https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=SteingraOWASP - User contributions [en]2026-05-28T09:22:08ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=San_Jose&diff=23829San Jose2007-12-03T18:43:38Z<p>Steingra: /* Thursday, December 13, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Thursday, December 13, 2007 ==<br />
<br />
<br />
OWASP Bay Area will host its next meeting at the Stanford University Alumni Association Center on Thursday, December 13. As usual attendance is free and food and beverages will be provided. This will be an awesome event and a great opportunity to network with industry peers. The event is open to the public; please forward this invite to your colleagues and friends who are interested in computer and application security. <br />
<br />
<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and Holiday Reception (food & beverages)<br/><br />
6:30pm - 7:15pm ... Ghosts in the Browser – Niels Provos, Google<br/><br />
7:15pm - 8:00pm ... Ph.D. Student Presentations – Adam Barth & Collin Jackson, Stanford University<br/><br />
8:00pm - 8:30pm ... Networking Session<br/><br />
<br />
'''Venue:'''<br/><br />
Stanford Alumni Association Center<br/><br />
Stanford University<br/><br />
326 Galvez Street<br/><br />
Stanford, CA 94305<br/><br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/#mvt=m&gid1=21396976&q1=326+galvez+st%2C+stanford%2C+ca&trf=0&lon=-122.164643&lat=37.430552&mag=3 Map]<br/><br />
<br />
<br />
'''Ghosts in the Browser'''<br/><br />
Presented by: Niels Provos, Ph.D., Google, Inc.<br/><br />
<br />
'''Abstract:'''<br/><br />
As more users are connected to the Internet and conduct their daily activities electronically, computer users have become the target of an underground economy that infects hosts with malware or adware for financial gain. Unfortunately, even a single visit to an infected web site enables the attacker to detect vulnerabilities in the user’s applications and force the download a multitude of malware binaries. Frequently, this malware allows the adversary to gain full control of the compromised systems leading to the ex-filtration of sensitive information or installation of utilities that facilitate remote control of the host. We believe that such behavior is similar to our traditional understanding of botnets. However, the main difference is that web-based malware infections are pull-based and that the resulting command feedback loop is looser. To characterize the nature of this rising thread, we identify the four prevalent mechanisms used to inject malicious content on popular web sites: web server security, user contributed content, advertising and third-party widgets. For each of these areas, we present examples of abuse found on the Internet. Our aim is to present the state of malware on the Web and emphasize the importance of this rising threat.<br />
<br />
'''Bio:'''<br/><br />
Based out of Mt.View, Niels Provos is a Senior Staff Engineer at Google, Inc. His interests include research in Web-Based Malware, Distributed Denial of Service, Steganography, Cryptography and Computer and Network Security. Niels studied Physics and Mathematics at University of Hamburg, Germany, and attended the University of Michigan as a graduate student where he earned both is Masters in Computer Science and his Ph.D. in Computer Science. He has published countless research papers and recently authored the book Virtual Honeypots: From Tracking Botnets to Intrusion Detection. <br />
<br />
<br />
'''Ph.D. Student Presentations'''<br/><br />
Presented by: Adam Barth & Collin Jackson, Stanford University<br/><br />
<br />
<br />
Preview of OWASP Bay Area, Mandeep Khera<br/><br />
Mandeep will provide an outline of the goals and objectives for local OWASP affiliates in 2008. <br />
<br />
Please RSVP by responding to this email or visit http://owaspdec2007.eventbrite.com<br />
<br />
Special thanks to Stanford University Alumni Association for hosting this event and to Cenzic and AppSec Consulting for sponsoring.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=23828San Jose2007-12-03T18:42:52Z<p>Steingra: /* Thursday, December 13, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Thursday, December 13, 2007 ==<br />
<br />
<br />
OWASP Bay Area will host its next meeting at the Stanford University Alumni Association Center on Thursday, December 13. As usual attendance is free and food and beverages will be provided. This will be an awesome event and a great opportunity to network with industry peers. The event is open to the public; please forward this invite to your colleagues and friends who are interested in computer and application security. <br />
<br />
<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and Holiday Reception (food & beverages)<br/><br />
6:30pm - 7:15pm ... Ghosts in the Browser – Niels Provos, Google<br/><br />
7:15pm - 8:00pm ... Ph.D. Student Presentations – Adam Barth & Collin Jackson, Stanford University<br/><br />
8:00pm - 8:30pm ... Networking Session<br/><br />
<br />
'''Venue:'''<br/><br />
Stanford Alumni Association Center<br/><br />
Stanford University<br/><br />
326 Galvez Street<br/><br />
Stanford, CA 94305<br/><br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/#mvt=m&gid1=21396976&q1=326+galvez+st%2C+stanford%2C+ca&trf=0&lon=-122.164643&lat=37.430552&mag=3 Map]<br/><br />
<br />
<br />
<br />
'''Ghosts in the Browser'''<br/><br />
Presented by: Niels Provos, Ph.D., Google, Inc.<br/><br />
<br />
'''Abstract:'''<br/><br />
As more users are connected to the Internet and conduct their daily activities electronically, computer users have become the target of an underground economy that infects hosts with malware or adware for financial gain. Unfortunately, even a single visit to an infected web site enables the attacker to detect vulnerabilities in the user’s applications and force the download a multitude of malware binaries. Frequently, this malware allows the adversary to gain full control of the compromised systems leading to the ex-filtration of sensitive information or installation of utilities that facilitate remote control of the host. We believe that such behavior is similar to our traditional understanding of botnets. However, the main difference is that web-based malware infections are pull-based and that the resulting command feedback loop is looser. To characterize the nature of this rising thread, we identify the four prevalent mechanisms used to inject malicious content on popular web sites: web server security, user contributed content, advertising and third-party widgets. For each of these areas, we present examples of abuse found on the Internet. Our aim is to present the state of malware on the Web and emphasize the importance of this rising threat.<br />
<br />
'''Bio:'''<br/><br />
Based out of Mt.View, Niels Provos is a Senior Staff Engineer at Google, Inc. His interests include research in Web-Based Malware, Distributed Denial of Service, Steganography, Cryptography and Computer and Network Security. Niels studied Physics and Mathematics at University of Hamburg, Germany, and attended the University of Michigan as a graduate student where he earned both is Masters in Computer Science and his Ph.D. in Computer Science. He has published countless research papers and recently authored the book Virtual Honeypots: From Tracking Botnets to Intrusion Detection. <br />
<br />
'''Ph.D. Student Presentations'''<br/><br />
Presented by: Adam Barth & Collin Jackson, Stanford University<br/><br />
<br />
Preview of OWASP Bay Area, Mandeep Khera<br/><br />
Mandeep will provide an outline of the goals and objectives for local OWASP affiliates in 2008. <br />
<br />
Please RSVP by responding to this email or visit http://owaspdec2007.eventbrite.com<br />
<br />
Special thanks to Stanford University Alumni Association for hosting this event and to Cenzic and AppSec Consulting for sponsoring.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=23827San Jose2007-12-03T18:41:53Z<p>Steingra: /* Thursday, December 13, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Thursday, December 13, 2007 ==<br />
