clinton Square Building is about two blocks down on left
* Go through Broad Street/Clinton intersection, passing Clinton Square Building on the left
* Entrance to parking garage is on left just after Broad Street
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

From the West:

* Take I-490 East towards Rochester
* Stay in the right lane to cross the Troup-Howell bridge. Take exit 15 for South Ave./Rte. 15
* Turn left at 2nd light
* Turn left at light onto Clinton
* Stay in second lane from the left
* Clinton Square Building (corner of Clinton & Broad) is about two blocks down on left
* Go through Broad Street/Clinton intersection, pass Clinton Square Building on the left, and take first driveway on left to enter Clinton Square Parking garage
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

== Past Events ==
;May 2011 Meeting
Michael Coates webinar on Attack-Aware Applications. 
https://owasp.webex.com/owasp/ldr.php?AT=pb&SP=MC&rID=87764002&rKey=14191b8f8c73dabc

;May 5, 2011
MercuryFest
Speakers: Ralph Durkee, Andrea Cogliati, Duane Peifer
Topic: SSL Man-in-the-Middle and Spoofing Attacks

;March 2011 Meeting
Topic: Pastebin Scrapping 
Speaker: Silas Cutler, Global Crossing, Security Architect

;January 2011 Meeting
Topic: State of OWASP and the State of Web Application Security 
Speaker: Ralph Durkee, Durkee Consulting

;August Meeting 2010
Topic: Man in the Middle Attacks: SSL Spoofing 
Speaker: Duane Peifer, UberGuard Information Security and Ralph Durkee, Durkee Consulting

;June Meeting 2010
Topic: Client Side Exploits 101 
Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and Information Assurance, RIT 2008; CISSP; MCSE, CSS

;May Meeting 2010
Topic: New Techniques in Application Intrusion Detection 
Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

;February Meeting 2010
Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
January Meeting 2011 State of OWASP and the State of Web Application Security by Ralph Durkee [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.ppt‎|PPT]] [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.pdf|PDF]] 

August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Duane Peifer [[Media:SSL_Spoofing.ppt‎|PPT]] [[Media:SSL_Spoofing.pdf|PDF]] 
August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Ralph Durkee [[Media:Ralph_Durkee_SSL_MITM_v1.ppt‎|PPT]] [[Media:Ralph_Durkee_SSL_MITM_v1.pdf|PDF]] 

May Meeting 2010 New Techniques in Application Intrusion Detection by Al Huizenga [[Media:OWASP may17-10.pptx|PPTX]] [[Media:OWASP may17-10.pdf|PDF]] 
May Meeting 2010 Identity Federation and Claim-based Security by Andrea Cogliati [[Media:SAML and Claims-Based Security.pdf|PDF]]

February Meeting 2010 DC AppSec Conference Recap by Ralph Durkee [[Media:OWASP Rochester 2010 Feb.ppt|PPT]]

October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2012-04-10T21:06:52Z

Sir W: Removed survey

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@owasp.org Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@owasp.org Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Locations for formal meetings will be announced with the corresponding meeting so please check here or the mailing [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announcement] list for specific meeting location details.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]
 
Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''March Meeting'''

What: Joint ISSA and OWASP meeting - De-Anonymizing Anonymous

When: Thursday, March 29th at 5:30pm

Location: Nixon Peabody LLP - 1300 Clinton Square, Susan B. Anthony 14th Floor Conference Room - Rochester, NY 14604

Abstract: What do you see when you take the Guy Fawkes mask off? In 2011, Imperva managed to witness an assault by hacktivist group Anonymous including the use of social media for communications and, most importantly, their attack methods. Since Anonymous' targets are highly variable, anyone can fall victim and security professionals need to know how to prepare.

This talk will give a walk-through the key stages of an Anonymous campaign:

* Recruitment and communication: We show how Anonymous leverages social networks to recruit its members and pick a target.
* Application attack: We detail and sequence the steps Anonymous hackers deploy to take data and bring down websites.
* DDoS: In this final stage, we shed light on the DDoS techniques deployed to take down websites.

Finally, we recommend key mitigation steps that organizations need to take if they ever become a target.

Speaker: Noa is a senior security strategist at Imperva. In this role Noa researches and analyzes the trends in the threat landscape. She is a frequent contributor to different security magazines, comments on security-breaking news, and is regularly invited to speak at industry events. Currently, Noa also writes a bi-weekly column on hacker trends and techniques for SecurityWeek. Previously, she held the position of a senior security researcher for Imperva's Application Defense Center. She holds a MSc degree (specializing in information security) from Tel-Aviv University.

Please RSVP to [mailto:info@rocissa.org info@rocissa.org] by Friday, March 23 so we can get a headcount.

Directions:

From the East:

* Take I-490 west towards Rochester
* Take the Clinton Avenue exit
* Clinton Square Building is about two blocks down on left
* Go through Broad Street/Clinton intersection, passing Clinton Square Building on the left
* Entrance to parking garage is on left just after Broad Street
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

From the West:

* Take I-490 East towards Rochester
* Stay in the right lane to cross the Troup-Howell bridge. Take exit 15 for South Ave./Rte. 15
* Turn left at 2nd light
* Turn left at light onto Clinton
* Stay in second lane from the left
* Clinton Square Building (corner of Clinton & Broad) is about two blocks down on left
* Go through Broad Street/Clinton intersection, pass Clinton Square Building on the left, and take first driveway on left to enter Clinton Square Parking garage
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

== Past Events ==
;May 2011 Meeting
Michael Coates webinar on Attack-Aware Applications. 
https://owasp.webex.com/owasp/ldr.php?AT=pb&SP=MC&rID=87764002&rKey=14191b8f8c73dabc

;May 5, 2011
MercuryFest
Speakers: Ralph Durkee, Andrea Cogliati, Duane Peifer
Topic: SSL Man-in-the-Middle and Spoofing Attacks

;March 2011 Meeting
Topic: Pastebin Scrapping 
Speaker: Silas Cutler, Global Crossing, Security Architect

;January 2011 Meeting
Topic: State of OWASP and the State of Web Application Security 
Speaker: Ralph Durkee, Durkee Consulting

;August Meeting 2010
Topic: Man in the Middle Attacks: SSL Spoofing 
Speaker: Duane Peifer, UberGuard Information Security and Ralph Durkee, Durkee Consulting

;June Meeting 2010
Topic: Client Side Exploits 101 
Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and Information Assurance, RIT 2008; CISSP; MCSE, CSS

;May Meeting 2010
Topic: New Techniques in Application Intrusion Detection 
Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

;February Meeting 2010
Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
January Meeting 2011 State of OWASP and the State of Web Application Security by Ralph Durkee [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.ppt‎|PPT]] [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.pdf|PDF]] 

August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Duane Peifer [[Media:SSL_Spoofing.ppt‎|PPT]] [[Media:SSL_Spoofing.pdf|PDF]] 
August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Ralph Durkee [[Media:Ralph_Durkee_SSL_MITM_v1.ppt‎|PPT]] [[Media:Ralph_Durkee_SSL_MITM_v1.pdf|PDF]] 

May Meeting 2010 New Techniques in Application Intrusion Detection by Al Huizenga [[Media:OWASP may17-10.pptx|PPTX]] [[Media:OWASP may17-10.pdf|PDF]] 
May Meeting 2010 Identity Federation and Claim-based Security by Andrea Cogliati [[Media:SAML and Claims-Based Security.pdf|PDF]]

February Meeting 2010 DC AppSec Conference Recap by Ralph Durkee [[Media:OWASP Rochester 2010 Feb.ppt|PPT]]

October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2012-03-24T14:48:13Z

Sir W: /* Local Officers */

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Help Us Improve Our Chapter ==

We are looking for feedback on how to better our chapter. If you'd like to give us feedback, we have an anonymous survey setup here:

http://www.surveymonkey.com/s/MTBH3S2

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@owasp.org Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@owasp.org Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Locations for formal meetings will be announced with the corresponding meeting so please check here or the mailing [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announcement] list for specific meeting location details.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]
 
Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''March Meeting'''

What: Joint ISSA and OWASP meeting - De-Anonymizing Anonymous

When: Thursday, March 29th at 5:30pm

Location: Nixon Peabody LLP - 1300 Clinton Square, Susan B. Anthony 14th Floor Conference Room - Rochester, NY 14604

Abstract: What do you see when you take the Guy Fawkes mask off? In 2011, Imperva managed to witness an assault by hacktivist group Anonymous including the use of social media for communications and, most importantly, their attack methods. Since Anonymous' targets are highly variable, anyone can fall victim and security professionals need to know how to prepare.

This talk will give a walk-through the key stages of an Anonymous campaign:

* Recruitment and communication: We show how Anonymous leverages social networks to recruit its members and pick a target.
* Application attack: We detail and sequence the steps Anonymous hackers deploy to take data and bring down websites.
* DDoS: In this final stage, we shed light on the DDoS techniques deployed to take down websites.

Finally, we recommend key mitigation steps that organizations need to take if they ever become a target.

Speaker: Noa is a senior security strategist at Imperva. In this role Noa researches and analyzes the trends in the threat landscape. She is a frequent contributor to different security magazines, comments on security-breaking news, and is regularly invited to speak at industry events. Currently, Noa also writes a bi-weekly column on hacker trends and techniques for SecurityWeek. Previously, she held the position of a senior security researcher for Imperva's Application Defense Center. She holds a MSc degree (specializing in information security) from Tel-Aviv University.

Please RSVP to [mailto:info@rocissa.org info@rocissa.org] by Friday, March 23 so we can get a headcount.

Directions:

From the East:

* Take I-490 west towards Rochester
* Take the Clinton Avenue exit
* Clinton Square Building is about two blocks down on left
* Go through Broad Street/Clinton intersection, passing Clinton Square Building on the left
* Entrance to parking garage is on left just after Broad Street
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

From the West:

* Take I-490 East towards Rochester
* Stay in the right lane to cross the Troup-Howell bridge. Take exit 15 for South Ave./Rte. 15
* Turn left at 2nd light
* Turn left at light onto Clinton
* Stay in second lane from the left
* Clinton Square Building (corner of Clinton & Broad) is about two blocks down on left
* Go through Broad Street/Clinton intersection, pass Clinton Square Building on the left, and take first driveway on left to enter Clinton Square Parking garage
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

== Past Events ==
;May 2011 Meeting
Michael Coates webinar on Attack-Aware Applications. 
https://owasp.webex.com/owasp/ldr.php?AT=pb&SP=MC&rID=87764002&rKey=14191b8f8c73dabc

;May 5, 2011
MercuryFest
Speakers: Ralph Durkee, Andrea Cogliati, Duane Peifer
Topic: SSL Man-in-the-Middle and Spoofing Attacks

;March 2011 Meeting
Topic: Pastebin Scrapping 
Speaker: Silas Cutler, Global Crossing, Security Architect

;January 2011 Meeting
Topic: State of OWASP and the State of Web Application Security 
Speaker: Ralph Durkee, Durkee Consulting

;August Meeting 2010
Topic: Man in the Middle Attacks: SSL Spoofing 
Speaker: Duane Peifer, UberGuard Information Security and Ralph Durkee, Durkee Consulting

;June Meeting 2010
Topic: Client Side Exploits 101 
Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and Information Assurance, RIT 2008; CISSP; MCSE, CSS

;May Meeting 2010
Topic: New Techniques in Application Intrusion Detection 
Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

;February Meeting 2010
Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
January Meeting 2011 State of OWASP and the State of Web Application Security by Ralph Durkee [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.ppt‎|PPT]] [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.pdf|PDF]] 

August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Duane Peifer [[Media:SSL_Spoofing.ppt‎|PPT]] [[Media:SSL_Spoofing.pdf|PDF]] 
August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Ralph Durkee [[Media:Ralph_Durkee_SSL_MITM_v1.ppt‎|PPT]] [[Media:Ralph_Durkee_SSL_MITM_v1.pdf|PDF]] 

May Meeting 2010 New Techniques in Application Intrusion Detection by Al Huizenga [[Media:OWASP may17-10.pptx|PPTX]] [[Media:OWASP may17-10.pdf|PDF]] 
May Meeting 2010 Identity Federation and Claim-based Security by Andrea Cogliati [[Media:SAML and Claims-Based Security.pdf|PDF]]

February Meeting 2010 DC AppSec Conference Recap by Ralph Durkee [[Media:OWASP Rochester 2010 Feb.ppt|PPT]]

October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2012-03-24T14:46:56Z

Sir W: Fixed Duane's address

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Help Us Improve Our Chapter ==

We are looking for feedback on how to better our chapter. If you'd like to give us feedback, we have an anonymous survey setup here:

http://www.surveymonkey.com/s/MTBH3S2

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@gmail.com Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@gmail.com Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Locations for formal meetings will be announced with the corresponding meeting so please check here or the mailing [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announcement] list for specific meeting location details.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]
 
Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''March Meeting'''

What: Joint ISSA and OWASP meeting - De-Anonymizing Anonymous

When: Thursday, March 29th at 5:30pm

Location: Nixon Peabody LLP - 1300 Clinton Square, Susan B. Anthony 14th Floor Conference Room - Rochester, NY 14604

Abstract: What do you see when you take the Guy Fawkes mask off? In 2011, Imperva managed to witness an assault by hacktivist group Anonymous including the use of social media for communications and, most importantly, their attack methods. Since Anonymous' targets are highly variable, anyone can fall victim and security professionals need to know how to prepare.

This talk will give a walk-through the key stages of an Anonymous campaign:

* Recruitment and communication: We show how Anonymous leverages social networks to recruit its members and pick a target.
* Application attack: We detail and sequence the steps Anonymous hackers deploy to take data and bring down websites.
* DDoS: In this final stage, we shed light on the DDoS techniques deployed to take down websites.

Finally, we recommend key mitigation steps that organizations need to take if they ever become a target.

Speaker: Noa is a senior security strategist at Imperva. In this role Noa researches and analyzes the trends in the threat landscape. She is a frequent contributor to different security magazines, comments on security-breaking news, and is regularly invited to speak at industry events. Currently, Noa also writes a bi-weekly column on hacker trends and techniques for SecurityWeek. Previously, she held the position of a senior security researcher for Imperva's Application Defense Center. She holds a MSc degree (specializing in information security) from Tel-Aviv University.

Please RSVP to [mailto:info@rocissa.org info@rocissa.org] by Friday, March 23 so we can get a headcount.

