OWASP - User contributions [en]

Scotland

2020-01-15T21:37:56Z

Swright75: Added February's event details

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''PwC '''for hosting our upcoming February 2020 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

=== '''Tuesday, 11 February 2020''' ===
'''Time''': 18:00 - 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-2020-tickets-90016877905

=== Description ===
We are pleased to announce that the first OWASP Scotland Chapter meeting of 2020 will take place on Tuesday the 11th of Feb. Many thanks to PwC, who has kindly offered to host this event for us. They will also be providing pizza and refreshments on the evening.

For attending this event you will be able to claim 2 CPE points.
=== '''Security Culture and Behaviour - security is still often seen as a technology problem''' ===
'''Speaker''': Louise MacDougall

This presentation will focus on the culture and behaviours surrounding cyber security and explore the 'People layer' of defence. Louise will discuss how organisations should be approaching cyber security leadership and how they can drive the right security behaviours within their staff. Particular focus will be on the role of senior leadership and behavioural models that can be applied to cyber security.

=== TBD ===
'''Speaker''': TBD

TBD

== Past Events ==

=== '''Thursday, 21 November 2019''' ===
'''Time''': 18:00 - 20:00 BST

'''Location''': Deloitte Offices, Saltire Court, 20 Castle Terrace, Edinburgh, EH1 2DB

Tickets: Tickets are available on eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-november-tickets-78186324401

=== Description ===
The final OWASP Scotland Chapter meeting of 2019 will take place on Thursday the 21st of November. Many thanks to Deloitte, who has kindly offered to host this event for us. They will also be providing pizza and refreshments on the evening.

We have two great talks lined up for the OWASP Scotland community with Rob McElvanney on "Red Teaming: Simply the BEST" and Colin Cassidy giving us an insight into the "Adventures in the wacky world of control systems".

For attending this event you will be able to claim 2 CPE points.

=== Red Teaming: Simply the BEST ===
'''Speaker''': Rob McElvanney, Deloitte

Using examples of real world attacks, Associate Director Rob McElvanney will discuss lessons learned from recent Red Team exercises, particularly within the CBEST and GBEST frameworks. This session will illustrate some of the methods used by advanced actors to achieve access, allowing them a foothold for lateral movement and privilege escalation. The session will also explore how organisations can improve their chances of defending against such adversaries.

=== Adventures in the wacky world of control systems ===
'''Speaker''': Colin Cassidy

This talk is a grab bag of different ICS topics to give people a flavours of the challenges being faced. The focus will be primarily on the energy industry, but other ICS and critical infrastructure faces similar issues. We will briefly discuss control system changes over time, what caused those changes, what improvements (or not) that they brought. We will cover some real life findings and thoughts from the field, this will include some odd findings, commonly seen issues, and how mistakes can cause surprisingly kinetic problems!

More positively there are solutions and improvements, but a one-size-fits-all solution does not tend to work, even when dealing with very similar sites.

Bio: Colin Cassidy (@parttimesecguy) used to be a software engineer at GE for 15 years working on their Distribution Management System (DMS). He is currently atoning for all his software development sin as a senior security consultant with IOActive. Colin has performed a number of security audits for ICS operators including one of the UKs largest Distribution Network Operators, several windfarms, container ships, shipping terminals, and AMI/smart meter infrastructure. Colin has also presented and Blackhat and Defcon on vulnerabilities found in Industrial Ethernet Switches. In his spare time, he searches for spare time.

=== Thursday, 12 September 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': Ernst & Young, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-september-tickets-66503743487)

==== Weaknesses in Software Supply Chains ====
'''Speaker''': Sean Wright

Software development today is a far cry from software development from yesteryear. Gone are the days of developing something from the ground up. Software development now involves “stitching together” numerous libraries and frameworks together to develop the desired system/application. We are now dependent on 3rd party vendors and providers now, more than ever before. This has greatly help to aid the generation of rapid development. However, this helped to introduce a new, and often overlooked problem, weakness introduced by these libraries. Why would an attacker spend significant effort and time trying to break through the front door of an organisation, when they can instead open a backdoor for themselves?