<br />
<br />
OWASP Bay Area will host its next meeting at the Stanford University Alumni Association Center on Thursday, December 13. As usual attendance is free and food and beverages will be provided. This will be an awesome event and a great opportunity to network with industry peers. The event is open to the public; please forward this invite to your colleagues and friends who are interested in computer and application security. <br />
<br />
<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and Holiday Reception (food & beverages)<br/><br />
6:30pm - 7:15pm ... Ghosts in the Browser – Niels Provos, Google<br/><br />
7:15pm - 8:00pm ... Ph.D. Student Presentations – Adam Barth & Collin Jackson, Stanford University<br/><br />
8:00pm - 8:30pm ... Networking Session<br/><br />
<br />
'''Venue:'''<br/><br />
Stanford Alumni Association Center<br/><br />
Stanford University<br/><br />
326 Galvez Street<br/><br />
Stanford, CA 94305<br/><br />
''Map and Directions:''<br/><br />
Map[http://maps.yahoo.com/#mvt=m&gid1=21396976&q1=326+galvez+st%2C+stanford%2C+ca&trf=0&lon=-122.164643&lat=37.430552&mag=3]<br/><br />
<br />
<br />
<br />
'''Ghosts in the Browser'''<br/><br />
Presented by: Niels Provos, Ph.D., Google, Inc.<br/><br />
<br />
'''Abstract:'''<br/><br />
As more users are connected to the Internet and conduct their daily activities electronically, computer users have become the target of an underground economy that infects hosts with malware or adware for financial gain. Unfortunately, even a single visit to an infected web site enables the attacker to detect vulnerabilities in the user’s applications and force the download a multitude of malware binaries. Frequently, this malware allows the adversary to gain full control of the compromised systems leading to the ex-filtration of sensitive information or installation of utilities that facilitate remote control of the host. We believe that such behavior is similar to our traditional understanding of botnets. However, the main difference is that web-based malware infections are pull-based and that the resulting command feedback loop is looser. To characterize the nature of this rising thread, we identify the four prevalent mechanisms used to inject malicious content on popular web sites: web server security, user contributed content, advertising and third-party widgets. For each of these areas, we present examples of abuse found on the Internet. Our aim is to present the state of malware on the Web and emphasize the importance of this rising threat.<br />
<br />
'''Bio:'''<br/><br />
Based out of Mt.View, Niels Provos is a Senior Staff Engineer at Google, Inc. His interests include research in Web-Based Malware, Distributed Denial of Service, Steganography, Cryptography and Computer and Network Security. Niels studied Physics and Mathematics at University of Hamburg, Germany, and attended the University of Michigan as a graduate student where he earned both is Masters in Computer Science and his Ph.D. in Computer Science. He has published countless research papers and recently authored the book Virtual Honeypots: From Tracking Botnets to Intrusion Detection. <br />
<br />
'''Ph.D. Student Presentations'''<br/><br />
Presented by: Adam Barth & Collin Jackson, Stanford University<br/><br />
<br />
Preview of OWASP Bay Area, Mandeep Khera<br/><br />
Mandeep will provide an outline of the goals and objectives for local OWASP affiliates in 2008. <br />
<br />
Please RSVP by responding to this email or visit http://owaspdec2007.eventbrite.com<br />
<br />
Special thanks to Stanford University Alumni Association for hosting this event and to Cenzic and AppSec Consulting for sponsoring.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=23826San Jose2007-12-03T18:40:12Z<p>Steingra: /* Thursday, December 13, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Thursday, December 13, 2007 ==<br />
<br />
<br />
OWASP Bay Area will host its next meeting at the Stanford University Alumni Association Center on Thursday, December 13. As usual attendance is free and food and beverages will be provided. This will be an awesome event and a great opportunity to network with industry peers. The event is open to the public; please forward this invite to your colleagues and friends who are interested in computer and application security. <br />
<br />
<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and Holiday Reception (food & beverages)<br/><br />
6:30pm - 7:15pm ... Ghosts in the Browser – Niels Provos, Google<br/><br />
7:15pm - 8:00pm ... Ph.D. Student Presentations – Adam Barth & Collin Jackson, Stanford University<br/><br />
8:00pm - 8:30pm ... Networking Session<br/><br />
<br />
'''Venue:'''<br/><br />
Stanford Alumni Association Center<br/><br />
Stanford University<br/><br />
326 Galvez Street<br/><br />
Stanford, CA 94305<br/><br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/#mvt=m&gid1=21396976&q1=326+galvez+st%2C+stanford%2C+ca&trf=0&lon=-122.164643&lat=37.430552&mag=3]<br/><br />
<br />
<br />
<br />
'''Ghosts in the Browser'''<br/><br />
Presented by: Niels Provos, Ph.D., Google, Inc.<br/><br />
<br />
'''Abstract:'''<br/><br />
As more users are connected to the Internet and conduct their daily activities electronically, computer users have become the target of an underground economy that infects hosts with malware or adware for financial gain. Unfortunately, even a single visit to an infected web site enables the attacker to detect vulnerabilities in the user’s applications and force the download a multitude of malware binaries. Frequently, this malware allows the adversary to gain full control of the compromised systems leading to the ex-filtration of sensitive information or installation of utilities that facilitate remote control of the host. We believe that such behavior is similar to our traditional understanding of botnets. However, the main difference is that web-based malware infections are pull-based and that the resulting command feedback loop is looser. To characterize the nature of this rising thread, we identify the four prevalent mechanisms used to inject malicious content on popular web sites: web server security, user contributed content, advertising and third-party widgets. For each of these areas, we present examples of abuse found on the Internet. Our aim is to present the state of malware on the Web and emphasize the importance of this rising threat.<br />
<br />
'''Bio:'''<br/><br />
Based out of Mt.View, Niels Provos is a Senior Staff Engineer at Google, Inc. His interests include research in Web-Based Malware, Distributed Denial of Service, Steganography, Cryptography and Computer and Network Security. Niels studied Physics and Mathematics at University of Hamburg, Germany, and attended the University of Michigan as a graduate student where he earned both is Masters in Computer Science and his Ph.D. in Computer Science. He has published countless research papers and recently authored the book Virtual Honeypots: From Tracking Botnets to Intrusion Detection. <br />
<br />
'''Ph.D. Student Presentations'''<br/><br />
Presented by: Adam Barth & Collin Jackson, Stanford University<br/><br />
<br />
Preview of OWASP Bay Area, Mandeep Khera<br/><br />
Mandeep will provide an outline of the goals and objectives for local OWASP affiliates in 2008. <br />
<br />
Please RSVP by responding to this email or visit http://owaspdec2007.eventbrite.com<br />
<br />
Special thanks to Stanford University Alumni Association for hosting this event and to Cenzic and AppSec Consulting for sponsoring.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=23825San Jose2007-12-03T18:37:41Z<p>Steingra: /* Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Thursday, December 13, 2007 ==<br />
<br />
<br />