Directions:

From the East:

* Take I-490 west towards Rochester
* Take the Clinton Avenue exit
* Clinton Square Building is about two blocks down on left
* Go through Broad Street/Clinton intersection, passing Clinton Square Building on the left
* Entrance to parking garage is on left just after Broad Street
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

From the West:

* Take I-490 East towards Rochester
* Stay in the right lane to cross the Troup-Howell bridge. Take exit 15 for South Ave./Rte. 15
* Turn left at 2nd light
* Turn left at light onto Clinton
* Stay in second lane from the left
* Clinton Square Building (corner of Clinton & Broad) is about two blocks down on left
* Go through Broad Street/Clinton intersection, pass Clinton Square Building on the left, and take first driveway on left to enter Clinton Square Parking garage
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

== Past Events ==
;May 2011 Meeting
Michael Coates webinar on Attack-Aware Applications. 
https://owasp.webex.com/owasp/ldr.php?AT=pb&SP=MC&rID=87764002&rKey=14191b8f8c73dabc

;May 5, 2011
MercuryFest
Speakers: Ralph Durkee, Andrea Cogliati, Duane Peifer
Topic: SSL Man-in-the-Middle and Spoofing Attacks

;March 2011 Meeting
Topic: Pastebin Scrapping 
Speaker: Silas Cutler, Global Crossing, Security Architect

;January 2011 Meeting
Topic: State of OWASP and the State of Web Application Security 
Speaker: Ralph Durkee, Durkee Consulting

;August Meeting 2010
Topic: Man in the Middle Attacks: SSL Spoofing 
Speaker: Duane Peifer, UberGuard Information Security and Ralph Durkee, Durkee Consulting

;June Meeting 2010
Topic: Client Side Exploits 101 
Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and Information Assurance, RIT 2008; CISSP; MCSE, CSS

;May Meeting 2010
Topic: New Techniques in Application Intrusion Detection 
Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

;February Meeting 2010
Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
January Meeting 2011 State of OWASP and the State of Web Application Security by Ralph Durkee [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.ppt‎|PPT]] [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.pdf|PDF]] 

August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Duane Peifer [[Media:SSL_Spoofing.ppt‎|PPT]] [[Media:SSL_Spoofing.pdf|PDF]] 
August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Ralph Durkee [[Media:Ralph_Durkee_SSL_MITM_v1.ppt‎|PPT]] [[Media:Ralph_Durkee_SSL_MITM_v1.pdf|PDF]] 

May Meeting 2010 New Techniques in Application Intrusion Detection by Al Huizenga [[Media:OWASP may17-10.pptx|PPTX]] [[Media:OWASP may17-10.pdf|PDF]] 
May Meeting 2010 Identity Federation and Claim-based Security by Andrea Cogliati [[Media:SAML and Claims-Based Security.pdf|PDF]]

February Meeting 2010 DC AppSec Conference Recap by Ralph Durkee [[Media:OWASP Rochester 2010 Feb.ppt|PPT]]

October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2012-03-18T23:17:05Z

Sir W: Added March meeting

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Help Us Improve Our Chapter ==

We are looking for feedback on how to better our chapter. If you'd like to give us feedback, we have an anonymous survey setup here:

http://www.surveymonkey.com/s/MTBH3S2

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@gmail.com Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@uberguard.com Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Locations for formal meetings will be announced with the corresponding meeting so please check here or the mailing [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announcement] list for specific meeting location details.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]
 
Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''March Meeting'''

What: Joint ISSA and OWASP meeting - De-Anonymizing Anonymous

When: Thursday, March 29th at 5:30pm

Location: Nixon Peabody LLP - 1300 Clinton Square, Susan B. Anthony 14th Floor Conference Room - Rochester, NY 14604

Abstract: What do you see when you take the Guy Fawkes mask off? In 2011, Imperva managed to witness an assault by hacktivist group Anonymous including the use of social media for communications and, most importantly, their attack methods. Since Anonymous' targets are highly variable, anyone can fall victim and security professionals need to know how to prepare.

This talk will give a walk-through the key stages of an Anonymous campaign:

* Recruitment and communication: We show how Anonymous leverages social networks to recruit its members and pick a target.
* Application attack: We detail and sequence the steps Anonymous hackers deploy to take data and bring down websites.
* DDoS: In this final stage, we shed light on the DDoS techniques deployed to take down websites.

Finally, we recommend key mitigation steps that organizations need to take if they ever become a target.

Speaker: Noa is a senior security strategist at Imperva. In this role Noa researches and analyzes the trends in the threat landscape. She is a frequent contributor to different security magazines, comments on security-breaking news, and is regularly invited to speak at industry events. Currently, Noa also writes a bi-weekly column on hacker trends and techniques for SecurityWeek. Previously, she held the position of a senior security researcher for Imperva's Application Defense Center. She holds a MSc degree (specializing in information security) from Tel-Aviv University.

Please RSVP to [mailto:info@rocissa.org info@rocissa.org] by Friday, March 23 so we can get a headcount.

Directions:

From the East:

* Take I-490 west towards Rochester
* Take the Clinton Avenue exit
* Clinton Square Building is about two blocks down on left
* Go through Broad Street/Clinton intersection, passing Clinton Square Building on the left
* Entrance to parking garage is on left just after Broad Street
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

From the West:

* Take I-490 East towards Rochester
* Stay in the right lane to cross the Troup-Howell bridge. Take exit 15 for South Ave./Rte. 15
* Turn left at 2nd light
* Turn left at light onto Clinton
* Stay in second lane from the left
* Clinton Square Building (corner of Clinton & Broad) is about two blocks down on left
* Go through Broad Street/Clinton intersection, pass Clinton Square Building on the left, and take first driveway on left to enter Clinton Square Parking garage
* Take garage elevator to lobby; then take lobby elevators to 14th floor
* The meeting will be in Conference Room 14A, the Susan B. Anthony Room

== Past Events ==
;May 2011 Meeting
Michael Coates webinar on Attack-Aware Applications. 
https://owasp.webex.com/owasp/ldr.php?AT=pb&SP=MC&rID=87764002&rKey=14191b8f8c73dabc

;May 5, 2011
MercuryFest
Speakers: Ralph Durkee, Andrea Cogliati, Duane Peifer
Topic: SSL Man-in-the-Middle and Spoofing Attacks

;March 2011 Meeting
Topic: Pastebin Scrapping 
Speaker: Silas Cutler, Global Crossing, Security Architect

;January 2011 Meeting
Topic: State of OWASP and the State of Web Application Security 
Speaker: Ralph Durkee, Durkee Consulting

;August Meeting 2010
Topic: Man in the Middle Attacks: SSL Spoofing 
Speaker: Duane Peifer, UberGuard Information Security and Ralph Durkee, Durkee Consulting

;June Meeting 2010
Topic: Client Side Exploits 101 
Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and Information Assurance, RIT 2008; CISSP; MCSE, CSS

;May Meeting 2010
Topic: New Techniques in Application Intrusion Detection 
Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

;February Meeting 2010
Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
January Meeting 2011 State of OWASP and the State of Web Application Security by Ralph Durkee [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.ppt‎|PPT]] [[Media:Ralph_Durkee_State_of_Web_App_Security_v8.pdf|PDF]] 

August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Duane Peifer [[Media:SSL_Spoofing.ppt‎|PPT]] [[Media:SSL_Spoofing.pdf|PDF]] 
August Meeting 2010 Man in the Middle Attacks: SSL Spoofing by Ralph Durkee [[Media:Ralph_Durkee_SSL_MITM_v1.ppt‎|PPT]] [[Media:Ralph_Durkee_SSL_MITM_v1.pdf|PDF]] 

May Meeting 2010 New Techniques in Application Intrusion Detection by Al Huizenga [[Media:OWASP may17-10.pptx|PPTX]] [[Media:OWASP may17-10.pdf|PDF]] 
May Meeting 2010 Identity Federation and Claim-based Security by Andrea Cogliati [[Media:SAML and Claims-Based Security.pdf|PDF]]

February Meeting 2010 DC AppSec Conference Recap by Ralph Durkee [[Media:OWASP Rochester 2010 Feb.ppt|PPT]]

October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Summit 2011 Attendee/Attendee026

2011-01-05T19:07:42Z

Sir W: Added funding for Ralph Durkee from Rochester chapter

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>OWASP 2011 Global Summit Attendee Tab</noinclude>
|-
| summit_attendee_name1 = Ralph Durkee
| summit_attendee_email1 = ralph.durkee@owasp.org
| summit_attendee_wiki_username1 =
|-
| summit_attendee_company = [http://www.rd1.net/rdc_home.html Durkee Consulting]
|-
| Project Leadership (less than 6 months old) =
| Project Leadership (more than 6 months old) =
| Release Leadership (less than 6 months old) =
| Release Leadership (more than 6 months old) =
| Project Contribution (less than 6 months old) =
| Project Contribution (more than 6 months old) =
| Release Contribution (less than 6 months old) =
| Release Contribution (more than 6 months old) =
| Committee Membership = Conferences
| Chapter Co-Leadership = Rochester
| Conference Co-Leadership = Rochester Security Summit 08, Rochester Security Summit 09, Rochester Security Summit 10
|-
| summit_attendee_current_owasp_involvement_name1 = Global Conferences Committee
| summit_attendee_current_owasp_involvement_url_1 = http://www.owasp.org/index.php/Global_Conferences_Committee
| summit_attendee_current_owasp_involvement_name2 = Rochester, NY Chapter Founder and Vice President
| summit_attendee_current_owasp_involvement_url_2 = http://www.owasp.org/rochester
| summit_attendee_current_owasp_involvement_name3 =
| summit_attendee_current_owasp_involvement_url_3 =
| summit_attendee_current_owasp_involvement_name4 =
| summit_attendee_current_owasp_involvement_url_4 =
| summit_attendee_current_owasp_involvement_name5 =
| summit_attendee_current_owasp_involvement_url_5 =
|-
| summit_attendee_reason_for_summit_participation_name1 =
| summit_attendee_reason_for_summit_participation_url_1 =
| notes_reason_for_participating_issues_to_be_discussed_1 =
| summit_attendee_reason_for_summit_participation_name2 =
| summit_attendee_reason_for_summit_participation_url_2 =
| notes_reason_for_participating_issues_to_be_discussed_2 =
| summit_attendee_reason_for_summit_participation_name3 =
| summit_attendee_reason_for_summit_participation_url_3 =
| notes_reason_for_participating_issues_to_be_discussed_3 =
| summit_attendee_reason_for_summit_participation_name4 =
| summit_attendee_reason_for_summit_participation_url_4 =
| notes_reason_for_participating_issues_to_be_discussed_4 =
| summit_attendee_reason_for_summit_participation_name5 =
| summit_attendee_reason_for_summit_participation_url_5 =
| notes_reason_for_participating_issues_to_be_discussed_5 =
|-
| summit_attendee_owasp_sponsor = N/A
|-
| summit_attendee_summit_time_paid_by_name1 = self
| summit_attendee_summit_time_paid_by_url_1 =
| summit_attendee_summit_time_paid_by_name2 =
| summit_attendee_summit_time_paid_by_url_2 =
|-
| summit_attendee_summit_expenses_paid_by_name1 = $300 from Rochester Chapter
| summit_attendee_summit_expenses_paid_by_url_1 = http://owasp.org/rochester
| summit_attendee_summit_expenses_paid_by_name2 =
| summit_attendee_summit_expenses_paid_by_url_2 =
|-
| reason_for_sponsorship = Active Committee Member
|-
| status = Confirmed, seeking funds
|-
| letter sent to sponsor =
|-
| notes for Kate =
|-
| attendee_name_mask =  Attendee026
| attendee_home_page =  Summit_2011_Attendee/Attendee026
}}

Rochester

2010-05-20T14:33:24Z

Sir W: Fixed mail link

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@uberguard.com Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@uberguard.com Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Mykonos Software has been graciously providing meeting space for our formal meetings. Mykonos is located at 220 Kenneth Dr, Rochester, NY (entrance from Lehigh Station Rd or W Henrietta Rd), near 390 and Lehigh Station Road.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''May Meeting'''

When: May 17th, 6pm

Where: Mykonos (BlueTie) at 220 Kenneth Dr, Rochester, NY (entrance from Lehigh Station Rd or W Henrietta Rd), near 390 and Lehigh Station Road

Topic: New Techniques in Application Intrusion Detection

Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

Abstract: Current solutions for securing legacy Web applications rely on a “lock-it-down” approach, similar to how IT security administrators use firewalls to lock down ports and servers. But applications are complicated, and it’s often impractical to create a rule set that tightly filters every app-level input. New alternative approaches to intrusion detection and response at the application layer are emerging. One key trend is to enhance the application code itself with built-in defensive logic. By instrumenting application code with incident detection triggers and dynamic responses, administrators can prevent application abuse before bad users establish an attack vector. In this presentation, we’ll discuss the merits and challenges of this approach. We’ll focus on specific examples, including the OWASP AppSensor project and the Mykonos Security Appliance.

Speaker Bio: Al Huizenga runs product strategy for Mykonos Software, a startup focused on new ways to secure Web applications from abuse. Al has 11 years experience marketing Web-based products and technologies. He is fascinated by how the same technology attributes that drive Web application adoption – openness, transparency, and ubiquity – also represent severe risk to the businesses that use them.

'''June Meeting - Joint Meeting with ISSA'''

When: June 10th, 2010, 6-7:30pm

Location: BlueTie, 220 Kenneth Drive, Rochester, NY (entrance from W
Henrietta Rd or Lehigh Station Rd)

Please RSVP at info@rochissa.org by Friday, June 10th

Title: Client Side Exploits 101

Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and
Information Assurance, RIT 2008; CISSP; MCSE, CSS

Abstract: JP will talk about some concepts of client side attacks. An introduction to Metasploit will be given. A case study of how to craft a malicious PDF payload will be demonstrated to introduce some of the key features and abilities of Metasploit and it's plugin's/modules. JP will go over some of the basics of Nmap and then suggest some ideas on how to defend against these types of attacks.

Speaker's bio: JP has five years experience in computer networking, system administration, and information security. During the day JP is responsible for Network and Security Management for a medium size global company based in the US. JP is also adjunct faculty at Rochester Institute of Technology where he teaches Networking and Security undergraduate classes. JP also performs pen testing and security audits for local companies in Rochester, NY.

== Past Events ==

;February Meeting

Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2010-05-20T14:32:57Z

Sir W: Fixed chapter leader

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [andrea.cogliati@owasp.org Andrea Cogliati]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@uberguard.com Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@uberguard.com Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Mykonos Software has been graciously providing meeting space for our formal meetings. Mykonos is located at 220 Kenneth Dr, Rochester, NY (entrance from Lehigh Station Rd or W Henrietta Rd), near 390 and Lehigh Station Road.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Meetings reminders are sent to the OWASP Rochester Announcement distribution list at least one week prior to a meeting.

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''May Meeting'''

When: May 17th, 6pm

Where: Mykonos (BlueTie) at 220 Kenneth Dr, Rochester, NY (entrance from Lehigh Station Rd or W Henrietta Rd), near 390 and Lehigh Station Road

Topic: New Techniques in Application Intrusion Detection

Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

Abstract: Current solutions for securing legacy Web applications rely on a “lock-it-down” approach, similar to how IT security administrators use firewalls to lock down ports and servers. But applications are complicated, and it’s often impractical to create a rule set that tightly filters every app-level input. New alternative approaches to intrusion detection and response at the application layer are emerging. One key trend is to enhance the application code itself with built-in defensive logic. By instrumenting application code with incident detection triggers and dynamic responses, administrators can prevent application abuse before bad users establish an attack vector. In this presentation, we’ll discuss the merits and challenges of this approach. We’ll focus on specific examples, including the OWASP AppSensor project and the Mykonos Security Appliance.

Speaker Bio: Al Huizenga runs product strategy for Mykonos Software, a startup focused on new ways to secure Web applications from abuse. Al has 11 years experience marketing Web-based products and technologies. He is fascinated by how the same technology attributes that drive Web application adoption – openness, transparency, and ubiquity – also represent severe risk to the businesses that use them.

'''June Meeting - Joint Meeting with ISSA'''

When: June 10th, 2010, 6-7:30pm

Location: BlueTie, 220 Kenneth Drive, Rochester, NY (entrance from W
Henrietta Rd or Lehigh Station Rd)

Please RSVP at info@rochissa.org by Friday, June 10th

Title: Client Side Exploits 101

Speaker: JP Bourget, BS IT, RIT 2005; MS Computer Security and
Information Assurance, RIT 2008; CISSP; MCSE, CSS

Abstract: JP will talk about some concepts of client side attacks. An introduction to Metasploit will be given. A case study of how to craft a malicious PDF payload will be demonstrated to introduce some of the key features and abilities of Metasploit and it's plugin's/modules. JP will go over some of the basics of Nmap and then suggest some ideas on how to defend against these types of attacks.