OWASP Bay Area will host its next meeting at the Stanford University Alumni Association Center on Thursday, December 13. As usual attendance is free and food and beverages will be provided. This will be an awesome event and a great opportunity to network with industry peers. The event is open to the public; please forward this invite to your colleagues and friends who are interested in computer and application security. <br />
<br />
<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and Holiday Reception (food & beverages)<br />
6:30pm - 7:15pm ... Ghosts in the Browser – Niels Provos, Google<br />
7:15pm - 8:00pm ... Ph.D. Student Presentations – Adam Barth & Collin Jackson, Stanford University<br />
8:00pm - 8:30pm ... Networking Session<br />
<br />
'''Venue:'''<br/><br />
Stanford Alumni Association Center<br />
Stanford University<br />
326 Galvez Street<br />
Stanford, CA 94305<br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/#mvt=m&gid1=21396976&q1=326+galvez+st%2C+stanford%2C+ca&trf=0&lon=-122.164643&lat=37.430552&mag=3]<br/><br />
<br />
<br />
<br />
Ghosts in the Browser<br />
Presented by: Niels Provos, Ph.D., Google, Inc.<br />
<br />
Abstract: As more users are connected to the Internet and conduct their daily activities electronically, computer users have become the target of an underground economy that infects hosts with malware or adware for financial gain. Unfortunately, even a single visit to an infected web site enables the attacker to detect vulnerabilities in the user’s applications and force the download a multitude of malware binaries. Frequently, this malware allows the adversary to gain full control of the compromised systems leading to the ex-filtration of sensitive information or installation of utilities that facilitate remote control of the host. We believe that such behavior is similar to our traditional understanding of botnets. However, the main difference is that web-based malware infections are pull-based and that the resulting command feedback loop is looser. To characterize the nature of this rising thread, we identify the four prevalent mechanisms used to inject malicious content on popular web sites: web server security, user contributed content, advertising and third-party widgets. For each of these areas, we present examples of abuse found on the Internet. Our aim is to present the state of malware on the Web and emphasize the importance of this rising threat.<br />
<br />
Bio: Based out of Mt.View, Niels Provos is a Senior Staff Engineer at Google, Inc. His interests include research in Web-Based Malware, Distributed Denial of Service, Steganography, Cryptography and Computer and Network Security. Niels studied Physics and Mathematics at University of Hamburg, Germany, and attended the University of Michigan as a graduate student where he earned both is Masters in Computer Science and his Ph.D. in Computer Science. He has published countless research papers and recently authored the book Virtual Honeypots: From Tracking Botnets to Intrusion Detection. <br />
<br />
Ph.D. Student Presentations<br />
Presented by: Adam Barth & Collin Jackson, Stanford University<br />
<br />
Preview of OWASP Bay Area, Mandeep Khera<br />
Mandeep will provide an outline of the goals and objectives for local OWASP affiliates in 2008. <br />
<br />
Please RSVP by responding to this email or visit http://owaspdec2007.eventbrite.com<br />
<br />
Special thanks to Stanford University Alumni Association for hosting this event and to Cenzic and AppSec Consulting for sponsoring.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose-Archive&diff=23824San Jose-Archive2007-12-03T18:18:35Z<p>Steingra: /* Meeting - Tuesday, December 19, 2006 */</p>
<hr />
<div>== Meeting - Tuesday, December 19, 2006 ==<br />
<br />
'''Venue:'''<br/><br />
Fujitsu Advanced Networking Solutions<br/><br />
1240 E. Arques Ave.<br/><br />
Sunnyvale, CA 94085<br/><br />
<br />
<br />
'''New Trends and Web Application Security Statistics'''<br/><br />
'''''Presented by: Jeremiah Grossman, Founder & CTO, WhiteHat Security'''''<br/><br />
<br />
'''Abstract:''' First Look at New Web Application Security Statistics. The Top 10 Web Application Vulnerabilities and their Impact on the Enterprise Web applications are the newest attack target, hitting the biggest and best brands on the Internet. And yet, until now, there has been limited information available about the most prevalent and most severe vulnerabilities that are facilitating the rapidly rising number of attacks.<br />
<br />
WhiteHat Security founder and CTO, Jeremiah Grossman, will present the findings from the first WhiteHat Security Web Application Security Risk Report. Based on WhiteHat’s aggregate data from hundreds of web application assessments, Mr.Grossman's presentation will provide a first-of-its-kind look at the top vulnerabilities that attackers are exploiting at businesses across the Web.<br />
<br/><br />
• Identify and discuss the top ten vulnerabilities <br/><br />
• Define the severity levels of web application vulnerabilities <br/><br />
• Present strategies for web application vulnerability management <br/><br />
<br />
'''Bio:''' Mr. Grossman is a world-renowned expert in Web security and a founding member of the Web Application Security Consortium. He is a frequent speaker at industry events including the BlackHat Briefings, ISACA’s Networks Security Conference, NASA, the Air Force and Technology Conference, ISSA and Defcon. Mr. Grossman is also a featured expert and frequent contributor on TechTarget’s SearchAppSecurity.com.<br />
<br />
<br/><br />
<br />
<br />
<br />
== Thursday, September 6, 2007 ==<br />
<br />
'''Pictures From the Event'''<br/><br />
Garrett Gee was nice enough to take some pictures of the September 6th event. They can be found here:<br/><br />
http://flickr.com/photos/ggee/sets/72157601905839040/ <br />
<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
''Note:'' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/><br />
<br />
'''Workshop Instructors:'''<br/><br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
Tom Stracener - Cenzic<br/><br />
Arian Evans - WhiteHat Security<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
Kurt Opsahl, EFF <br/><br />
<br />
<br />
Please RSVP at http://owaspday.eventbrite.com or send an email to brian.bertacini at owasp.org. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21696San Jose2007-09-12T16:06:52Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Thursday, September 6, 2007 ==<br />
<br />
'''Pictures From the Event'''<br/><br />
Garrett Gee was nice enough to take some pictures of the September 6th event. They can be found here:<br/><br />
http://flickr.com/photos/ggee/sets/72157601905839040/ <br />
<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
''Note:'' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/><br />
<br />
'''Workshop Instructors:'''<br/><br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
Tom Stracener - Cenzic<br/><br />
Arian Evans - WhiteHat Security<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
Kurt Opsahl, EFF <br/><br />
<br />
<br />
Please RSVP at http://owaspday.eventbrite.com or send an email to brian.bertacini at owasp.org. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose_Archive&diff=21695San Jose Archive2007-09-12T15:48:37Z<p>Steingra: </p>
<hr />
<div>==Wednesday, July 25, 2007 ==<br />
Open to the public, attendance is free<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and reception (food & bev)<br/><br />
6:30pm - 7:15pm ... Attacking XML Security - Brad Hill<br/><br />
7:15pm - 8:00pm ... Development of a Security Metric System to Rate Enterprise Software - Fredrick Lee<br/><br />
8:00pm - 8:30pm ... Networking Session<br/><br />
<br />
'''Venue:'''<br/><br />
Ariba<br/><br />
807 11th Avenue<br/><br />
Sunnyvale, Ca 94089<br/><br />
[http://www.ariba.com/company/hq_map.cfm Map and Directions]<br/><br />
<br />
<br />
'''Attacking XML Security'''<br/><br />
'''''Presented by: Brad Hill, iSEC Partners'''''<br/><br />
<br />
'''Abstract:''' <br />
Brad will present his ongoing research into attacking the XML Digital Signature and Encryption standards that underpin the security of Web Services, mobile code, SAML, federated identity systems and more. The talk will begin with a high-level, critical take on the emerging conventional wisdom about message-oriented security and continue with a detailed discussion of design and implementation weaknesses in the standards. Technical material will include a root cause analysis of the recent iSEC advisory on cross-platform, remote code execution vulnerabilities discovered in multiple XML Digital Signature products. <br/><br />
<br />
[http://www.isecpartners.com/files/iSEC_HILL_AttackingXMLSecurity_bh07.pdf Presentation Link]<br/><br />
<br />
'''Bio:''' Based out of Seattle, Brad Hill is a Senior Security Consultant at iSEC Partners, a full-service security consulting firm that provides penetration testing, secure systems development, security education and software design verification. Brad brings a ten year background as a software developer and architect in the technology and financial services sectors to his work at iSEC, where he does design review, application assessment and development lifecycle improvement for some of the world’s leading software companies. <br />
<br/><br />
<br/><br />
<br/><br />
'''Development of a Security Metric System to Rate Enterprise Software'''<br/><br />
'''''Presented by: Fredrick Lee, Fortify Software'''''<br/><br />
<br />
'''Abstract:''' <br />
As part of Fortify Software’s Java Open Review (JOR) project, both security defects and quality issues discovered in open source software are collected. The projects being analyzed are diverse in their development methodologies, development stages, and application styles. The projects range from small utility packages (e.g. Apache Commons), to mid-size intranet applications (e.g. JSPWiki), to large-scale, commercial grade enterprise projects (e.g. JBoss). In essence, participants in the Java Open Review project reflect the typical enterprise organization’s code base: a large collection of several small utility/internal applications and a handful of enterprise “flagship” products.<br />
<br />
As part of the project, we have been challenged to answer the question: Which<br />
application is more “secure.” To answer this question, Fortify has sought to develop a set of metrics that combine lessons learned from our experience working on various enterprise code bases and our work on the JOR project. The metrics are designed to incorporate diverse criteria, including the size of the application, the types of vulnerabilities identified, and time required to fix the vulnerabilities. The metrics provide a mechanism to rate software components for security concerns and enable enterprises to:<br />
<br />
- Evaluate which open source projects offer an acceptable level of security <br/><br />
- Compare competing open source software solutions based on their security <br/><br />
- Measure internal development efforts against open source open source counterparts<br />
<br />
Ultimately, with sufficient industry adoption, the metrics can also enable enterprises to compare their internal efforts against other enterprises within the same vertical. As part of the talk we will present our experience to date working with companies to develop an effective mechanism for evaluating the security of enterprise software.<br />
<br />
'''Bio:''' Fredrick Lee is a member of Fortify Software’s Security Research Group, where he manages the Java Open Review Project. Scanning the code of over 100 applications so far, Fredrick is helping assess and improve the security of open source software. Fredrick also helps the Security Research Group develop the secure coding rules that are use to run Fortify’s suite of products. <br />
<br />
Prior to joining Fortify Software, Fredrick was a Senior Information Security Engineer at Bank of America, where he helped roll out a secure development framework, performed security assessments, and developed enterprise security solutions. <br />
<br />
Fredrick graduated from the University of Oklahoma, with a BS in Computer Engineering. <br />
<br />
<br/><br />
<br />
'''Upcoming Security Workshops'''<br/><br />
'''''Presented by: Brian Bertacini, Volunteer Chapter Organizer'''''<br/><br />
<br />
'''Abstract:''' Introduce local volunteer expert trainers that are planning web application and infrastructure security workshops.<br />
<br />
Please RSVP to via email [mailto:brian.bertacini@owasp.org Brian Bertacini], call 408-979-0571 or visit [http://owasp.mollyguard.com OWASP.Mollyguard.com]<br />
<br />
Special thanks to [http://www.ariba.com Ariba] for hosting this event and to [http://www.appsecconsulting.com AppSec Consulting] and [http://www.isecpartners.com iSEC Partners] for sponsoring.<br />
<br />
<br />
== Thursday, April 12, 2007 ==<br />
Open to the public, attendance is free<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and reception (food & bev)<br/><br />
6:30pm - 7:30pm ... Past, Present and Future of Web Application Security in PCI - Bernie Weidel<br/><br />
7:30pm - 8:30pm ... Top Web Application Vulnerabilities, Exploits and Countermeasures - Josh Daymont<br/><br />
<br />
'''Venue:'''<br/><br />
Ariba<br/><br />
807 11th Avenue<br/><br />
Sunnyvale, Ca 94089<br/><br />
[http://www.ariba.com/company/hq_map.cfm Map and Directions]<br/><br />
<br />
<br />
'''Past, Present and Future of Web Application Security in PCI'''<br/><br />
'''''Presented by: Bernie Weidel - PCI Product Manager, Qualys'''''<br/><br />
<br />
'''Abstract:''' <br />
This presentation will start off with a holistic view of Ecommerce Data Security in contrast to the overall scope of Fraud in the Financial Services Industry, thereby giving insights as to why the PCI DSS was created by the Credit Card Brands and developed into its current form. Next, we will explore the current state of Web Application Security in the PCI DSS v1.1 and attempt to bring clarity to some of the more confusing items. We will also outline the structure of the PCI DSS Council; reviewing its key concepts and requirements. Lastly, we will outline methods you can use to proactively get involved in shaping future versions of the PCI DSS.<br/><br />
<br />
'''Bio:''' Bernie Weidel, Product Manager for QualysGuard PCI is responsible for evaluating customer/partner requirements, integrating them into the product, and driving PCI to market. Bernie has been developing methods to achieve and evidence compliance since 2000, when he designed a HIPAA compliance program for Scarborough Insurance Agency. Prior to joining Qualys, Bernie was an Infrastructure Security Project Manager at Adobe Systems where he implemented, managed and streamlined SOX and PCI compliance programs. He was also responsible for various aspects of security such as Web Application Security, Database Security, PDA Security and Vulnerability Management. Before Adobe, Bernie worked for Symbol Wireless Technologies as a Wireless Systems Analyst; designing, installing and troubleshooting/fine tuning Enterprise Wireless Networks.<br />
<br/><br />
<br/><br />
<br/><br />
'''Top Web Application Vulnerabilities, Exploits and Countermeasures'''<br/><br />
'''''Presented by: Josh Daymont - Sr. Security Consultant, Fortify'''''<br/><br />
<br />
'''Abstract:''' <br />
This presentation will take a look at Web Application Security from the Front lines to the back offices of systems development. First, a look at the top vulnerabilities and how are they exploited. Then look beyond the front lines and explore countermeasures that can be implemented during the development process to protect applications and sensitive data after deployment.<br/><br />
<br />
<br />
<br />
<br />
'''About OWASP'''<br/><br />
'''''Presented by: Brian Bertacini, Volunteer chapter organizer'''''<br/><br />
<br />