Speaker's bio: JP has five years experience in computer networking, system administration, and information security. During the day JP is responsible for Network and Security Management for a medium size global company based in the US. JP is also adjunct faculty at Rochester Institute of Technology where he teaches Networking and Security undergraduate classes. JP also performs pen testing and security audits for local companies in Rochester, NY.

== Past Events ==

;February Meeting

Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2010-05-10T07:37:45Z

Sir W: Added May meeting

<hr>

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralph Durkee]

<paypal>Rochester</paypal>
== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Vice President: [mailto:rd@rd1.net Ralph Durkee]
*Treasurer: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Secretary: Appointed by Event Coordinator at each meeting.
*Event Coordinator: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
*Communications and Chapter OWASP Evangelist: [mailto:lou.leone@owasp.org Lou Leone]
*Webmaster: [mailto:duane.peifer@uberguard.com Duane Peifer]
*Mail List Administrator: [mailto:duane.peifer@uberguard.com Duane Peifer]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meeting locations determined on a meeting by meeting basis and announced at least one week prior to the meeting.
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

If you or your organization is interested in donating meeting space please contact one of the local officers listed above. The space should be able to accommodate at least 15 people.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''May Meeting'''

When: May 17th, 6pm

Where: Mykonos at 220 Kenneth Dr, Rochester, NY (entrance from Lehigh Station Rd or W Henrietta Rd), near 390 and Lehigh Station Road

Topic: New Techniques in Application Intrusion Detection

Speaker: Al Huizenga, Director of Product Management, Mykonos Software, Inc.

Abstract: Current solutions for securing legacy Web applications rely on a “lock-it-down” approach, similar to how IT security administrators use firewalls to lock down ports and servers. But applications are complicated, and it’s often impractical to create a rule set that tightly filters every app-level input. New alternative approaches to intrusion detection and response at the application layer are emerging. One key trend is to enhance the application code itself with built-in defensive logic. By instrumenting application code with incident detection triggers and dynamic responses, administrators can prevent application abuse before bad users establish an attack vector. In this presentation, we’ll discuss the merits and challenges of this approach. We’ll focus on specific examples, including the OWASP AppSensor project and the Mykonos Security Appliance.

Speaker Bio: Al Huizenga runs product strategy for Mykonos Software, a startup focused on new ways to secure Web applications from abuse. Al has 11 years experience marketing Web-based products and technologies. He is fascinated by how the same technology attributes that drive Web application adoption – openness, transparency, and ubiquity – also represent severe risk to the businesses that use them.

== Past Events ==

;February Meeting

Ralph Durkee presented a recap of the recent AppSec conference in DC. 
Andrea Cogliati gave a talk on Identity Federation and Claim-based Security.

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
October Hackerfest 2009 Introduction to OWASP Rochester by Ralph Durkee, Lou Leone [[Media:Intro_to_OWASP_Rochester_v9.ppt|PPT]]

September OWASP 2009 Securing Apache Web Servers with Mod Security & CIS Benchmark by Ralph Durkee [[Media:Durkee_Apache_2009_v7.ppt|PPT]] [[Media:Durkee_Apache_2009_v7.odp|Open Office]]

May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Global Conferences Committee - Application 5

2010-01-22T23:09:20Z

Sir W: Added endorsement by Andrea Cogliati

[[How to Join a Committee|Click here to return to 'How to Join a Committee' page]]

----

{| border="0" align="center" style="width: 100%;"
|-
! align="center" colspan="2" style="background: rgb(64, 88, 160) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | '''COMMITTEE APPLICATION FORM'''
|-
| align="center" style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 25%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''Applicant's Name'''
| align="left" colspan="1" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 85%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Ralph Durkee 
|-
| align="center" style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 25%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''Current and past OWASP Roles'''
| align="left" colspan="1" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 85%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Founder and former President Rochester, NY Chapter since 2004, Current VP of Rochester Chapter.  Co-Chair of Rochester Security Summit joint ISSA/OWASP/ISACA Annual Security Conference  www.RochesterSecurity.org 
|-
| align="center" style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 25%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''Committee Applying for'''
| align="left" colspan="1" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 85%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | OWASP Global Conferences Committee.
|}

----

 

----

Please be aware that for an application to be considered by the board, '''you MUST have 5 recommendations'''. An incomplete application will not be considered for vote.

----

 

----

{| border="0" align="center" style="width: 100%;"
|-
! align="center" colspan="8" style="background: rgb(64, 88, 160) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | '''COMMITTEE RECOMMENDATIONS'''
|-
! align="center" style="background: white none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | 
! align="center" style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | '''Who Recommends/Name'''
! align="center" style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | '''Role in OWASP'''
! align="center" style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous; color: white;" | '''Recommendation Content'''
|-
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 3%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''1'''
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Lou Leone 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Communications and Chapter OWASP Evangelist 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 57%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Ralph has been great to work with at our local OWASP chapter.  His passion and enthusiam match the high level of competency he brings to security discussions. 
|-
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 3%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''2'''
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Duane Peifer 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Rochester NY Chapter webmaster and communications 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 57%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Ralph is well known as a leader in the security community here in Rochester. His leadership, knowledge, and experience have been crucial to the success of the local OWASP chapter as well as other local security organizations and events. 
|-
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 3%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''3'''
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Dwayne P. Foley, CISM, CISSP, GIAC (GSEC GCFW) 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 57%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Ralph is one the most active participants in information security that I know. I had the pleasure of participating in class instruction from Ralph in his roll of a SANS instructor. I have worked closely with Ralph as a peer on complex, large enterprise polices and security issues. I have also had the pleasure to participate with Ralph in the local chapters of several national and global security organizations. I am sure there are many that have grown from Ralph’s leadership even more that will benefit with Ralph as a committee member. 
|-
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 3%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''4'''
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Andrea Cogliati 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Rochester NY Chapter President 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 57%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Ralph is a long time information security professional with a deep knowledge of both the technical and the organizational aspects of information security. He has been involved in a variety of different projects and environments, from open-source projects to enterprise application deployment. Ralph founded the Rochester, NY Chapter of OWASP in 2004, and has been part of the Rochester Security Summit board since its first edition in 2006. The Rochester Security Summit has been a growing success in Upstate NY with speakers from all over the country. Ralph's skills and connections in the IT community make him an ideal candidate for the Global Conference Committee. 
|-
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 3%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''5'''
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 20%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 
| align="center" style="background: rgb(204, 204, 204) none repeat scroll 0% 0%; width: 57%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 
|}

----

Rochester

2009-05-28T18:23:21Z

Sir W: June meeting

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralph Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''June meeting details'''

June informal meeting at Mac Gregor's will be held on '''June 22nd''', instead of June 15th.

'''Joint Meeting with LUGOR in September'''

We'll have a joint meeting with [http://www.lugor.org/ Linux User Group of Rochester] on September 17th from 7pm to 9pm on RIT Campus, room #70-1400.

Ralph Durkee will deliver a presentation about Apache Web Server and Web App Firewall w Mod_security.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2009-05-27T15:07:44Z

Sir W: Added LUGOR meeting

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralph Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''Joint Meeting with LUGOR in September'''

We'll have a joint meeting with [http://www.lugor.org/ Linux User Group of Rochester] on September 17th from 7pm to 9pm on RIT Campus, room #70-1400.

Ralph Durkee will deliver a presentation about Apache Web Server and Web App Firewall w Mod_security.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==
May OWASP 2009 Key Management - One Perspective by Lou Leone [[Media:N-tierKeyManagementIssues.ppt|PPT]]

May IEEE 2009 Introduction to OWASP, presented by Ralph Durkee and Andrea Cogliati [[Media:Intro_to_OWASP_Rochester_v5.ppt|PPT]]

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2009-05-05T14:14:24Z

Sir W: /* Meeting Dates & Location */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''May Meeting Details'''

May meeting will be held on '''May 18th, 6pm''' at Bryant & Stratton College.

'''Title:''' Key Management - One Perspective

'''Abstract:''' Encryption is easy. Key management is hard. Really hard. The difficulty arises not from the complexity of keys and encryption schemes, approaches to them, or their applications, but from the impacts of encrypted data to operational systems and procedures. One perspective on key management provides insight into implementing encrypted data storage in a typical n-tiered system and identifying the impacted concerns with appropriate implementation strategies for mitigating them.

'''Presenter:''' Lou Leone

Lou is a Cognitive Science graduate from the University of Rochester. He is founder of Telperion Development Corp. and has provided services for the utility and telecommunications industries and for Rochester’s ever present Kodak and Xerox. He had a brief stint as the VP of Technology for PaeTec Communications, Inc. and is presently the VP of Technology Development for UniteU Technologies Inc. Over years of personally writing vast swaths of absolutely terrible code, he has developed a fine appreciation of the art of software architecture and the beauty of implementation excellence.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2009-05-05T14:08:00Z

Sir W: May meeting details

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''May Meeting Details'''

March meeting will be held on '''March 18th, 6pm''' at Bryant & Stratton College.

'''Title:''' Key Management - One Perspective

'''Abstract:''' Encryption is easy. Key management is hard. Really hard. The difficulty arises not from the complexity of keys and encryption schemes, approaches to them, or their applications, but from the impacts of encrypted data to operational systems and procedures. One perspective on key management provides insight into implementing encrypted data storage in a typical n-tiered system and identifying the impacted concerns with appropriate implementation strategies for mitigating them.

'''Presenter:''' Lou Leone

Lou is a Cognitive Science graduate from the University of Rochester. He is founder of Telperion Development Corp. and has provided services for the utility and telecommunications industries and for Rochester’s ever present Kodak and Xerox. He had a brief stint as the VP of Technology for PaeTec Communications, Inc. and is presently the VP of Technology Development for UniteU Technologies Inc. Over years of personally writing vast swaths of absolutely terrible code, he has developed a fine appreciation of the art of software architecture and the beauty of implementation excellence.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2009-03-29T22:15:11Z

Sir W: Lou's date correction

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''March Meeting Details'''

March meeting will be held on '''March 16th, 6pm''' at Bryant & Stratton College.

'''Title:''' 2008 Web Security Trends

'''Abstract:''' The presentation will open with a brief review of the OWASP Top Ten from
2007, followed by a review and comparison of 2007 and 2008 web security
statistics. After this we'll review some recent high profile web site
incidents and a few of the web site flaws personally discovered by Duane in
2008. We'll discuss how these vulnerabilities are easily exploited and how
they are prevented. The presentation will be concluded by some industry web
security predictions for 2009.

'''Presenter:''' Duane Peifer

Duane is CTO at UberGuard Information Security, LLC, in Avon, NY,
were he provides UberGuard's customers with technical consulting and
web site security assessments and penetration tests. He holds a B.S.
in Computer Science from Rochester Institute of Technology and has 15
years of Systems Engineering and Project Management experience. Duane
is also the co-owner of UberScan, LLC, a startup software development
company.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

January 2009 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2009-03-23T18:40:44Z

Sir W: Added January presentation

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''March Meeting Details'''

March meeting will be held on '''March 16th, 6pm''' at Bryant & Stratton College.

'''Title:''' 2008 Web Security Trends

'''Abstract:''' The presentation will open with a brief review of the OWASP Top Ten from
2007, followed by a review and comparison of 2007 and 2008 web security
statistics. After this we'll review some recent high profile web site
incidents and a few of the web site flaws personally discovered by Duane in
2008. We'll discuss how these vulnerabilities are easily exploited and how
they are prevented. The presentation will be concluded by some industry web
security predictions for 2009.

'''Presenter:''' Duane Peifer

Duane is CTO at UberGuard Information Security, LLC, in Avon, NY,
were he provides UberGuard's customers with technical consulting and
web site security assessments and penetration tests. He holds a B.S.
in Computer Science from Rochester Institute of Technology and has 15
years of Systems Engineering and Project Management experience. Duane
is also the co-owner of UberScan, LLC, a startup software development
company.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

January 2008 Paranoid Programming Practices, by Lou Leone and Aaron Witt [[Media:ParanoidProgrammers.ppt|PPT]]

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

File:ParanoidProgrammers.ppt

2009-03-23T18:36:58Z

Sir W:

Rochester

2009-03-09T17:47:45Z

Sir W: Correcting spell

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''March Meeting Details'''

March meeting will be held on '''March 16th, 6pm''' at Bryant & Stratton College.

'''Title:''' 2008 Web Security Trends

'''Abstract:''' The presentation will open with a brief review of the OWASP Top Ten from
2007, followed by a review and comparison of 2007 and 2008 web security
statistics. After this we'll review some recent high profile web site
incidents and a few of the web site flaws personally discovered by Duane in
2008. We'll discuss how these vulnerabilities are easily exploited and how
they are prevented. The presentation will be concluded by some industry web
security predictions for 2009.

'''Presenter:''' Duane Peifer

Duane is CTO at UberGuard Information Security, LLC, in Avon, NY,
were he provides UberGuard's customers with technical consulting and
web site security assessments and penetration tests. He holds a B.S.
in Computer Science from Rochester Institute of Technology and has 15
years of Systems Engineering and Project Management experience. Duane
is also the co-owner of UberScan, LLC, a startup software development
company.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2009-03-09T17:45:12Z

Sir W: Added March meeting

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''March Meeting Details'''

March meeting will be help on '''March 16th, 6pm''' at Bryant & Stratton College.

'''Title:''' 2008 Web Security Trends

'''Abstract:''' The presentation will open with a brief review of the OWASP Top Ten from
2007, followed by a review and comparison of 2007 and 2008 web security
statistics. After this we'll review some recent high profile web site
incidents and a few of the web site flaws personally discovered by Duane in
2008. We'll discuss how these vulnerabilities are easily exploited and how
they are prevented. The presentation will be concluded by some industry web
security predictions for 2009.

'''Presenter:''' Duane Peifer

Duane is CTO at UberGuard Information Security, LLC, in Avon, NY,
were he provides UberGuard's customers with technical consulting and
web site security assessments and penetration tests. He holds a B.S.
in Computer Science from Rochester Institute of Technology and has 15
years of Systems Engineering and Project Management experience. Duane
is also the co-owner of UberScan, LLC, a startup software development
company.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Category:OWASP Presentations

2009-01-15T16:57:19Z

Sir W: Added Apple Keynote template

== Welcome to the OWASP Presentations Program ==

In an effort to promote more in-depth work in application security, the OWASP Presentations program is now accepting presentation submissions. Presentations submitted to the OWASP Presentations program will be reviewed by a team of senior application security experts. These reviewers will provide constructive feedback on submissions in the hopes of achieving a publishable quality paper. Papers that are approved by the review team will be published on the OWASP website and will be candidates for presentation at the next OWASP AppSec conference.

== Submitting a Presentation ==

To submit a presentation, please use the following [[Media:Presentation_template.ppt | template for Microsoft Powerpoint]] presentations. All submissions should be sent to [mailto:owasp@owasp.org owasp@owasp.org]. By submitting a presentation, you agree to having OWASP publish the presentation on the OWASP website.

= OWASP Education Presentation Guidelines =
Some guidelines:
* Use the OWASP Education Project [[:Image:Education_Project_Template.zip|Template powerpoint]]
* Provide a summary next to the slides
* Add a descriptive summary and expectations on knowledge
* Only include necessary data
* Slide contents should be self evident
* One slide should cover only one specific topic, avoid overly dense slides
* Max seven words per line, seven lines per slide
* Present information graphically: an image can say more than thousand words
* Don't use all capital letters
* limit your presentation to less than 50 slides - better less than 30 slides (a good presentation will be max. 90 minutes and typical time per slide is 2 minutes). If you need more, split the presentation in parts.
* Support each slide with notes (the part below the slide in PowerPoint). These notes should provide the presenter with enough material (including references) to prepare the presentation without much extra research.
...