'''Abstract:''' An overview of the Open Web Application Security Project (OWASP), current projects and feedback from the recent WebAppSec Conference in Seattle. <br />
<br />
Please RSVP to via email [mailto:brian.bertacini@owasp.org Brian Bertacini], call 408-979-0571 or visit [http://owasp.mollyguard.com OWASP.Mollyguard.com]<br />
<br />
Special thanks to [http://www.aribe.com Ariba] for hosting this event.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose_Archive&diff=21693San Jose Archive2007-09-12T15:46:48Z<p>Steingra: New page: ==Wednesday, July 25, 2007 == Open to the public, attendance is free '''Agenda and Presentations:'''<br/> 6:00pm - 6:30pm ... Check-in and reception (food & bev)<br/> 6:30pm - 7:15pm ... ...</p>
<hr />
<div>==Wednesday, July 25, 2007 ==<br />
Open to the public, attendance is free<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and reception (food & bev)<br/><br />
6:30pm - 7:15pm ... Attacking XML Security - Brad Hill<br/><br />
7:15pm - 8:00pm ... Development of a Security Metric System to Rate Enterprise Software - Fredrick Lee<br/><br />
8:00pm - 8:30pm ... Networking Session<br/><br />
<br />
'''Venue:'''<br/><br />
Ariba<br/><br />
807 11th Avenue<br/><br />
Sunnyvale, Ca 94089<br/><br />
[http://www.ariba.com/company/hq_map.cfm Map and Directions]<br/><br />
<br />
<br />
'''Attacking XML Security'''<br/><br />
'''''Presented by: Brad Hill, iSEC Partners'''''<br/><br />
<br />
'''Abstract:''' <br />
Brad will present his ongoing research into attacking the XML Digital Signature and Encryption standards that underpin the security of Web Services, mobile code, SAML, federated identity systems and more. The talk will begin with a high-level, critical take on the emerging conventional wisdom about message-oriented security and continue with a detailed discussion of design and implementation weaknesses in the standards. Technical material will include a root cause analysis of the recent iSEC advisory on cross-platform, remote code execution vulnerabilities discovered in multiple XML Digital Signature products. <br/><br />
<br />
[http://www.isecpartners.com/files/iSEC_HILL_AttackingXMLSecurity_bh07.pdf Presentation Link]<br/><br />
<br />
'''Bio:''' Based out of Seattle, Brad Hill is a Senior Security Consultant at iSEC Partners, a full-service security consulting firm that provides penetration testing, secure systems development, security education and software design verification. Brad brings a ten year background as a software developer and architect in the technology and financial services sectors to his work at iSEC, where he does design review, application assessment and development lifecycle improvement for some of the world’s leading software companies. <br />
<br/><br />
<br/><br />
<br/><br />
'''Development of a Security Metric System to Rate Enterprise Software'''<br/><br />
'''''Presented by: Fredrick Lee, Fortify Software'''''<br/><br />
<br />
'''Abstract:''' <br />
As part of Fortify Software’s Java Open Review (JOR) project, both security defects and quality issues discovered in open source software are collected. The projects being analyzed are diverse in their development methodologies, development stages, and application styles. The projects range from small utility packages (e.g. Apache Commons), to mid-size intranet applications (e.g. JSPWiki), to large-scale, commercial grade enterprise projects (e.g. JBoss). In essence, participants in the Java Open Review project reflect the typical enterprise organization’s code base: a large collection of several small utility/internal applications and a handful of enterprise “flagship” products.<br />
<br />
As part of the project, we have been challenged to answer the question: Which<br />
application is more “secure.” To answer this question, Fortify has sought to develop a set of metrics that combine lessons learned from our experience working on various enterprise code bases and our work on the JOR project. The metrics are designed to incorporate diverse criteria, including the size of the application, the types of vulnerabilities identified, and time required to fix the vulnerabilities. The metrics provide a mechanism to rate software components for security concerns and enable enterprises to:<br />
<br />
- Evaluate which open source projects offer an acceptable level of security <br/><br />
- Compare competing open source software solutions based on their security <br/><br />
- Measure internal development efforts against open source open source counterparts<br />
<br />
Ultimately, with sufficient industry adoption, the metrics can also enable enterprises to compare their internal efforts against other enterprises within the same vertical. As part of the talk we will present our experience to date working with companies to develop an effective mechanism for evaluating the security of enterprise software.<br />
<br />
'''Bio:''' Fredrick Lee is a member of Fortify Software’s Security Research Group, where he manages the Java Open Review Project. Scanning the code of over 100 applications so far, Fredrick is helping assess and improve the security of open source software. Fredrick also helps the Security Research Group develop the secure coding rules that are use to run Fortify’s suite of products. <br />
<br />
Prior to joining Fortify Software, Fredrick was a Senior Information Security Engineer at Bank of America, where he helped roll out a secure development framework, performed security assessments, and developed enterprise security solutions. <br />
<br />
Fredrick graduated from the University of Oklahoma, with a BS in Computer Engineering. <br />
<br />
<br/><br />
<br />
'''Upcoming Security Workshops'''<br/><br />
'''''Presented by: Brian Bertacini, Volunteer Chapter Organizer'''''<br/><br />
<br />
'''Abstract:''' Introduce local volunteer expert trainers that are planning web application and infrastructure security workshops.<br />
<br />
Please RSVP to via email [mailto:brian.bertacini@owasp.org Brian Bertacini], call 408-979-0571 or visit [http://owasp.mollyguard.com OWASP.Mollyguard.com]<br />
<br />
Special thanks to [http://www.ariba.com Ariba] for hosting this event and to [http://www.appsecconsulting.com AppSec Consulting] and [http://www.isecpartners.com iSEC Partners] for sponsoring.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21223San Jose2007-08-29T22:22:13Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
''Note:'' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/><br />
<br />
'''Workshop Instructors:'''<br/><br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
Arian Evans - WhiteHat Security<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anythingcan be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
Kurt Opsahl, EFF <br/><br />
<br />
<br />
Please RSVP at http://owaspday.eventbrite.com or send an email to brian.bertacini at owasp.org. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21199San Jose2007-08-28T21:51:14Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
''Note:'' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/><br />
<br />
'''Workshop Instructor:''' Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
Kurt Opsahl, EFF <br/><br />
<br />
<br />
Please RSVP at http://owaspday.eventbrite.com or send an email to brian.bertacini at owasp.org. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21106San Jose2007-08-24T18:31:06Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
''Note:'' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/><br />
<br />
'''Workshop Instructor:''' Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
<br />
Please RSVP at http://owaspday.eventbrite.com or send an email to brian.bertacini at owasp.org. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21105San Jose2007-08-24T18:30:40Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
''Map and Directions:''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
''Note:'' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/><br />
<br />
'''Workshop Instructor:''' <br/><br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
<br />
Please RSVP at http://owaspday.eventbrite.com or send an email to brian.bertacini at owasp.org. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21104San Jose2007-08-24T18:28:40Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
'''Map and Directions:'''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
'''Workshop Instructor:''' <br/><br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
Please RSVP at http://owaspday.eventbrite.com or send an email to brian.bertacini at owasp.org. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
'''Note:''' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21103San Jose2007-08-24T18:27:18Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
'''Map and Directions:'''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
'''Workshop Instructor:''' <br/><br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
Please RSVP at http://owaspday.eventbrite.com. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
'''Note:''' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21102San Jose2007-08-24T18:26:32Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br/><br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
'''Map and Directions:'''<br/><br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br/><br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br/><br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br/><br />
<br />
<br />
'''Workshop Instructor:''' <br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br/><br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br/><br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br/><br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
Please RSVP at http://owaspday.eventbrite.com. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
'''Note:''' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21101San Jose2007-08-24T18:25:16Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
Map and Directions: <br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br />
<br />
<br />
'''Workshop Instructor:''' <br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br />
<br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
<br />
'''Panelists:'''<br/><br />
<br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
Please RSVP at http://owaspday.eventbrite.com. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
'''Note:''' To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21100San Jose2007-08-24T18:24:36Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
Map and Directions: <br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br />
<br />
<br />
'''Workshop Instructor:''' <br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br />
<br />
'''Moderator:''' Alex Stamos, iSEC Partners<br/><br />
<br />
'''Panelists:'''<br/><br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
Please RSVP at http://owaspday.eventbrite.com. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
Note: To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21099San Jose2007-08-24T18:24:03Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
Map and Directions: <br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br />
<br />
<br />
'''Workshop Instructor:''' <br />
Siva Ram, CISA - Senior Consultant, AppSec Consulting<br/><br />
<br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br />
<br />
Moderator: Alex Stamos, iSEC Partners<br/><br />
<br />
Panelists:<br/><br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
Please RSVP at http://owaspday.eventbrite.com. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
Note: To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21098San Jose2007-08-24T18:22:24Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
Map and Directions: <br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br />
<br />
<br />
'''Workshop Instructor:'''<br />
<br />
Siva Ram, CISA<br/><br />
Senior Consultant, AppSec Consulting<br/><br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br />
<br />
Moderator: Alex Stamos, iSEC Partners<br/><br />
<br />
Panelists:<br/><br />
Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
Please RSVP at http://owaspday.eventbrite.com. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
Note: To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21097San Jose2007-08-24T18:21:36Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
Map and Directions: <br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br />
<br />
<br />
'''Workshop Instructor:'''<br />
<br />
Siva Ram, CISA<br/><br />
Senior Consultant, AppSec Consulting<br/><br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br />
<br />
Moderator: Alex Stamos, iSEC Partners<br/><br />
Panelists: Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br/><br />
David Pollino, Washington Mutual Bank<br/><br />
Robert Fly, Salesforce.com<br/><br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br/><br />
<br />
Please RSVP at http://owaspday.eventbrite.com. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
Note: To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=21096San Jose2007-08-24T18:20:23Z<p>Steingra: /* Next Meeting - Thursday, September 6, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, September 6, 2007 ==<br />
Open to the public, attendance is free<br/><br />
<br />
'''Agenda and Presentations:'''<br/><br />
5:00pm – 5:30pm Check-in and Reception (food and beverages)<br/><br />
5:30pm – 6:45pm Malicious Code Injection Workshop<br/><br />
6:45pm – 6:55pm Break<br/><br />
6:55pm – 8:10pm Panel Discussion – Privacy, Security and Breaches, Oh My!<br/><br />
8:10pm – 8:30pm Networking Session<br/><br />
<br />
<br />
'''Venue:'''<br />
eBay - Town Square B<br/><br />
2161 North First Street<br/><br />
San Jose, CA 95131<br/><br />
<br />
Map and Directions: <br />
[http://maps.yahoo.com/broadband#mvt=m&q1=2211+N+1st+Street%2C+San+Jose%2C+CA&trf=0&lon=-121.921484&lat=37.377166&mag=3 Map]<br/><br />
<br />
<br />
'''Malicious Code Injection Workshop'''<br />
<br />
SQL Injection, Cross-site Scripting (XSS) and other injection attacks techniques have become pervasive on the web. This hands-on workshop takes an in-depth look at common methods used to exploit web applications. Attendees will learn step-by-step techniques used by attackers allowing them to better understand how web applications are exploited. Each attack method is followed up with a discussion about effective countermeasures to defend against such attacks. <br />
<br />
This interactive workshop includes a victim web application that contains built-in vulnerabilities. Attendees can bring their own laptop computers and participate in hands-on lab sessions. The objective of this workshop is to learn secure development practices used to harden the security of applications. Attendee participation is encouraged and door prizes will be awarded at random. <br />
<br />
<br />
'''Workshop Instructor:'''<br />
<br />
Siva Ram, CISA<br/><br />
Senior Consultant, AppSec Consulting<br/><br />
<br />
'''Panel Discussion: “Privacy, Security and Breaches, Oh My!” '''<br />
<br />
This panel discussion will review the current state of information privacy and the security of web applications. Security breaches are occurring at an alarming rate and consumers are loosing faith. What, if anything can be done to restore confidence in e-commerce?<br />
<br />
What can we learn from events at Card Systems are more recently Monster.com? What can be done to ensure your company is not the next victim of a class action and/or hackers and data thieves? Join an all-star panel of Information Privacy and Data Security professionals to better understand what’s at stake and how to stay out of the headlines. <br />
<br />
Moderator: Alex Stamos, iSEC Partners<br />
Panelists: Doran Rotman, KPMG (co-author, Generally Accepted Privacy Principles<br />
David Pollino, Washington Mutual Bank<br />
Robert Fly, Salesforce.com<br />