This way presentations can be reused by the [[Education]] Project.

= Papers =



; [http://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt Advanced SQL Injection] (Victor Chapela)
: Detailed methodology for analyzing applications for SQL injection vulnerabilities.

; [http://link Title] (Author)
: Brief description

== Keynote Template ==

If you want to create a presentation with Apple Keynote using the OWASP design, you can use the [[Media:OWASP_Keynote_Template.zip|Keynote '08 template]].

File:OWASP Keynote Template.zip

2009-01-15T16:52:41Z

Sir W: OWASP Presentation template for Apple Keynote '08

OWASP Presentation template for Apple Keynote '08

Rochester

2009-01-12T16:42:30Z

Sir W: Added Aaron Witt to January meeting's speakers

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''January Meeting Details'''

January meeting has been postponed to '''January 26th, 6pm''' at Bryant & Stratton College.

'''Title:''' Paranoid Programming Practices

"It’s not a matter of whether you’re paranoid or not. It’s a matter of whether you’re paranoid enough."
- Unknown. (He wouldn’t give me his name…)

'''Abstract:''' This presentation provides an overview of Policy Frameworks and their importance to formalizing secure programming practices within a software development organization. It also covers the primary elements of Secure Programming Practices including discussions on attackers, tenants, architectures, and principles. This presentation is focused towards OWASP and Payment Card Industries’ Data Security Specification (PCI DSS) audiences and concludes with a review of the “Top 10” vulnerabilities along OWASP classifications.

'''Presenters:''' Lou Leone and Aaron Witt

Lou Leone is a Cognitive Science graduate from the University of Rochester. He is founder of Telperion Development Corp. and has provided services for the utility and telecommunications industries and for Rochester’s ever present Kodak and Xerox. He had a brief stint as the VP of Technology for PaeTec Communications, Inc. and is presently the VP of Technology Development for UniteU Technologies Inc. Over years of personally writing vast swaths of absolutely terrible code, he has developed a fine appreciation of the art of software architecture and the beauty of implementation excellence.

Aaron Witt graduated from the University of Illinois with a degree in Computer Science. He worked at Xerox for 11 years as a software engineer and architect and is currently employed at UniteU Technologies Inc. His interests include creating secure, identity-aware applications, workflow-based systems, and design patterns. When not fixing Lou’s terrible code, he also enjoys woodworking and herding cats.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2009-01-09T16:10:06Z

Sir W: January meeting

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''January Meeting Details'''

January meeting has been postponed to '''January 26th, 6pm''' at Bryant & Stratton College.

'''Title:''' Paranoid Programming Practices

"It’s not a matter of whether you’re paranoid or not. It’s a matter of whether you’re paranoid enough."
- Unknown. (He wouldn’t give me his name…)

'''Abstract:''' This presentation provides an overview of Policy Frameworks and their importance to formalizing secure programming practices within a software development organization. It also covers the primary elements of Secure Programming Practices including discussions on attackers, tenants, architectures, and principles. This presentation is focused towards OWASP and Payment Card Industries’ Data Security Specification (PCI DSS) audiences and concludes with a review of the “Top 10” vulnerabilities along OWASP classifications.

'''Presenter:''' Lou Leone

Lou Leone is a Cognitive Science graduate from the University of Rochester. He is founder of Telperion Development Corp. and has provided services for the utility and telecommunications industries and for Rochester’s ever present Kodak and Xerox. He had a brief stint as the VP of Technology for PaeTec Communications, Inc. and is presently the VP of Technology Development for UniteU Technologies Inc. Over years of personally writing vast swaths of absolutely terrible code, he has developed a fine appreciation of the art of software architecture and the beauty of implementation excellence.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2008-11-28T21:26:43Z

Sir W: November meeting

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''November Meeting Details'''

November meeting has been postponed to December 1st, 6pm at Bryant & Stratton College. We'll have a brief discussion around the news from the OWASP Worldwide Summit and a video from OWASP NYC AppSec conference: "Web Intrusion Detection with ModSecurity" by Ivan Ristic.

'''FREE PIZZA, courtesy of Durkee Consulting, Inc.'''

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2008-11-14T13:45:39Z

Sir W: Changed Future Events to Past Events

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''November Meeting Details'''

November meeting has been postponed to December 1st, 6pm at Bryant & Stratton College.

== Past Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2008-11-14T13:45:16Z

Sir W: November meeting

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''November Meeting Details'''

November meeting has been postponed to December 1st, 6pm at Bryant & Stratton College.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

OWASP on the Move

2008-11-03T17:43:39Z

Sir W: Added Rochester Security Summit

This program allows local chapters or application security conferences to have OWASP presenters on site.

This program allows 3 parties to find each other:

* Local chapters or application security events that want to attract an OWASP speaker
* OWASP speakers to entertain OWASP presentations and that want to see the world
* OWASP sponsors that want to support spreading the OWASP message

Owasp on the Move (OotM) is an OWASP project. Visit the project [[:Category:OWASP_on_the_Move_Project|page]] to see what the future holds for OotM.

==Application Process ==
The way it works is really easy.

* Upfront the event organizer sends the OotM request (event details, who to cover, etc...) to [[Contact|Kate]]
* If within the rules (see below) it will be rapidly approved by Kate
* The event organizer updates the OotM section below to track the application
* After the event is performed the speaker, who made the travel/lodging expenses, e-mails a scan of the receipts to Kate
* Kate re-imburses up to the approved budget and informs the event organizer
* The event organizer updates the OotM section below
That's it!

==OWASP On the Move Rules:==

The following rules apply for the OotM project:

*The normal maximum amount per speaker is 500 USD
*Only in special circumstances the maximum amount per speaker can be raised to a maximum of $1000 USD
*There is a proposed limit of 2,000 USD on the amount of $ provided to any individual per year (*see 'further funding' below)
*There is a proposed limit of 1,000 USD on the amount of $ provided to any event per year(*see 'further funding' below)
*There is a proposed limit of 2,000 USD on the amount of $ provided to any chapter per year(*see 'further funding' below)
*The program will run for 1 year or 30,000 USD (whichever comes first) and then will be reviewed for the value and ROI for OWASP and its community;

So, a chapter can use the sponsorship 4 times a year, with the max of 2 speakers sponsored by OotM for one single event.

*Further funding: for active chapters or speakers who have reach the proposed financial limits, further funding is possible but will depend on available budget, since priority would be given to chapters below these thresholds

== Current demand ==
Add your demand here:

== Current offerings ==
If you want to (re)do an OWASP related presentation, propose them here with your availability boundaries (timing/geographical)
* Marc Curphey will happily speak about the WebAppSec industry, SDLC etc. around Europe. You can see him in action at [http://video.hitb.org/2006.html HITB with John Viega] (big download)
* [mailto:thesp0nge@owasp.org Paolo Perego] is available to talk about [http://www.owasp.org/index.php/Category:OWASP_Orizon_Project Orizon project], safe coding and code review issues around Europe in the near October-December.
* [mailto:marc.m.morana@gmail.org Marco Morana] is available to talk about [http://iac.dtic.mil/iatac/download/security.pdf Software Security Frameworks]and Secure Code Reviews [https://www.cmpevents.com/CSI33/a.asp?option=G&V=3&id=443342 see 07 CSI conference as reference] in USA around November-December and in Europe around January-February.
* [mailto:sebastien.gioria@owasp.fr Sébastien Gioria] is available to talk about WebAppSec, educational purpose on AppSec in French or at least in english around France/Europe/Canada from middle of March 08. You can find some Talk on the [http://www.owasp.fr Owasp France Chapter]
* you?

== Upcoming OWASP on the Move Events ==

== Past OWASP on the Move Events ==

* 30th Oct 2008: [[Rochester]] Marco Morana presented at [http://rochestersecurity.org Rochester Security Summit 2008] about Risk Management in the SDLC.
* 8th Sep 2007: [[Belgium]] Mark Curphey, pdp (Architect), Simon Roses Femerling and David Kierznowski presented as part of the OWASP Day worldwide conference.
* 14th July 2007: [[Turkey]] Dinis joined the first Turkey Mini-Conference
* 22nd June 2007: [[Belgium]] Ivan Ristic and Dinis Cruz came to the chapter meeting (sponsored by F5 Networks locally).

== Sponsors ==
Currently the OotM is sponsored by banners on the OWASP home page.

We are looking for sponsors that specifically want to sponsor the OotM project.

Past local sponsors were:
* F5 Networks in [[Belgium]]

OWASP on the Move

2008-11-03T17:26:09Z

Sir W: Removed Rochester Security Summit

This program allows local chapters or application security conferences to have OWASP presenters on site.

This program allows 3 parties to find each other:

* Local chapters or application security events that want to attract an OWASP speaker
* OWASP speakers to entertain OWASP presentations and that want to see the world
* OWASP sponsors that want to support spreading the OWASP message

Owasp on the Move (OotM) is an OWASP project. Visit the project [[:Category:OWASP_on_the_Move_Project|page]] to see what the future holds for OotM.

==Application Process ==
The way it works is really easy.

* Upfront the event organizer sends the OotM request (event details, who to cover, etc...) to [[Contact|Kate]]
* If within the rules (see below) it will be rapidly approved by Kate
* The event organizer updates the OotM section below to track the application
* After the event is performed the speaker, who made the travel/lodging expenses, e-mails a scan of the receipts to Kate
* Kate re-imburses up to the approved budget and informs the event organizer
* The event organizer updates the OotM section below
That's it!

==OWASP On the Move Rules:==

The following rules apply for the OotM project:

*The normal maximum amount per speaker is 500 USD
*Only in special circumstances the maximum amount per speaker can be raised to a maximum of $1000 USD
*There is a proposed limit of 2,000 USD on the amount of $ provided to any individual per year (*see 'further funding' below)
*There is a proposed limit of 1,000 USD on the amount of $ provided to any event per year(*see 'further funding' below)
*There is a proposed limit of 2,000 USD on the amount of $ provided to any chapter per year(*see 'further funding' below)
*The program will run for 1 year or 30,000 USD (whichever comes first) and then will be reviewed for the value and ROI for OWASP and its community;

So, a chapter can use the sponsorship 4 times a year, with the max of 2 speakers sponsored by OotM for one single event.

*Further funding: for active chapters or speakers who have reach the proposed financial limits, further funding is possible but will depend on available budget, since priority would be given to chapters below these thresholds

== Current demand ==
Add your demand here:

== Current offerings ==
If you want to (re)do an OWASP related presentation, propose them here with your availability boundaries (timing/geographical)
* Marc Curphey will happily speak about the WebAppSec industry, SDLC etc. around Europe. You can see him in action at [http://video.hitb.org/2006.html HITB with John Viega] (big download)
* [mailto:thesp0nge@owasp.org Paolo Perego] is available to talk about [http://www.owasp.org/index.php/Category:OWASP_Orizon_Project Orizon project], safe coding and code review issues around Europe in the near October-December.
* [mailto:marc.m.morana@gmail.org Marco Morana] is available to talk about [http://iac.dtic.mil/iatac/download/security.pdf Software Security Frameworks]and Secure Code Reviews [https://www.cmpevents.com/CSI33/a.asp?option=G&V=3&id=443342 see 07 CSI conference as reference] in USA around November-December and in Europe around January-February.
* [mailto:sebastien.gioria@owasp.fr Sébastien Gioria] is available to talk about WebAppSec, educational purpose on AppSec in French or at least in english around France/Europe/Canada from middle of March 08. You can find some Talk on the [http://www.owasp.fr Owasp France Chapter]
* you?

== Upcoming OWASP on the Move Events ==

== Past OWASP on the Move Events ==

* 8th Sep 2007: [[Belgium]] Mark Curphey, pdp (Architect), Simon Roses Femerling and David Kierznowski presented as part of the OWASP Day worldwide conference.
* 14th July 2007: [[Turkey]] Dinis joined the first Turkey Mini-Conference
* 22nd June 2007: [[Belgium]] Ivan Ristic and Dinis Cruz came to the chapter meeting (sponsored by F5 Networks locally).

== Sponsors ==
Currently the OotM is sponsored by banners on the OWASP home page.

We are looking for sponsors that specifically want to sponsor the OotM project.

Past local sponsors were:
* F5 Networks in [[Belgium]]

OWASP on the Move

2008-11-03T17:25:32Z

Sir W: Removed Rochester Security Summit

This program allows local chapters or application security conferences to have OWASP presenters on site.

This program allows 3 parties to find each other:

* Local chapters or application security events that want to attract an OWASP speaker
* OWASP speakers to entertain OWASP presentations and that want to see the world
* OWASP sponsors that want to support spreading the OWASP message

Owasp on the Move (OotM) is an OWASP project. Visit the project [[:Category:OWASP_on_the_Move_Project|page]] to see what the future holds for OotM.

==Application Process ==
The way it works is really easy.

* Upfront the event organizer sends the OotM request (event details, who to cover, etc...) to [[Contact|Kate]]
* If within the rules (see below) it will be rapidly approved by Kate
* The event organizer updates the OotM section below to track the application
* After the event is performed the speaker, who made the travel/lodging expenses, e-mails a scan of the receipts to Kate
* Kate re-imburses up to the approved budget and informs the event organizer
* The event organizer updates the OotM section below
That's it!

==OWASP On the Move Rules:==

The following rules apply for the OotM project:

*The normal maximum amount per speaker is 500 USD
*Only in special circumstances the maximum amount per speaker can be raised to a maximum of $1000 USD
*There is a proposed limit of 2,000 USD on the amount of $ provided to any individual per year (*see 'further funding' below)
*There is a proposed limit of 1,000 USD on the amount of $ provided to any event per year(*see 'further funding' below)
*There is a proposed limit of 2,000 USD on the amount of $ provided to any chapter per year(*see 'further funding' below)
*The program will run for 1 year or 30,000 USD (whichever comes first) and then will be reviewed for the value and ROI for OWASP and its community;

So, a chapter can use the sponsorship 4 times a year, with the max of 2 speakers sponsored by OotM for one single event.

*Further funding: for active chapters or speakers who have reach the proposed financial limits, further funding is possible but will depend on available budget, since priority would be given to chapters below these thresholds

== Current demand ==
Add your demand here:

== Current offerings ==
If you want to (re)do an OWASP related presentation, propose them here with your availability boundaries (timing/geographical)
* Marc Curphey will happily speak about the WebAppSec industry, SDLC etc. around Europe. You can see him in action at [http://video.hitb.org/2006.html HITB with John Viega] (big download)
* [mailto:thesp0nge@owasp.org Paolo Perego] is available to talk about [http://www.owasp.org/index.php/Category:OWASP_Orizon_Project Orizon project], safe coding and code review issues around Europe in the near October-December.
* [mailto:marc.m.morana@gmail.org Marco Morana] is available to talk about [http://iac.dtic.mil/iatac/download/security.pdf Software Security Frameworks]and Secure Code Reviews [https://www.cmpevents.com/CSI33/a.asp?option=G&V=3&id=443342 see 07 CSI conference as reference] in USA around November-December and in Europe around January-February.
* [mailto:sebastien.gioria@owasp.fr Sébastien Gioria] is available to talk about WebAppSec, educational purpose on AppSec in French or at least in english around France/Europe/Canada from middle of March 08. You can find some Talk on the [http://www.owasp.fr Owasp France Chapter]
* you?