Larry Pingree, Safeway (co-founder, Digital Forensics Association)<br />
<br />
Please RSVP at http://owaspday.eventbrite.com. Feel free to invite like minded IT Security Professionals and help grow OWASP.<br/> <br />
<br />
Note: To participate in the exercise bring an 802.11b/g equipped laptop with IE or Firefox installed. No hostile code will be put on your laptop by the instructors, but do have a firewall running to protect yourself. No wired connection to the class network will be provided.<br/></div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=20591San Jose2007-08-03T18:23:37Z<p>Steingra: /* Next Meeting - Wednesday, July 25, 2007 */</p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Wednesday, July 25, 2007 ==<br />
Open to the public, attendance is free<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and reception (food & bev)<br/><br />
6:30pm - 7:15pm ... Attacking XML Security - Brad Hill<br/><br />
7:15pm - 8:00pm ... Development of a Security Metric System to Rate Enterprise Software - Fredrick Lee<br/><br />
8:00pm - 8:30pm ... Networking Session<br/><br />
<br />
'''Venue:'''<br/><br />
Ariba<br/><br />
807 11th Avenue<br/><br />
Sunnyvale, Ca 94089<br/><br />
[http://www.ariba.com/company/hq_map.cfm Map and Directions]<br/><br />
<br />
<br />
'''Attacking XML Security'''<br/><br />
'''''Presented by: Brad Hill, iSEC Partners'''''<br/><br />
<br />
'''Abstract:''' <br />
Brad will present his ongoing research into attacking the XML Digital Signature and Encryption standards that underpin the security of Web Services, mobile code, SAML, federated identity systems and more. The talk will begin with a high-level, critical take on the emerging conventional wisdom about message-oriented security and continue with a detailed discussion of design and implementation weaknesses in the standards. Technical material will include a root cause analysis of the recent iSEC advisory on cross-platform, remote code execution vulnerabilities discovered in multiple XML Digital Signature products. <br/><br />
<br />
[http://www.isecpartners.com/files/iSEC_HILL_AttackingXMLSecurity_bh07.pdf Presentation Link]<br/><br />
<br />
'''Bio:''' Based out of Seattle, Brad Hill is a Senior Security Consultant at iSEC Partners, a full-service security consulting firm that provides penetration testing, secure systems development, security education and software design verification. Brad brings a ten year background as a software developer and architect in the technology and financial services sectors to his work at iSEC, where he does design review, application assessment and development lifecycle improvement for some of the world’s leading software companies. <br />
<br/><br />
<br/><br />
<br/><br />
'''Development of a Security Metric System to Rate Enterprise Software'''<br/><br />
'''''Presented by: Fredrick Lee, Fortify Software'''''<br/><br />
<br />
'''Abstract:''' <br />
As part of Fortify Software’s Java Open Review (JOR) project, both security defects and quality issues discovered in open source software are collected. The projects being analyzed are diverse in their development methodologies, development stages, and application styles. The projects range from small utility packages (e.g. Apache Commons), to mid-size intranet applications (e.g. JSPWiki), to large-scale, commercial grade enterprise projects (e.g. JBoss). In essence, participants in the Java Open Review project reflect the typical enterprise organization’s code base: a large collection of several small utility/internal applications and a handful of enterprise “flagship” products.<br />
<br />
As part of the project, we have been challenged to answer the question: Which<br />
application is more “secure.” To answer this question, Fortify has sought to develop a set of metrics that combine lessons learned from our experience working on various enterprise code bases and our work on the JOR project. The metrics are designed to incorporate diverse criteria, including the size of the application, the types of vulnerabilities identified, and time required to fix the vulnerabilities. The metrics provide a mechanism to rate software components for security concerns and enable enterprises to:<br />
<br />
- Evaluate which open source projects offer an acceptable level of security <br/><br />
- Compare competing open source software solutions based on their security <br/><br />
- Measure internal development efforts against open source open source counterparts<br />
<br />
Ultimately, with sufficient industry adoption, the metrics can also enable enterprises to compare their internal efforts against other enterprises within the same vertical. As part of the talk we will present our experience to date working with companies to develop an effective mechanism for evaluating the security of enterprise software.<br />
<br />
'''Bio:''' Fredrick Lee is a member of Fortify Software’s Security Research Group, where he manages the Java Open Review Project. Scanning the code of over 100 applications so far, Fredrick is helping assess and improve the security of open source software. Fredrick also helps the Security Research Group develop the secure coding rules that are use to run Fortify’s suite of products. <br />
<br />
Prior to joining Fortify Software, Fredrick was a Senior Information Security Engineer at Bank of America, where he helped roll out a secure development framework, performed security assessments, and developed enterprise security solutions. <br />
<br />
Fredrick graduated from the University of Oklahoma, with a BS in Computer Engineering. <br />
<br />
<br/><br />
<br />
'''Upcoming Security Workshops'''<br/><br />
'''''Presented by: Brian Bertacini, Volunteer Chapter Organizer'''''<br/><br />
<br />
'''Abstract:''' Introduce local volunteer expert trainers that are planning web application and infrastructure security workshops.<br />
<br />
Please RSVP to via email [mailto:brian.bertacini@owasp.org Brian Bertacini], call 408-979-0571 or visit [http://owasp.mollyguard.com OWASP.Mollyguard.com]<br />
<br />
Special thanks to [http://www.ariba.com Ariba] for hosting this event and to [http://www.appsecconsulting.com AppSec Consulting] and [http://www.isecpartners.com iSEC Partners] for sponsoring.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=17628San Jose2007-04-02T03:54:08Z<p>Steingra: </p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, April 12, 2007 ==<br />
Open to the public, attendance is free<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and reception (food & bev)<br/><br />
6:30pm - 7:30pm ... Past, Present and Future of Web Application Security in PCI - Bernie Weidel<br/><br />
7:30pm - 8:30pm ... Top Web Application Vulnerabilities, Exploits and Countermeasures - Josh Daymont<br/><br />
<br />
'''Venue:'''<br/><br />
Ariba<br/><br />
807 11th Avenue<br/><br />
Sunnyvale, Ca 94089<br/><br />
[http://www.ariba.com/company/hq_map.cfm Map and Directions]<br/><br />
<br />
<br />
'''Past, Present and Future of Web Application Security in PCI'''<br/><br />
'''''Presented by: Bernie Weidel - PCI Product Manager, Qualys'''''<br/><br />
<br />
'''Abstract:''' <br />
This presentation will start off with a holistic view of Ecommerce Data Security in contrast to the overall scope of Fraud in the Financial Services Industry, thereby giving insights as to why the PCI DSS was created by the Credit Card Brands and developed into its current form. Next, we will explore the current state of Web Application Security in the PCI DSS v1.1 and attempt to bring clarity to some of the more confusing items. We will also outline the structure of the PCI DSS Council; reviewing its key concepts and requirements. Lastly, we will outline methods you can use to proactively get involved in shaping future versions of the PCI DSS.<br/><br />
<br />