== Upcoming OWASP on the Move Events ==

* October 30, 2008 - [[Rochester]] Marco Morana will speak at [http://rochestersecurity.org Rochester Security Summit] about Software Security Framework

== Past OWASP on the Move Events ==

* 8th Sep 2007: [[Belgium]] Mark Curphey, pdp (Architect), Simon Roses Femerling and David Kierznowski presented as part of the OWASP Day worldwide conference.
* 14th July 2007: [[Turkey]] Dinis joined the first Turkey Mini-Conference
* 22nd June 2007: [[Belgium]] Ivan Ristic and Dinis Cruz came to the chapter meeting (sponsored by F5 Networks locally).

== Sponsors ==
Currently the OotM is sponsored by banners on the OWASP home page.

We are looking for sponsors that specifically want to sponsor the OotM project.

Past local sponsors were:
* F5 Networks in [[Belgium]]

Rochester

2008-10-27T21:00:09Z

Sir W: /* Local Officers */

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

<paypal>Rochester</paypal>

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andrea.cogliati@owasp.org Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''September Meeting Details'''

September meeting will be held on '''Monday September 22nd, 6pm at Bryant & Stratton College''' and will feature a videoconference with '''Jeff Williams''', world famous webappsec guru, on verb tampering, EASPI library and the future of OWASP. '''You can't miss this one!'''

'''Presenter:''' Jeff Williams

'''Topic:''' Verb tampering and ESAPI

'''Bio:''' Jeff Williams is one of the major contributors in webappsec community. He has written many whitepapers, spoken at many conferences including Secure Software Summit, OWASP conferences, ISSA InfoSec Conference, NSA High Confidence Software and Systems Conference (HCSS), JavaOne, National Computer Security Conference (NCSC), etc, worked on several projects and written many tools available at OWASP (including creating the OWASP Top 10, WebGoat, Stinger, Secure Software Contract Annex, Honeycomb Project and the Enterprise Security API). Jeff has done a lot of work in promoting awareness of web application security. He's CEO of Aspect Security and also volunteers as chairs of OWASP Foundation. You can find more about him on [http://myappsecurity.blogspot.com/2007/03/reflection-on-jeff-williams.html his blog].

'''Abstract:''' The ESAPI is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway. Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.
The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Working Session OWASP Strategic Planning

2008-10-21T18:07:10Z

Sir W: /* Working Session Participants */

{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#b3b3b3; color:white"|'''Working Sessions Operational Rules''' - [[:Working Sessions Methodology|'''Please see here the general frame of rules''']].
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION IDENTIFICATION'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Work Session Name'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|'''OWASP Strategic Planning'''
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Short Work Session Description'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|Discuss and prepare the OWASP Strategic Planing.
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Related Projects (if any)'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
| style="width:25%; background:#cccccc" align="center"|'''Chair''' [mailto:jeff.williams(at)owasp.org Jeff Williams], [mailto:dinis.cruz(at)owasp.org Dinis Cruz], [mailto:dave.wichers(at)owasp.org Dave Wichers], [mailto:seba@owasp.org Sebastien Deleersnyder], [mailto:tomb(at)owasp.org Tom Brennan].
| style="width:25%; background:#cccccc" align="center"|'''Secretary''' TBD
| style="width:25%; background:#cccccc" align="center"|'''Mailing list''' [https://lists.owasp.org/mailman/admin/ws-strategic-planning/logout Subscription Page]
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION SPECIFICS'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Objectives'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|
* Discuss OWASP Past, Present and Future,
* Projects organization and rating,
* Global Community Outreach (PR Issues, Pro Bono opportunities)
* Procedures for OWASP Standardization,
* Discuss OWASP Governance,
* Discuss Chapter Governance.
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Venue/Date&Time/Model'''
| style="width:25%; background:#cccccc" align="center"|'''Venue''' [[:OWASP EU Summit 2008|OWASP EU Summit Portugal 2008]]
| style="width:25%; background:#cccccc" align="center"|'''Date&Time''' November 4 & 7, 2008 Time TBD
| style="width:25%; background:#cccccc" align="center"|'''Discussion Model''' "Participants + Attendees" or "Everybody is a Participant" - TBD
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:white; color:white"|
|}

{|style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION OPERATIONAL RESOURCES'''
|-
| style="width:100%; background:#cccccc" align="center"|Please add here, ASAP, any needed relevant resources, e.g. data-show, boards, laptops, etc.
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:white; color:white"|
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION ADDITIONAL DETAILS'''
|-
| style="width:100%; background:#cccccc" align="center"|Please add here, any additional notes, links, ideas, guidelines, etc... The objective is to help the working sessions participants and attendees to prepare their participation/contribution
|}
{| style="width:100%" border="0" align="center"
! colspan="3" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION OUTCOMES'''
|-
| style="width:7%; background:#6C82B5" align="center"|Statements, Initiatives or Decisions
| style="width:46%; background:#b3b3b3" align="center"|'''Proposed by Working Group'''
| style="width:47%; background:#b3b3b3" align="center"|'''Approved by OWASP Board'''
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Action Plan for 2009.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Strategies and recommendations for current OWASP projects.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Fill in here.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|}
== Working Session Participants ==
(Add you name by editing this table. On your the right, just above the this frame, you have the option to edit)
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION PARTICIPANTS'''
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:18%; background:#cccccc" align="center"|'''Name'''
| style="width:15%; background:#cccccc" align="center"|'''Company'''
| style="width:60%; background:#cccccc" align="center"|'''Notes & reason for participating, issues to be discussed/addressed'''
|-
| style="width:7%; background:#7B8ABD" align="center"|1
| style="width:18%; background:#cccccc" align="center"|Kate & Paulo
| style="width:15%; background:#cccccc" align="center"|OWASP Foundation
| style="width:60%; background:#cccccc" align="center"|Employees
|-
| style="width:7%; background:#7B8ABD" align="center"|2
| style="width:18%; background:#cccccc" align="center"|David Campbell
| style="width:15%; background:#cccccc" align="center"|OWASP Denver
| style="width:60%; background:#cccccc" align="center"|Chapter governance, etc
|-
| style="width:7%; background:#7B8ABD" align="center"|3
| style="width:18%; background:#cccccc" align="center"|Matteo Meucci
| style="width:15%; background:#cccccc" align="center"|OWASP-Italy
| style="width:15%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|4
| style="width:18%; background:#cccccc" align="center"|Steve Antoniewicz
| style="width:15%; background:#cccccc" align="center"|OWASP NYC
| style="width:60%; background:#cccccc" align="center"|Partnerships
|-
| style="width:7%; background:#7B8ABD" align="center"|5
| style="width:18%; background:#cccccc" align="center"|Andrea Cogliati
| style="width:15%; background:#cccccc" align="center"|OWASP Rochester, NY
| style="width:60%; background:#cccccc" align="center"|Interested in reaching out academia
|-
| style="width:7%; background:#7B8ABD" align="center"|6
| style="width:18%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:60%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|7
| style="width:18%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:60%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|8
| style="width:18%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:60%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|9
| style="width:18%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:60%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|10
| style="width:18%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:60%; background:#cccccc" align="center"|
|}
If needed add here more lines.

[[Category:OWASP_Working_Session]]

OWASP Working Session Enterprise Security API Project

2008-10-21T18:04:58Z

Sir W: /* Working Session Participants */

{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#b3b3b3; color:white"|'''Working Sessions Operational Rules''' - [[:Working Sessions Methodology|'''Please see here the general frame of rules''']].
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION IDENTIFICATION'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Work Session Name'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|'''OWASP Enterprise Security API Project '''
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Short Work Session Description'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|In this working session we will consider all aspects of the Enterprise Security API project. The goal of the project is to simplify security for developers to make secure code more likely. To achieve this goal we define clean intuitive APIs for standard security functionality. Ideally, these APIs will cover common security controls across web applications, web services, and even rich client applications. This working session will review the state of the project, discuss technical issues, discuss "marketing" of the project, prioritize project work items, and browbeat attendees into joining the project and making the world a safer place.
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Related Projects (if any)'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|
[[:Category:OWASP Enterprise Security API|OWASP Enterprise Security API (ESAPI) Project]]
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
| style="width:25%; background:#cccccc" align="center"|'''Chair''' [mailto:jeff.williams(at)owasp.org '''Jeff Williams''']
| style="width:25%; background:#cccccc" align="center"|'''Secretary''' [mailto:arshan.dabirsiaghi(at)aspectsecurity.com '''Arshan Dabirsiaghi''']
| style="width:25%; background:#cccccc" align="center"|'''Mailing list''' [https://lists.owasp.org/mailman/listinfo/owasp-esapi '''Subscription Page''']
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION SPECIFICS'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Objectives'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|
Introduce everyone to the idea and cost-benefits of an ESAPI.
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Venue/Date&Time/Model'''
| style="width:25%; background:#cccccc" align="center"|'''Venue''' [[:OWASP EU Summit 2008|OWASP EU Summit Portugal 2008]]
| style="width:25%; background:#cccccc" align="center"|'''Date&Time''' November 5, 2008 1:00 PM
| style="width:25%; background:#cccccc" align="center"|'''Discussion Model''' "Participants + Attendees"
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:white; color:white"|
|}

{|style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION OPERATIONAL RESOURCES'''
|-
| style="width:100%; background:#cccccc" align="center"|Please add here, ASAP, any needed relevant resources, e.g. data-show, boards, laptops, etc.
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:white; color:white"|
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION ADDITIONAL DETAILS'''
|-
| style="width:100%; background:#cccccc" align="left"|Please add here, any additional notes, links, ideas, guidelines, etc... The objective is to help the working sessions participants and attendees to prepare their participation/contribution.
|}
{| style="width:100%" border="0" align="center"
! colspan="3" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION OUTCOMES'''
|-
| style="width:7%; background:#6C82B5" align="center"|Statements, Initiatives or Decisions
| style="width:46%; background:#b3b3b3" align="center"|'''Proposed by Working Group'''
| style="width:47%; background:#b3b3b3" align="center"|'''Approved by OWASP Board'''
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|A volunteer to lead the 'marketing' campaign for ESAPI.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Prioritized list of marketing ideas for the ESAPI concept.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Prioritized list of ideas for improving the API.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Fill in here.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|}
== Working Session Participants ==
(Add you name by editing this table. On your the right, just above the this frame, you have the option to edit)
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION PARTICIPANTS'''
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:15%; background:#cccccc" align="center"|'''Name'''
| style="width:15%; background:#cccccc" align="center"|'''Company'''
| style="width:63%; background:#cccccc" align="center"|'''Notes & reason for participating, issues to be discussed/addressed'''
|-
| style="width:7%; background:#7B8ABD" align="center"|1
| style="width:15%; background:#cccccc" align="center"|Matt Tesauro
| style="width:15%; background:#cccccc" align="center"|OWASP Live CD Project Lead
| style="width:63%; background:#cccccc" align="center"|Curious about how various "ports" should be handled (lang != Java) Run them as separate projects or sub-projects. How are they synchronized, if at all? What state are they in? How bad will the browbeating be?
|-
| style="width:7%; background:#7B8ABD" align="center"|2
| style="width:15%; background:#cccccc" align="center"|Andrea Cogliati
| style="width:15%; background:#cccccc" align="center"|OWASP Rochester, NY
| style="width:63%; background:#cccccc" align="center"|Interested in porting to other platforms (Ruby&Rails) and in integration issues with existing framework (Struts, Spring, ...)
|-
| style="width:7%; background:#7B8ABD" align="center"|3
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|4
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|5
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|6
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|7
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|8
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|9
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|10
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|}
If needed add here more lines.

[[Category:OWASP_Working_Session]]

OWASP Working Session Top 10 2009

2008-10-21T18:03:48Z

Sir W: /* Working Session Participants */

{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#b3b3b3; color:white"|'''Working Sessions Operational Rules''' - [[:Working Sessions Methodology|'''Please see here the general frame of rules''']].
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION IDENTIFICATION'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Work Session Name'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|'''OWASP Top 10 2009'''
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Short Work Session Description'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|Aims to provide a key awareness document for web application security.
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Related Projects (if any)'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|[[:Category:OWASP Top Ten Project|OWASP Top Ten Project]]
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
| style="width:25%; background:#cccccc" align="center"|'''Chair''' [mailto:dave.wichers(at)owasp.org '''Dave Wichers''']
| style="width:25%; background:#cccccc" align="center"|'''Secretary''' [mailto:jeff.williams(at)owasp.org '''Jeff Williams''']
| style="width:25%; background:#cccccc" align="center"|'''Mailing list''' [https://lists.owasp.org/mailman/listinfo/owasp-topten '''Subscription Page''']
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION SPECIFICS'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Objectives'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|
* Discuss current Top10 structure and objectives,
* Identify which information sources will be considered for analysis, Eg:
** MITRE
** Compromise DB's (Attrition, WASC etc) and bias due to reporting
** Anonomised penetration test results and the difficulty in obtaining
* Define methodology to collect attacks statistics,
* Define prioritisation approach
** Agree weighting between current or emerging threats
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Venue/Date&Time/Model'''
| style="width:25%; background:#cccccc" align="center"|'''Venue''' [[:OWASP EU Summit 2008|OWASP EU Summit Portugal 2008]]
| style="width:25%; background:#cccccc" align="center"|'''Date&Time''' November 5 & 7, 2008 Time TBD
| style="width:25%; background:#cccccc" align="center"|'''Discussion Model''' "Participants + Attendees"
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:white; color:white"|
|}

{|style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION OPERATIONAL RESOURCES'''
|-
| style="width:100%; background:#cccccc" align="center"|Please add here, ASAP, any needed relevant resources, e.g. data-show, boards, laptops, etc.
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:white; color:white"|
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION ADDITIONAL DETAILS'''
|-
| style="width:100%; background:#cccccc" align="left"|Please add here, any additional notes, links, ideas, guidelines, etc... The objective is to help the working sessions participants and attendees to prepare their participation/contribution.

Potential Resources:

* [http://cve.mitre.org/cve/ MITRE's Common Vulnerability Enumeration (CVE) Database]

* The [http://www.webappsec.org/projects/whid/whid.shtml WASC Web Hacking Incidents Database]

* The [http://www.webappsec.org/projects/statistics/ 2007 WASC Web Application Security Statistics Report]
|}
{| style="width:100%" border="0" align="center"
! colspan="3" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION OUTCOMES'''
|-
| style="width:7%; background:#6C82B5" align="center"|Statements, Initiatives or Decisions
| style="width:46%; background:#b3b3b3" align="center"|'''Proposed by Working Group'''
| style="width:47%; background:#b3b3b3" align="center"|'''Approved by OWASP Board'''
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|The sources of input for the 2009 Top 10 will be identified.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|The ordering scheme for the Top 10 will be determined.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Discussion of whether the existing document structure should be maintained or adjusted.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|}
== Working Session Participants ==
(Add your name by editing this table. On the right, just above this frame, you have the option to edit)
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION PARTICIPANTS'''
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:15%; background:#cccccc" align="center"|'''Name'''
| style="width:15%; background:#cccccc" align="center"|'''Company'''
| style="width:63%; background:#cccccc" align="center"|'''Notes & reason for participating, issues to be discussed/addressed'''
|-
| style="width:7%; background:#7B8ABD" align="center"|1
| style="width:15%; background:#cccccc" align="center"|Paolo Perego
| style="width:15%; background:#cccccc" align="center"|Spike Reply
| style="width:63%; background:#cccccc" align="center"|As penetration tester it woud be great to me to participating in writing the new Top 10. As code reviewer and Orizon project leader it would be very interesting in scouting dynamic threats in order to add some dynamic feature to my tool.
|-
| style="width:7%; background:#7B8ABD" align="center"|2
| style="width:15%; background:#cccccc" align="center"|David Campbell
| style="width:15%; background:#cccccc" align="center"|OWASP Denver
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|3
| style="width:15%; background:#cccccc" align="center"|Robert Mann
| style="width:15%; background:#cccccc" align="center"|RBS / ABN AMRO
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|4
| style="width:15%; background:#cccccc" align="center"|Troy Leach
| style="width:15%; background:#cccccc" align="center"|[https://www.pcisecuritystandards.org/ PCI Security Standards Council]
| style="width:63%; background:#cccccc" align="center"|Technical Director
|-
| style="width:7%; background:#7B8ABD" align="center"|5
| style="width:15%; background:#cccccc" align="center"|Eoin Keary
| style="width:15%; background:#cccccc" align="center"|Ernst & Young. Long time OWASP member (Code and Testing guides)
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|6
| style="width:15%; background:#cccccc" align="center"| Matteo Meucci
| style="width:15%; background:#cccccc" align="center"| Minded Security
| style="width:63%; background:#cccccc" align="center"| I'd like to discuss about a new way to create the Top10 from the OWASP Community
|-
| style="width:7%; background:#7B8ABD" align="center"|7
| style="width:15%; background:#cccccc" align="center"|Giorgio Fedon
| style="width:15%; background:#cccccc" align="center"|Minded Security
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|8
| style="width:15%; background:#cccccc" align="center"|Andrea Cogliati
| style="width:15%; background:#cccccc" align="center"|OWASP Rochester, NY
| style="width:63%; background:#cccccc" align="center"|I volunteered as a technical writer
|-
| style="width:7%; background:#7B8ABD" align="center"|9
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|10
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|}
If needed add here more lines.

[[Category:OWASP_Working_Session]]

OWASP Working Session - PASSWD Metrics and Vulnerabilities

2008-10-21T18:02:33Z

Sir W: /* Working Session Participants */

{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#b3b3b3; color:white"|'''Working Sessions Operational Rules''' - [[:Working Sessions Methodology|'''Please see here the general frame of rules''']].
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION IDENTIFICATION'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Work Session Name'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|'''PASSWD Metrics and Vulnerabilities'''
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Short Work Session Description'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|how to create a model that will help in predicting and monitoring the security of an application.
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Related Projects (if any)'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|
[[:OWASP Top Ten Project]]
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
| style="width:25%; background:#cccccc" align="center"|'''Chair''' [mailto:Lucilla.Mancini(at)business-e.it '''Lucilla Mancini''']
| style="width:25%; background:#cccccc" align="center"|'''Secretary''' [mailto:name(at)name '''TBD''']
| style="width:25%; background:#cccccc" align="center"|'''Mailing list''' [https://lists.owasp.org/mailman/listinfo/ws-arca-metrics-vulnerabilities '''Subscription Page''']
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION SPECIFICS'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Objectives'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|
* Create a structured model that uses metrics for improving application security while reducing costs
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Venue/Date&Time/Model'''
| style="width:25%; background:#cccccc" align="center"|'''Venue''' [[:OWASP EU Summit 2008|OWASP EU Summit Portugal 2008]]
| style="width:25%; background:#cccccc" align="center"|'''Date&Time''' November 4, 2008 Time TBD
| style="width:25%; background:#cccccc" align="center"|'''Discussion Model''' "Everybody is a Participant"
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:white; color:white"|
|}
{|style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION OPERATIONAL RESOURCES'''
|-
| style="width:100%; background:#cccccc" align="center"|post-it's, White bond paper sheets
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:white; color:white"|
|}
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION ADDITIONAL DETAILS'''
|-
| style="width:100%; background:#cccccc" align="left"|
If you have participated in any translation in any place other project (OWASP or non OWASP) bring your experiences. If you don't have experience, but just one or two good ideas, you are very welcome as well.
|}
{| style="width:100%" border="0" align="center"
! colspan="3" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION OUTCOMES'''
|-
| style="width:7%; background:#6C82B5" align="center"|Statements, Initiatives or Decisions
| style="width:46%; background:#b3b3b3" align="center"|'''Proposed by Working Group'''
| style="width:47%; background:#b3b3b3" align="center"|'''Approved by OWASP Board'''
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Fill in here.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:46%; background:#C2C2C2" align="center"|Fill in here.
| style="width:47%; background:#C2C2C2" align="center"|After the Board Meeting - fill in here.
|}
== Working Session Participants ==
(Add you name by editing this table. On your the right, just above the this frame, you have the option to edit)
{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''WORKING SESSION PARTICIPANTS'''
|-
| style="width:7%; background:#7B8ABD" align="center"|
| style="width:15%; background:#cccccc" align="center"|'''Name'''
| style="width:15%; background:#cccccc" align="center"|'''Company'''
| style="width:63%; background:#cccccc" align="center"|'''Notes & reason for participating, issues to be discussed/addressed'''
|-
| style="width:7%; background:#7B8ABD" align="center"|1
| style="width:15%; background:#cccccc" align="center"|Massimo Biagiotti
| style="width:15%; background:#cccccc" align="center"|E-Business
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|2
| style="width:15%; background:#cccccc" align="center"|Andrea Cogliati
| style="width:15%; background:#cccccc" align="center"|OWASP Rochester, NY
| style="width:63%; background:#cccccc" align="center"|General interest toward Application Security metrics
|-
| style="width:7%; background:#7B8ABD" align="center"|3
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|4
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|5
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|6
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|7
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|8
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|9
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|-
| style="width:7%; background:#7B8ABD" align="center"|10
| style="width:15%; background:#cccccc" align="center"|
| style="width:15%; background:#cccccc" align="center"|
| style="width:63%; background:#cccccc" align="center"|
|}
If needed add here more lines.

[[Category:OWASP_Working_Session]]

OWASP EU Summit 2008--PRESS

2008-10-21T15:32:51Z

Sir W: Italian Browser Security PR added

[[:OWASP EU Summit 2008|'''Please click here to return to the OWASP EU Summit Portugal 2008 main page''']].

== Press Releases ==

{| style="width:100%" border="0" align="center"
! colspan="8" align="center" style="background:#4058A0; color:white"|'''PRESS RELEASE IDENTIFICATION'''
|-
| style="width:16%; background:#7B8ABD" align="center"|'''Subject/Date'''
| colspan="7" style="width:84%; background:#b3b3b3" align="left"|'''October 13th, 2008/OWASP European Summit'''
|-
| style="width:16%; background:#7B8ABD" align="center"|'''Language Versions '''
| style="width:12%; background:#cccccc" align="center"|'''English''' Click [[OWASP EU Summit 2008 PR English|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''Portuguese/Portugal''' Please click [https://www.owasp.org/images/f/f2/PRESS_RELEASE_PT.pdf here] to see.
| style="width:12%; background:#cccccc" align="center"|'''Portuguese/Brazil''' Please click [http://convisosec.com/PublicDocuments/OWASP/owaspeusummitpressreleasebr.pdf here] to see.
| style="width:12%; background:#cccccc" align="center"|'''Spanish''' Click [[OWASP EU Summit 2008 ES Spanish|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''French''' Click [[OWASP EU Summit 2008 PR French|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''Turkish''' Click [[OWASP EU Summit 2008 TR Turkish|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''Italian''' Click [[OWASP EU Summit 2008 PR Italian|here]] to see.
|-
| style="width:16%; background:#7B8ABD" align="center"|'''Subject/Date'''
| colspan="7" style="width:84%; background:#b3b3b3" align="left"|'''October 15th, 2008/OWASP teams up with browser developers to increase security on the web'''
|-
| style="width:14%; background:#7B8ABD" align="center"|'''Language Versions '''
| style="width:12%; background:#cccccc" align="center"|'''English''' Click [[OWASP EU Summit 2008 PR Browser|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''Portuguese/Portugal'''
| style="width:12%; background:#cccccc" align="center"|'''Portuguese/Brazil'''
| style="width:12%; background:#cccccc" align="center"|'''Spanish'''
| style="width:12%; background:#cccccc" align="center"|'''French'''
| style="width:12%; background:#cccccc" align="center"|'''Turkish'''
| style="width:12%; background:#cccccc" align="center"|'''Italian''' Click [[OWASP EU Summit 2008 PR Browser Italian|here]] to see
|}

== Press registration ==

Press registration is open to any member of the broadcast, print and Internet media who can prove they work for an organization or publication that covers computer security on a regular basis. At the conference we will provide a press room with Internet access and electrical outlets for laptop computers. If you need a separate room for filming interviews, please request it in advance in the comments section. Let us know if there are any other special needs such as speakers you want to interview when you arrive or other items such as computer access to file stories or a fax machine.

We welcome anyone to apply for press credentials but reserve the right to deny you a pass. As such, please be prepared to show us copies of your articles either at your publication's Web site or on the publication's masthead should we request it.

At the show, please be able to present a business card, and government issued picture id, article on your organization's masthead and contact information for your assignment editor should we need it to validate your credentials before issuing you a pass.

Press registration may be granted for the conference and working sessions seminars only. There are no press passes available for Training.

Please make a point to pre-register. Should you attempt to attain credentials on-site, we cannot guarantee you will qualify and must bring all information in the above paragraph.

To register please ask [mailto:kate.hartmann(at)owasp.org Kate Hartmann] for a password and use: [http://guest.cvent.com/i.aspx?4W,M3,35818773-e14b-4d8e-8db8-5e14a6285a3d http://www.owasp.org/images/7/7f/Register.gif]

== Media Resources for Working Sessions ==
The following text is being provided by the chairs from each of the [[OWASP EU Summit 2008#WORKING_SESSIONS_-_November_4th_.26_5th_.28Tue.2C_Wed.29]]. It explains why the working session is important, why it matters to the industry and what might be the beneficial outcomes. We hope to have public/industry information from all the working sessions here in due course for advanced publicity purposes.

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP Documentation Projects
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" | The working session on OWASP Documentation Projects is a great chance to understand how the set of OWASP related documents can be used as a toolset to promote security on software development and management. The outcomes from PCI DSS v.1.2 and other standards that will come form the market, shows how important is to understand the importance of protection measures on coding and how these actions will come back in high quality products that can reach the market in a more adequate fashion.

The outcomes will promote OWASP documents in the market and to be part of it will make the difference for your company, your career and your personal contribution for the security community.
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP_Working_Session_-_OWASP_Documentation_Projects]]
|-
|}
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP Tools Projects
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" |
The working session for OWASP Tools will address standards for Tool development at OWASP. This is will include standards for documentation, supporting tools via Books, How-Tos, Webcasts, Podcasts. We will also dive deep into the OWASP Project Assessment.

This session is for toolmakers who want to make better tools.
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP_Working_Session_-_OWASP_Tools_Projects]]
|-
|}
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP .NET Project
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" | OWASP secures .NET web applications and services. This working session will promote the OWASP .NET initiative, and discuss the roadmap for OWASP .NET for 2009. Additional objectives include discussing vulnerability research, application review and guidance for .NET and Mono (Open Source .NET) projects.
Are we protecting .NET/Mono developers? Is there adequate security guidance and vulnerability research for technology platforms, frameworks, community software, including:
* ASP.NET Data Services
* ASP.NET MVC
* Sharepoint
* Silverlight
* Community Server
* Wikipedia Search (Mono)
* DekiWiki (Mono)
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP Working Session - .NET Project]]
|-
|}

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP Education Project
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" |
There is plenty of knowledge available inside the OWASP community, spread via the wiki, Conferences, chapter meetings and not to forget the books.

Another important way to distribute the available knowledge is though education!

The Summit Working Session on Education will cover important aspects such as:
* How to improve knowledge transfer from OWASP projects towards the community,
* How to create training material (lessons, classes, courses) from OWASP project material?
* How to set up an OWASP education baseline,
* How to setup an OWASP Boot Camp,
* How to connect to organisation to promote OWASP education content: e.g. universities, other non-profit (or profit?) education organisations,
* How to organize the OWASP / Conference trainings to make them the best in the world?
* Can we integrate this into OWASP certification projects?
* How to setup an OWASP Boot Camp?

This working session is the ideal opportunity to build further on the shoulders of giants and spread OWASP's solutions through the education project!
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP_Working_Session_Education_Project]]
|-
|}
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP Awards
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" |
Governments, businesses and people rely on the Internet - the Internet has almost become something we cannot live without. But the Internet suffers from one terrible flaw: it's insecure. It's insecure because we've
rushed into creating a global network of computers without making sure we knew what we were
doing. The Open Web Application Security Project (OWASP) is a global open community dedicated to
enabling organisations to develop, purchase, and maintain applications that can be trusted. All of the
OWASP tools, documents, forums, and chapters are free and open to anyone interested in
improving application security.

There are people and groups working in this area who are doing battle for all of us every day, yet many are
unknown outside their own specialist areas. The proposed OWASP Awards could be used to thank and recognise outstanding contributions,
identify those who are raising security awareness and highlight those supporting security initiatives such as
promoting better practices.
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP_Working_Session_-_OWASP_Awards]]
|-
|}

== Media Resources for Training Courses ==

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | Flash Security Training
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" |

Flash security is hot. Just look at the hysteria around 'ClickJacking'.There are 2 Flash related security trainings at the summit covering Flash Security: [[OWASP_EU_Summit_2008_Training#Flash_Player_Security|Flash Player Security]] and [[OWASP_EU_Summit_2008_Training#Auditing_Flash_Applications|Auditing Flash Applications]]. These courses and the [[:Category:OWASP Flash Security Project|OWASP Flash Security project]] aim to share a knowledge base in order to raise awareness around the subject of Flash applications security.

The courses provide an overview of the Flash Player security model and common architectures for Flash deployment.
The course is targeted at people who need to understand the fundamentals of Flash Player security and how it will affect their website such as CSOs, web designers, Flash authors, web-site auditors and web architects.
The goal of the course is to provide the student with the enough information to architect and audit a secure Flash deployment.

|-
| style="width:15%; background:#7B8ABD" valign="top" | Training Page || style="background:#C2C2C2" | [[OWASP_EU_Summit_2008_Training]]
|-
|}

OWASP EU Summit 2008 PR Browser Italian

2008-10-21T15:31:23Z

Sir W: Italian Browser Security Press Release

= Press Release: Workshop sulla sicurezza dei browser =

'''Press Release: OWASP incontra gli sviluppatori di browser per migliorare la sicurezza del web'''

''Algarve/Portogallo - 4-7 Novembre 2008''

'''OWASP invita gli sviluppatori di web browser a prendere parte al proprio Summit in Portogallo'''

OWASP, Open Web Application Security Project, incontra i gruppi di sviluppatori di browser per incrementare la sicurezza del World Wide Web. Tutti i team di sviluppo di browser sono stati invitati a prendere parte all’OWASP European Summit che si terrà a Novembre in Portogallo.

Il Summit ospiterà il workshop Intrinsic Security Working Group sulla Sicurezza dei Browser che raccoglierà insieme gli esperti mondiali di sicurezza e i gruppi di sviluppo dei browser allo scopo di facilitare l’introduzione di caratteristiche di sicurezza all’interno dei browser che tutti i nostri clienti utilizzano oltre al miglioramento delle specifiche e degli standard a cui noi ci affidiamo.

Il Workshop sulla Sicurezza dei Browser ha l’obiettivo di produrre una lista dei desideri e un elenco di argomenti sul linguaggio HTML e sulla sicurezza dei browser da proporre al World Wide Web Consortium.

Per maggiori informazioni sull’OWASP EU Summit, consultare il sito web del Summit all’indirizzo: http://www.owasp.org/index.php/OWASP_EU_Summit_2008

Contatto: 
Kate Hartmann 
OWASP Operations Director 
9175 Guilford Road, Suite 300 
Columbia, MD 21046, USA 
Telefono: +1-301-575-0189 
Fax: +1-301-604-8033 
Email: kate.hartmann@owasp.org

OWASP EU Summit 2008--PRESS

2008-10-21T15:15:59Z

Sir W: Italian PR added

[[:OWASP EU Summit 2008|'''Please click here to return to the OWASP EU Summit Portugal 2008 main page''']].