'''Bio:''' Bernie Weidel, Product Manager for QualysGuard PCI is responsible for evaluating customer/partner requirements, integrating them into the product, and driving PCI to market. Bernie has been developing methods to achieve and evidence compliance since 2000, when he designed a HIPAA compliance program for Scarborough Insurance Agency. Prior to joining Qualys, Bernie was an Infrastructure Security Project Manager at Adobe Systems where he implemented, managed and streamlined SOX and PCI compliance programs. He was also responsible for various aspects of security such as Web Application Security, Database Security, PDA Security and Vulnerability Management. Before Adobe, Bernie worked for Symbol Wireless Technologies as a Wireless Systems Analyst; designing, installing and troubleshooting/fine tuning Enterprise Wireless Networks.<br />
<br/><br />
<br/><br />
<br/><br />
'''Top Web Application Vulnerabilities, Exploits and Countermeasures'''<br/><br />
'''''Presented by: Josh Daymont - Sr. Security Consultant, Fortify'''''<br/><br />
<br />
'''Abstract:''' <br />
This presentation will take a look at Web Application Security from the Front lines to the back offices of systems development. First, a look at the top vulnerabilities and how are they exploited. Then look beyond the front lines and explore countermeasures that can be implemented during the development process to protect applications and sensitive data after deployment.<br/><br />
<br />
<br />
<br />
<br />
'''About OWASP'''<br/><br />
'''''Presented by: Brian Bertacini, Volunteer chapter organizer'''''<br/><br />
<br />
'''Abstract:''' An overview of the Open Web Application Security Project (OWASP), current projects and feedback from the recent WebAppSec Conference in Seattle. <br />
<br />
Please RSVP to via email [mailto:brian.bertacini@owasp.org Brian Bertacini], call 408-979-0571 or visit [http://owasp.mollyguard.com OWASP.Mollyguard.com]<br />
<br />
Special thanks to [http://www.aribe.com Ariba] for hosting this event.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose&diff=17627San Jose2007-04-02T03:52:57Z<p>Steingra: </p>
<hr />
<div>{{Chapter Template|chaptername=San Jose|extra=The chapter leader is [mailto:brian.bertacini@owasp.org Brian Bertacini]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-sanjose|emailarchives=http://lists.owasp.org/pipermail/owasp-sanjose}}<br />
<br />
== Next Meeting - Thursday, April 12, 2007 ==<br />
Open to the public, attendance is free<br />
<br />
'''Agenda and Presentations:'''<br/><br />
6:00pm - 6:30pm ... Check-in and reception (food & bev)<br/><br />
6:30pm - 7:30pm ... Past, Present and Future of Web Application Security in PCI - Bernie Weidel<br/><br />
7:30pm - 8:30pm ... Top Web Application Vulnerabilities, Exploits and Countermeasures - Josh Daymont<br/><br />
<br />
'''Venue:'''<br/><br />
Ariba<br/><br />
807 11th Avenue<br/><br />
Sunnyvale, Ca 94089<br/><br />
[http://www.ariba.com/company/hq_map.cfm Map and Directions]<br/><br />
<br />
<br />
'''Past, Present and Future of Web Application Security in PCI'''<br/><br />
'''''Presented by: Bernie Weidel - PCI Product Manager, Qualys'''''<br/><br />
<br />
'''Abstract:''' <br />
This presentation will start off with a holistic view of Ecommerce Data Security in contrast to the overall scope of Fraud in the Financial Services Industry, thereby giving insights as to why the PCI DSS was created by the Credit Card Brands and developed into its current form. Next, we will explore the current state of Web Application Security in the PCI DSS v1.1 and attempt to bring clarity to some of the more confusing items. We will also outline the structure of the PCI DSS Council; reviewing its key concepts and requirements. Lastly, we will outline methods you can use to proactively get involved in shaping future versions of the PCI DSS.<br/><br />
<br />
'''Bio:''' Bernie Weidel, Product Manager for QualysGuard PCI is responsible for evaluating customer/partner requirements, integrating them into the product, and driving PCI to market. Bernie has been developing methods to achieve and evidence compliance since 2000, when he designed a HIPAA compliance program for Scarborough Insurance Agency. Prior to joining Qualys, Bernie was an Infrastructure Security Project Manager at Adobe Systems where he implemented, managed and streamlined SOX and PCI compliance programs. He was also responsible for various aspects of security such as Web Application Security, Database Security, PDA Security and Vulnerability Management. Before Adobe, Bernie worked for Symbol Wireless Technologies as a Wireless Systems Analyst; designing, installing and troubleshooting/fine tuning Enterprise Wireless Networks.<br />
<br/><br />
<br/><br />
<br/><br />
'''Top Web Application Vulnerabilities, Exploits and Countermeasures'''<br/><br />
'''''Presented by: Josh Daymont - Sr. Security Consultant, Fortify'''''<br/><br />
<br />
'''Abstract:''' <br />
This presentation will take a look at Web Application Security from the Front lines to the back offices of systems development. First, a look at the top vulnerabilities and how are they exploited. Then look beyond the front lines and explore countermeasures that can be implemented during the development process to protect applications and sensitive data after deployment.<br/><br />
<br />
<br />
<br />
<br />
'''About OWASP'''<br/><br />
'''''Presented by: Brian Bertacini, Volunteer chapter organizer'''''<br/><br />
<br />
'''Abstract:''' An overview of the Open Web Application Security Project (OWASP), current projects and feedback from the recent WebAppSec Conference in Seattle. <br />
<br />
Please RSVP to via email [mailto:brian.bertacini@owasp.org Brian Bertacini], call 408-979-0571 or visit [http://owasp.mollyguard.com OWASP.Mollyguard.com]<br />
<br />
Special thanks to [http://www.fsba.com Fujitsu Advanced Networking Solutions] for hosting this event.</div>Steingrahttps://wiki.owasp.org/index.php?title=San_Jose-Archive&diff=17624San Jose-Archive2007-04-02T03:34:59Z<p>Steingra: New page: == Meeting - Tuesday, December 19, 2006 == '''Venue:'''<br/> Fujitsu Advanced Networking Solutions<br/> 1240 E. Arques Ave.<br/> Sunnyvale, CA 94085<br/> '''New Trends and Web Applicati...</p>
<hr />
<div>== Meeting - Tuesday, December 19, 2006 ==<br />
<br />
'''Venue:'''<br/><br />
Fujitsu Advanced Networking Solutions<br/><br />
1240 E. Arques Ave.<br/><br />
Sunnyvale, CA 94085<br/><br />
<br />
<br />
'''New Trends and Web Application Security Statistics'''<br/><br />
'''''Presented by: Jeremiah Grossman, Founder & CTO, WhiteHat Security'''''<br/><br />
<br />
'''Abstract:''' First Look at New Web Application Security Statistics. The Top 10 Web Application Vulnerabilities and their Impact on the Enterprise Web applications are the newest attack target, hitting the biggest and best brands on the Internet. And yet, until now, there has been limited information available about the most prevalent and most severe vulnerabilities that are facilitating the rapidly rising number of attacks.<br />
<br />
WhiteHat Security founder and CTO, Jeremiah Grossman, will present the findings from the first WhiteHat Security Web Application Security Risk Report. Based on WhiteHat’s aggregate data from hundreds of web application assessments, Mr.Grossman's presentation will provide a first-of-its-kind look at the top vulnerabilities that attackers are exploiting at businesses across the Web.<br />
<br/><br />
• Identify and discuss the top ten vulnerabilities <br/><br />
• Define the severity levels of web application vulnerabilities <br/><br />
• Present strategies for web application vulnerability management <br/><br />
<br />
'''Bio:''' Mr. Grossman is a world-renowned expert in Web security and a founding member of the Web Application Security Consortium. He is a frequent speaker at industry events including the BlackHat Briefings, ISACA’s Networks Security Conference, NASA, the Air Force and Technology Conference, ISSA and Defcon. Mr. Grossman is also a featured expert and frequent contributor on TechTarget’s SearchAppSecurity.com.<br />
<br />
<br/></div>Steingra