== Press Releases ==

{| style="width:100%" border="0" align="center"
! colspan="8" align="center" style="background:#4058A0; color:white"|'''PRESS RELEASE IDENTIFICATION'''
|-
| style="width:16%; background:#7B8ABD" align="center"|'''Subject/Date'''
| colspan="7" style="width:84%; background:#b3b3b3" align="left"|'''October 13th, 2008/OWASP European Summit'''
|-
| style="width:16%; background:#7B8ABD" align="center"|'''Language Versions '''
| style="width:12%; background:#cccccc" align="center"|'''English''' Click [[OWASP EU Summit 2008 PR English|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''Portuguese/Portugal''' Please click [https://www.owasp.org/images/f/f2/PRESS_RELEASE_PT.pdf here] to see.
| style="width:12%; background:#cccccc" align="center"|'''Portuguese/Brazil''' Please click [http://convisosec.com/PublicDocuments/OWASP/owaspeusummitpressreleasebr.pdf here] to see.
| style="width:12%; background:#cccccc" align="center"|'''Spanish''' Click [[OWASP EU Summit 2008 ES Spanish|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''French''' Click [[OWASP EU Summit 2008 PR French|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''Turkish''' Click [[OWASP EU Summit 2008 TR Turkish|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''Italian''' Click [[OWASP_EU_Summit_2008_PR_Italian|here]] to see.
|-
| style="width:16%; background:#7B8ABD" align="center"|'''Subject/Date'''
| colspan="7" style="width:84%; background:#b3b3b3" align="left"|'''October 15th, 2008/OWASP teams up with browser developers to increase security on the web'''
|-
| style="width:14%; background:#7B8ABD" align="center"|'''Language Versions '''
| style="width:12%; background:#cccccc" align="center"|'''English''' Click [[OWASP EU Summit 2008 PR Browser|here]] to see.
| style="width:12%; background:#cccccc" align="center"|'''Portuguese/Portugal'''
| style="width:12%; background:#cccccc" align="center"|'''Portuguese/Brazil'''
| style="width:12%; background:#cccccc" align="center"|'''Spanish'''
| style="width:12%; background:#cccccc" align="center"|'''French'''
| style="width:12%; background:#cccccc" align="center"|'''Turkish'''
| style="width:12%; background:#cccccc" align="center"|'''Italian'''
|}

== Press registration ==

Press registration is open to any member of the broadcast, print and Internet media who can prove they work for an organization or publication that covers computer security on a regular basis. At the conference we will provide a press room with Internet access and electrical outlets for laptop computers. If you need a separate room for filming interviews, please request it in advance in the comments section. Let us know if there are any other special needs such as speakers you want to interview when you arrive or other items such as computer access to file stories or a fax machine.

We welcome anyone to apply for press credentials but reserve the right to deny you a pass. As such, please be prepared to show us copies of your articles either at your publication's Web site or on the publication's masthead should we request it.

At the show, please be able to present a business card, and government issued picture id, article on your organization's masthead and contact information for your assignment editor should we need it to validate your credentials before issuing you a pass.

Press registration may be granted for the conference and working sessions seminars only. There are no press passes available for Training.

Please make a point to pre-register. Should you attempt to attain credentials on-site, we cannot guarantee you will qualify and must bring all information in the above paragraph.

To register please ask [mailto:kate.hartmann(at)owasp.org Kate Hartmann] for a password and use: [http://guest.cvent.com/i.aspx?4W,M3,35818773-e14b-4d8e-8db8-5e14a6285a3d http://www.owasp.org/images/7/7f/Register.gif]

== Media Resources for Working Sessions ==
The following text is being provided by the chairs from each of the [[OWASP EU Summit 2008#WORKING_SESSIONS_-_November_4th_.26_5th_.28Tue.2C_Wed.29]]. It explains why the working session is important, why it matters to the industry and what might be the beneficial outcomes. We hope to have public/industry information from all the working sessions here in due course for advanced publicity purposes.

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP Documentation Projects
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" | The working session on OWASP Documentation Projects is a great chance to understand how the set of OWASP related documents can be used as a toolset to promote security on software development and management. The outcomes from PCI DSS v.1.2 and other standards that will come form the market, shows how important is to understand the importance of protection measures on coding and how these actions will come back in high quality products that can reach the market in a more adequate fashion.

The outcomes will promote OWASP documents in the market and to be part of it will make the difference for your company, your career and your personal contribution for the security community.
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP_Working_Session_-_OWASP_Documentation_Projects]]
|-
|}
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP Tools Projects
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" |
The working session for OWASP Tools will address standards for Tool development at OWASP. This is will include standards for documentation, supporting tools via Books, How-Tos, Webcasts, Podcasts. We will also dive deep into the OWASP Project Assessment.

This session is for toolmakers who want to make better tools.
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP_Working_Session_-_OWASP_Tools_Projects]]
|-
|}
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP .NET Project
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" | OWASP secures .NET web applications and services. This working session will promote the OWASP .NET initiative, and discuss the roadmap for OWASP .NET for 2009. Additional objectives include discussing vulnerability research, application review and guidance for .NET and Mono (Open Source .NET) projects.
Are we protecting .NET/Mono developers? Is there adequate security guidance and vulnerability research for technology platforms, frameworks, community software, including:
* ASP.NET Data Services
* ASP.NET MVC
* Sharepoint
* Silverlight
* Community Server
* Wikipedia Search (Mono)
* DekiWiki (Mono)
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP Working Session - .NET Project]]
|-
|}

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP Education Project
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" |
There is plenty of knowledge available inside the OWASP community, spread via the wiki, Conferences, chapter meetings and not to forget the books.

Another important way to distribute the available knowledge is though education!

The Summit Working Session on Education will cover important aspects such as:
* How to improve knowledge transfer from OWASP projects towards the community,
* How to create training material (lessons, classes, courses) from OWASP project material?
* How to set up an OWASP education baseline,
* How to setup an OWASP Boot Camp,
* How to connect to organisation to promote OWASP education content: e.g. universities, other non-profit (or profit?) education organisations,
* How to organize the OWASP / Conference trainings to make them the best in the world?
* Can we integrate this into OWASP certification projects?
* How to setup an OWASP Boot Camp?

This working session is the ideal opportunity to build further on the shoulders of giants and spread OWASP's solutions through the education project!
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP_Working_Session_Education_Project]]
|-
|}
{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | OWASP Awards
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" |
Governments, businesses and people rely on the Internet - the Internet has almost become something we cannot live without. But the Internet suffers from one terrible flaw: it's insecure. It's insecure because we've
rushed into creating a global network of computers without making sure we knew what we were
doing. The Open Web Application Security Project (OWASP) is a global open community dedicated to
enabling organisations to develop, purchase, and maintain applications that can be trusted. All of the
OWASP tools, documents, forums, and chapters are free and open to anyone interested in
improving application security.

There are people and groups working in this area who are doing battle for all of us every day, yet many are
unknown outside their own specialist areas. The proposed OWASP Awards could be used to thank and recognise outstanding contributions,
identify those who are raising security awareness and highlight those supporting security initiatives such as
promoting better practices.
|-
| style="width:15%; background:#7B8ABD" valign="top" | Session Page || style="background:#C2C2C2" | [[OWASP_Working_Session_-_OWASP_Awards]]
|-
|}

== Media Resources for Training Courses ==

{| style="width:80%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white" | Flash Security Training
|-
| style="width:15%; background:#7B8ABD" valign="top" | Briefing Text || style="background:#F2F2F2" |

Flash security is hot. Just look at the hysteria around 'ClickJacking'.There are 2 Flash related security trainings at the summit covering Flash Security: [[OWASP_EU_Summit_2008_Training#Flash_Player_Security|Flash Player Security]] and [[OWASP_EU_Summit_2008_Training#Auditing_Flash_Applications|Auditing Flash Applications]]. These courses and the [[:Category:OWASP Flash Security Project|OWASP Flash Security project]] aim to share a knowledge base in order to raise awareness around the subject of Flash applications security.

The courses provide an overview of the Flash Player security model and common architectures for Flash deployment.
The course is targeted at people who need to understand the fundamentals of Flash Player security and how it will affect their website such as CSOs, web designers, Flash authors, web-site auditors and web architects.
The goal of the course is to provide the student with the enough information to architect and audit a secure Flash deployment.

|-
| style="width:15%; background:#7B8ABD" valign="top" | Training Page || style="background:#C2C2C2" | [[OWASP_EU_Summit_2008_Training]]
|-
|}

OWASP EU Summit 2008 PR Italian

2008-10-21T15:10:50Z

Sir W: Italian Summit Press Release

Definire l'agenda 2009 per la Sicurezza delle Applicazioni Web: OWASP ti invita al proprio Summit in Portogallo http://www.owasp.org/index.php/OWASP_EU_Summit_2008.

Con l'obiettivo di 'Definire l'agenda WebAppSec per il 2009', il Summit OWASP è un incontro mondiale di leader OWASP e persone chiave dell'industria per presentare e discutere le ultime novità OWASP in fatto di tool, documentazione e trend della sicurezza delle applicazioni. Unisciti a noi in Portogallo fra un paio di settimane! Questa sede ospita una vasta selezioni di corsi di formazione, assieme a un percorso tecnico e ad uno di business che la rendono IL posto dove apprendere tutto quanto riguarda la sicurezza delle applicazioni web e le risorse che OWASP rende oggi disponibili.

OWASP (Open Web Application Security Project) è una organizzazione no-profit nata con lo scopo di supportare chi lavora nel campo della sicurezza delle applicazioni web nel mondo ed ha già erogato più di 250.000 dollari di fondi per la ricerca. Oltre a più di 40 presentazioni tenute dai leader OWASP e dai destinatari dei fondi, il summit ospiterà numerose sessioni di lavoro destinate a migliorare la collaborazione, raggiungere obiettivi specifici e identificare la rotta per progetti, sedi locali e per l'intera comunità OWASP.

Per facilitare questo evento, l'OWASP sta investendo 150.000 dollari che saranno usati per coprire le spese di viaggio e alloggio per i leader OWASP, partecipanti attivi e persone chiave nell'industria. Con la loro presenza confermata (vedi la lista a: http://spreadsheets.google.com/pub?key=pAX6n7m2zaTVLrPtR07riBA), il summit OWASP garantirà un ambiente rilassato ma professionale dove incontrare, discutere, influenzare e contribuire ai progetti OWASP.

Il summit OWASP ospiterà inoltre una vasta gamma di corsi di formazione che vanno a coprire un ampio spettro di argomenti riguardanti la sicurezza delle applicazioni web e progetti OWASP.

Questo incredibile risultato per OWASP è reso possibile solo dalla collaborazione attiva di numerose persone e organizzazioni nel mondo intero. In questo spirito di cooperazione, OWASP invita tutti i suoi membri e chiunque sia interessato, individui e societa', a partecipare a questo emozionante evento. Unisciti a noi e aiutaci a definire l'agenda 2009 per la sicurezza delle applicazioni web!

Ci sono anche alcune opportunità di sponsorizzazione dell'evento (vedi http://www.owasp.org/index.php/OWASP_EU_Summit_2008_Sponsors). Non perdere l'opportunità di associare il tuo marchio a questo evento di rilevanza mondiale!

Di seguito sono riportati ulteriori dettagli riguardanti il Summit. Per tutte le informazioni in merito e per annunci dell’ultima ora, visita il sito del Summit: http://www.owasp.org/index.php/OWASP_EU_Summit_2008.

'''Progetti'''
I progetti OWASP selezionati per la presentazione al summit includono nuovi documenti e strumenti innovativi per aiutare gli sviluppatori, architetti software e specialisti della sicurezza a rendere più sicure le applicazioni:

* Application Security Verification Standard,
* Code review guide, V1.1,
* Ruby on Rails Security Guide v2,
* Securing WebGoat using ModSecurity,
* Testing Guide v3,
* GTK+ GUI for w3af project,
* Access Control Rules Tester,
* AntiSamy .NET,
* Live CD & DVD Project,
* OpenPGP Extensions for HTTP,
* Orizon Project,
* Python Static Analysis,
* WebScarab-NG,
* E molti, molti altri!

'''Sessioni di lavoro'''

Anticipando la presenza di persone chiave nell’industria della sicurezza delle applicazioni, le Sessioni di Lavoro copriranno un ampio ventaglio di argomenti, tra i quali:

* OWASP Top 10 2009,
* Browser Security,
* Web Application Framework Security,
* Enterprise Security API Project,
* Best Practices for OWASP Chapter Leaders,
* OWASP Documentation Projects,
* OWASP Tools Projects,
* OWASP Education Project,
* OWASP Strategic Planning for 2009,
* OWASP Certification,
* OWASP Winter of Code 2009
* Two-way Internationalization of OWASP Content
* E molto altro!

'''Formazione'''

I seguenti corsi da 2, 1 o mezza giornata coprono i principali argomenti relativi alla sicurezza delle applicazioni web e ai progetti OWASP:

* OWASP Top 10 - What Developers Should Know on Web Application Security
* Uncovering WebScarab's Secret Treasures
* Securing WebGoat with ModSecurity
* Secure Programming with Java
* Advanced Web Application Security Testing
* Building Secure Web 2.0 Applications
* Building Secure Web Services
* Building Secure Web Applications with OWASP's Enterprise Security API (ESAPI)
* Classic ASP Security using OWASP tools
* Web Application Assessments
* Hacking Owasp Orizon Project v1.0
* Ajax Security
* Practical Penetration Testing: Think Like an Attacker to Stop Attacks
* Linux Software Exploitation
* Web server/services hardening using SELinux

Contatto:

Kate Hartmann 
OWASP Operations Director 
9175 Guilford Road, Suite 300 
Columbia, MD 21046, USA 
Telefono: +1-301-575-0189 
Fax: +1-301-604-8033 
Email: kate.hartmann@owasp.org

Rochester

2008-09-17T21:31:50Z

Sir W: September meeting details

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andreac@dollos.it Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''September Meeting Details'''

September meeting will be held on '''Monday September 22nd, 6pm at Bryant & Stratton College''' and will feature a videoconference with '''Jeff Williams''', world famous webappsec guru, on verb tampering, EASPI library and the future of OWASP. '''You can't miss this one!'''

'''Presenter:''' Jeff Williams

'''Topic:''' Verb tampering and ESAPI

'''Bio:''' Jeff Williams is one of the major contributors in webappsec community. He has written many whitepapers, spoken at many conferences including Secure Software Summit, OWASP conferences, ISSA InfoSec Conference, NSA High Confidence Software and Systems Conference (HCSS), JavaOne, National Computer Security Conference (NCSC), etc, worked on several projects and written many tools available at OWASP (including creating the OWASP Top 10, WebGoat, Stinger, Secure Software Contract Annex, Honeycomb Project and the Enterprise Security API). Jeff has done a lot of work in promoting awareness of web application security. He's CEO of Aspect Security and also volunteers as chairs of OWASP Foundation. You can find more about him on [http://myappsecurity.blogspot.com/2007/03/reflection-on-jeff-williams.html his blog].

'''Abstract:''' The ESAPI is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway. Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.
The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2008-09-08T14:03:02Z

Sir W: Added Digital Rochester's Get Connected!

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andreac@dollos.it Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''September Meeting Details'''

In September we'll have a presentation by Jeff Williams, OWASP co-founder and world-recognized expert on Web Application Security. His presentation is tentatively scheduled for Monday September 22nd at 6pm at Bryant & Stratton College.

'''Digital Rochester's Get Connected!'''

We've been invited by Digital Rochester to be part of their September 9th
networking event. Get Connected! is Digital Rochester's annual event that
gathers a select group of networking and service organizations from around
the region in order to make connections that can benefit the greater
Rochester community. Some are hard-core techies, others more social, many
have a mission that could inspire you to get involved! Come to learn more
about the organizations and to meet some of Rochester's most interesting
professionals as we all Get Connected!

: Tuesday Sep 9th 5:30pm - 8:00 pm at Village Gate, 2nd floor atrium, 274 North Goodman St ([http://maps.google.com/maps?f=q&hl=en&geocode=&q=274+North+Goodman+St+rochester+ny&sll=37.0625,-95.677068&sspn=51.488837,94.130859&ie=UTF8&z=16&iwloc=addr&om=1 Google Map])

Over twenty groups will be there to share information about their
organizations and the ways in which people can get involved with some of
their activities. We'll have a table, but as you mix with the crowd, be
sure to help us spread the word about OWASP!

There's no charge to attend. For more info visit [http://www.digitalrochester.com/details.php Get Connected!] web site.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2008-08-13T13:46:09Z

Sir W: Added September details

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andreac@dollos.it Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''September Meeting Details'''

In September we'll have a presentation by Jeff Williams, OWASP co-founder and world-recognized expert on Web Application Security. His presentation is tentatively scheduled for Monday September 22nd at 6pm at Bryant & Stratton College.

'''August'''

We won't have any meetings in August. See you in September.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]
[[Category:New York]]

Rochester

2008-06-26T19:27:34Z

Sir W: Corrected RSVP

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andreac@dollos.it Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''July Meeting Details'''

In July we'll have a joint meeting with [http://www.rochissa.org/ Rochester ISSA chapter]. This meeting will start at 5:30pm instead of usual 6pm. Please RSVP to [mailto:info@rochissa.org info@rochissa.org] or call 585-319-4853 to speed up admission process.

* Date July 21, 5:30pm-7:30pm
* Location RG&E - 89 East Avenue, 1st Floor Conference Room - Rochester, NY 14649 - Free parking is in the gated west lot next to the RG&E Building.
* Title Input Validation: The root of all evil
* Abstract A brief definition and overview of input validation. Review of common input validation strategies. Concluding with examples of issues resulting from weak or non-existent input validation, including examples of corrective validation solutions.
* Presenter Duane Peifer
Duane is a Senior Systems Engineer at UberGuard Information Security, LLC, in Avon, NY, were he provides UberGuard's customers with technical consulting and web site security assessments and penetration tests. He holds a B.S. in Computer Science from Rochester Institute of Technology and has 15 years of Systems Engineering and Project Management
experience. Duane is also the co-owner of UberScan, LLC, a startup software development company.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2008-06-26T19:24:38Z

Sir W: Added RSVP

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andreac@dollos.it Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''July Meeting Details'''

In July we'll have a joint meeting with [http://www.rochissa.org/ Rochester ISSA chapter]. This meeting will start at 5:30pm instead of usual 6pm. Please RSVP to [mailto:andreac@dollos.it Andrea Cogliati] to speed up admission process.

* Date July 21, 5:30pm-7:30pm
* Location RG&E - 89 East Avenue, 1st Floor Conference Room - Rochester, NY 14649 - Free parking is in the gated west lot next to the RG&E Building.
* Title Input Validation: The root of all evil
* Abstract A brief definition and overview of input validation. Review of common input validation strategies. Concluding with examples of issues resulting from weak or non-existent input validation, including examples of corrective validation solutions.
* Presenter Duane Peifer
Duane is a Senior Systems Engineer at UberGuard Information Security, LLC, in Avon, NY, were he provides UberGuard's customers with technical consulting and web site security assessments and penetration tests. He holds a B.S. in Computer Science from Rochester Institute of Technology and has 15 years of Systems Engineering and Project Management
experience. Duane is also the co-owner of UberScan, LLC, a startup software development company.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2008-06-26T19:21:57Z

Sir W: July meeting, all info

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andreac@dollos.it Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''July Meeting Details'''

In July we'll have a joint meeting with [http://www.rochissa.org/ Rochester ISSA chapter]. This meeting will start at 5:30pm instead of usual 6pm.

* Date July 21, 5:30pm-7:30pm
* Location RG&E - 89 East Avenue, 1st Floor Conference Room - Rochester, NY 14649 - Free parking is in the gated west lot next to the RG&E Building.
* Title Input Validation: The root of all evil
* Abstract A brief definition and overview of input validation. Review of common input validation strategies. Concluding with examples of issues resulting from weak or non-existent input validation, including examples of corrective validation solutions.
* Presenter Duane Peifer
Duane is a Senior Systems Engineer at UberGuard Information Security, LLC, in Avon, NY, were he provides UberGuard's customers with technical consulting and web site security assessments and penetration tests. He holds a B.S. in Computer Science from Rochester Institute of Technology and has 15 years of Systems Engineering and Project Management
experience. Duane is also the co-owner of UberScan, LLC, a startup software development company.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

Rochester

2008-06-24T15:40:58Z

Sir W: Added July meeting details

== Welcome to the OWASP Rochester Local Chapter ==

Welcome to the local Rochester chapter homepage. The chapter leader is [mailto:rd@rd1.net Ralf Durkee]

== Participation ==

OWASP chapter meetings are free and open to anyone interested in application security. We encourage members to give presentations on specific topics and to contribute to the local chapter by sharing their knowledge with others. Prior to participating with OWASP please review the [[Chapter Rules]].

The Rochester chapter has two mailing lists: one for announcements and one for general discussion. The announce list is for official communications (e.g meeting announcements, web site updates, etc). The discussion list is for general participation and everyone is encouraged to post. The announce mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-announce here]. The discussion mailing list can be found [http://lists.owasp.org/mailman/listinfo/owasp-rochester-ny here]. You can also review the [http://lists.owasp.org/pipermail/owasp-rochester-announce/ announce] and [http://lists.owasp.org/pipermail/owasp-rochester-ny discussion] e-mail archives to see what folks have been talking about. Please make sure you are subscribed to announce to receive any last minute meeting info.

== Local Officers ==

<ul>
*President: [mailto:rd@rd1.net Ralf Durkee]
*Vice President: Chris Karr
*Secretary and Treasurer: [mailto:mailto:stevebuck@sbuck.net Steve Buck]
*Web and Communications: [mailto:andreac@dollos.it Andrea Cogliati]
</ul>

== Meeting Dates & Location ==

Dates: The third Monday of every month, starting at 6:00 PM.

Types of events: Formal meeting (featuring a presentation) in odd numbered months, informal event (open forum with beer and wings) in even numbered months

Locations:

* Formal meetings at 1225 Jefferson Rd, Rochester, NY 14623 (near I-390) [http://maps.google.com/maps?f=q&hl=en&q=1225+Jefferson+Rd,+Rochester,+NY&ie=UTF8&om=1&ll=43.087727,-77.600255&spn=0.014856,0.04283 Google Maps]
* Beer and wings at Mac Gregor's Grill & Tap Room, 300 Jefferson Rd, NY 14623 [http://maps.google.com/maps?f=q&hl=en&geocode=&time=&date=&ttype=&q=300+Jefferson+Rd+Rochester+NY&sll=43.15549,-77.61601&sspn=0.284013,0.55481&ie=UTF8&om=1&z=16&iwloc=addr Google Maps]

Formal meeting space is graciously offered by [http://www.bryantstratton.edu/campus/campus.aspx?c=14 Bryant & Stratton College] Enter the Frontier Commons plaza, near the Post Office. Towards the right, rear of the plaza is the PSC (Professional Skills Center) door, which is to the left of the main Bryant & Stratton entrance door. There will be a sign on the door indicating the room in which we will meet.

Please note that for informal meetings at Mac Gregor's, everybody needs to pay for their own food and drinks.

'''July Meeting Details'''

In July we'll have a joint meeting with [http://www.rochissa.org/ Rochester ISSA chapter].

* Date July 21 at 6pm
* Location TBD
* Title Input Validation: The root of all evil
* Presenter Duane Peifer
* Abstract A brief definition and overview of input validation. Review of common input validation strategies. Concluding with examples of issues resulting from weak or non-existent input validation, including examples of corrective validation solutions.

== Future Events ==

; Oct 29-30 2008 - Rochester Security Summit 2008

: The Rochester OWASP chapter in partnership with other Rochester institutions is organizing the third annual Rochester Security Summit Oct 29-30 during National Cyber Security Awareness Month. This year we'll have a full day dedicated to application security and we are are working to bring to Rochester the best national acclaimed speakers.

Visit [http://www.RochesterSecurity.org/ Rochester Security Summit Site] for details.

== Past Presentations ==

May 2008 Database Encryption, by Ralf Durkee [[Media:Database_Encryption.ppt‎|PPT]]

January 2008 SQL Injection and Dynamic SQL, by Andrea Cogliati [[Media:MoreSQL.zip|ZIP]]

September 2007 2007 OWASP Top 10 Most Critical Web Application Security Vulnerabilities, by Ralph Durkee [[Media:OWASP_Top_10_2007_v6.ppt|PowerPoint]]

October 2006 The first of the OWASP top ten: unvalidated input, by Steve Buck.
[http://rd1.net/owasp/2006-10-16_owasp-presentation.ppt PowerPoint]

April 2006 PGP: Encryption for e-mail and web applications, by Ralph Durkee [http://rd1.net/owasp/Apr_OWASP_PGP_Durkee.pdf PDF]

February 2006 Identity Theft, Phishing and Pharming, by Danny Allan [http://rd1.net/owasp/AppSec2005DC-Danny_Allan-Identity_Theft_Phishing_and_Pharming.pdf PDF]

February 2006 Secure e-mail, by Thomas Bullinger [http://rd1.net/owasp/SecureEmail.pdf PDF]

January 2006 PCI Compliance, by Pat Massey, Ralf Durkee, Maureen Baran [http://rd1.net/owasp/Rochester_OWASP_PCI_Compliance.pdf PDF]

September 2005 Two Factor Authentication for Java Applications with Client Certificates, by Ralf Durkee [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.pdf PDF] [http://rd1.net/owasp/DCI-Java-SSL-Certs-2005-09-19.sxi Open Office]

April 2005 Avoiding Backend Exploitation of Mail Forms, by Max Kessler [http://rd1.net/owasp/owasp-mailform-exploitation.ppt PowerPoint] [http://rd1.net/owasp/owasp-mailform-exploitation.sxi Open Office]

March 2005 Bringing Two-Factor Authentication to Web Applications, by Michael Starks [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt PowerPoint] [http://rd1.net/owasp/2005_Mar_OWASP_Two-factor%20Web%20App.ppt Open Office]

February 2005 Insecure Storage, by Chris Karr [http://rd1.net/owasp/Insecure_Storage.ppt PowerPoint]

January 2005 Access Control and Session Mgmnt, by Steve Buck [http://rd1.net/owasp/Jan_OWASP-access-control.ppt PowerPoint] [http://rd1.net/owasp/Jan_OWASP-access-control.sxi Open Office]

November 2004 Intro to OWASP by Ralf Durkee. Demonstration of SQL Injection attack and prevention, by Paul Cupo [http://rd1.net/owasp/Nov_OWASP_20041103.ppt PowerPoint]

[[Category:OWASP Chapter]]

OWASP on the Move

2008-06-23T20:17:50Z

Sir W: Added Rochester Security Summit

This new program allows local chapter or application security conferences to have OWASP presenters on site.

This page will allow 3 parties to find each other:

* OWASP speakers to entertain OWASP presentations and that want to see the world
* Local chapters or application security events that want to attract an OWASP speaker
* OWASP sponsors that want to support spreading the OWASP message

Owasp on the Move (OotM) is now also a project. Visit the project [[:Category:OWASP_on_the_Move_Project|page]] to see what the future holds for OotM.

==OWASP On the Move Rules:==

The following rules apply for the OotM project:

*The normal maximum amount per speaker is 500 USD
*Only in special circumstances the maximum amount per speaker can be raised to a maximum of $1000 USD
*There is a proposed limit of 2,000 USD on the amount of $ provided to any individual per year (*see 'further funding' below)
*There is a proposed limit of 1,000 USD on the amount of $ provided to any event per year(*see 'further funding' below)
*There is a proposed limit of 2,000 USD on the amount of $ provided to any chapter per year(*see 'further funding' below)
*The program will run for 1 year or 30,000 USD (whichever comes first) and then will be reviewed for the value and ROI for OWASP and its community;

So, a chapter can use the sponsorship 4 times a year, with the max of 2 speakers sponsored by OotM for one single event.

*Further funding: for active chapters or speakers who have reach the proposed financial limits, further funding is possible but will depend on available budget, since priority would be given to chapters below these thresholds

== Current demand ==
Add your demand here:

* [[Helsinki]] is looking for OWASP speakers on the SDLC topic for a mini-conference. Expected timing is sometime in May . Sponsors and potential speakers are requested to contact Antti.

* [[Edmonton]] is looking for an OWASP speaker on any topic to coincide with the CIPS Edmonton ICE Conference[http://www.iceconference.com/iceSpeakers.aspx]. The talk would be during November 5 - 7, 2007. Looking for a quick reply if possible as we are trying to finalize the conference program very shortly. Keynotes at the conference include Bruce Schneier and Jim Christy, so this could be a great opportunity to showcase OWASP to an interested audience.

* [[Rochester]] is looking for an OWASP speaker for the [http://rochestersecurity.org Rochester Security Summit] on October 30, 2008.

== Current offerings ==
If you want to (re)do an OWASP related presentation, propose them here with your availability boundaries (timing/geographical)
* Marc Curphey will happily speak about the WebAppSec industry, SDLC etc. around Europe. You can see him in action at [http://video.hitb.org/2006.html HITB with John Viega] (big download)
* [mailto:thesp0nge@owasp.org Paolo Perego] is available to talk about [http://www.owasp.org/index.php/Category:OWASP_Orizon_Project Orizon project], safe coding and code review issues around Europe in the near October-December.
* [mailto:marc.m.morana@gmail.org Marco Morana] is available to talk about [http://iac.dtic.mil/iatac/download/security.pdf Software Security Frameworks]and Secure Code Reviews [https://www.cmpevents.com/CSI33/a.asp?option=G&V=3&id=443342 see 07 CSI conference as reference] in USA around November-December and in Europe around January-February.
* [mailto:sebastien.gioria@owasp.fr Sébastien Gioria] is available to talk about WebAppSec, educational purpose on AppSec in French or at least in english around France/Europe/Canada from middle of March 08. You can find some Talk on the [http://www.owasp.fr Owasp France Chapter]
* you?

== Upcoming OWASP on the Move Events ==

* October 30, 2008 - [[Rochester]] Marco Morana will speak at [http://rochestersecurity.org Rochester Security Summit] about Software Security Framework

== Past OWASP on the Move Events ==

* 8th Sep 2007: [[Belgium]] Mark Curphey, pdp (Architect), Simon Roses Femerling and David Kierznowski presented as part of the OWASP Day worldwide conference.
* 14th July 2007: [[Turkey]] Dinis joined the first Turkey Mini-Conference
* 22nd June 2007: [[Belgium]] Ivan Ristic and Dinis Cruz came to the chapter meeting (sponsored by F5 Networks locally).

== Sponsors ==
Currently the OotM is sponsored by banners on the OWASP home page.

We are looking for sponsors that specifically want to sponsor the OotM project.

Past local sponsors were:
* F5 Networks in [[Belgium]]