The purpose of this talk is to raise awareness for the potential problem, with some recommendations of tools and approaches which could help. Discussing past examples where backdoors have been placed into libraries, as well as discussing some of the difficulties to keeping libraries up to date.

==== EY Global Information Security Survey Results ====
'''Speaker''': Shriparna Ghosh

EY runs a Global Information Security Survey (GISS) every year. Responses were collected from over 60 countries representing all industry sectors with more than 1400 participants.

After a year in which organisations have been rocked by a series of large-scale cybersecurity breaches and ongoing recriminations over state-sponsored interventions, EY’s Global Information Security Survey shows which areas were the key areas of focus or areas of investment for various sectors. It also outlines the top trends in the cyber world from a global perspective.

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-59785884189)

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-10-24T19:55:53Z

Swright75: /* Acknowledgements */

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''Delloite''' for hosting our upcoming November 2019 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

=== '''Thursday, 21 November 2019''' ===
'''Time''': 18:00 - 20:00 BST

'''Location''': Deloitte Offices, Saltire Court, 20 Castle Terrace, Edinburgh, EH1 2DB

Tickets: Tickets are available on eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-november-tickets-78186324401

=== Description ===
The final OWASP Scotland Chapter meeting of 2019 will take place on Thursday the 21st of November. Many thanks to Deloitte, who has kindly offered to host this event for us. They will also be providing pizza and refreshments on the evening.

We have two great talks lined up for the OWASP Scotland community with Rob McElvanney on "Red Teaming: Simply the BEST" and Colin Cassidy giving us an insight into the "Adventures in the wacky world of control systems".

For attending this event you will be able to claim 2 CPE points.

=== Red Teaming: Simply the BEST ===
'''Speaker''': Rob McElvanney, Deloitte

Using examples of real world attacks, Associate Director Rob McElvanney will discuss lessons learned from recent Red Team exercises, particularly within the CBEST and GBEST frameworks. This session will illustrate some of the methods used by advanced actors to achieve access, allowing them a foothold for lateral movement and privilege escalation. The session will also explore how organisations can improve their chances of defending against such adversaries.

=== Adventures in the wacky world of control systems ===
'''Speaker''': Colin Cassidy

This talk is a grab bag of different ICS topics to give people a flavours of the challenges being faced. The focus will be primarily on the energy industry, but other ICS and critical infrastructure faces similar issues. We will briefly discuss control system changes over time, what caused those changes, what improvements (or not) that they brought. We will cover some real life findings and thoughts from the field, this will include some odd findings, commonly seen issues, and how mistakes can cause surprisingly kinetic problems!

More positively there are solutions and improvements, but a one-size-fits-all solution does not tend to work, even when dealing with very similar sites.

Bio: Colin Cassidy (@parttimesecguy) used to be a software engineer at GE for 15 years working on their Distribution Management System (DMS). He is currently atoning for all his software development sin as a senior security consultant with IOActive. Colin has performed a number of security audits for ICS operators including one of the UKs largest Distribution Network Operators, several windfarms, container ships, shipping terminals, and AMI/smart meter infrastructure. Colin has also presented and Blackhat and Defcon on vulnerabilities found in Industrial Ethernet Switches. In his spare time, he searches for spare time.

== Past Events ==

=== Thursday, 12 September 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': Ernst & Young, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-september-tickets-66503743487)

==== Weaknesses in Software Supply Chains ====
'''Speaker''': Sean Wright

Software development today is a far cry from software development from yesteryear. Gone are the days of developing something from the ground up. Software development now involves “stitching together” numerous libraries and frameworks together to develop the desired system/application. We are now dependent on 3rd party vendors and providers now, more than ever before. This has greatly help to aid the generation of rapid development. However, this helped to introduce a new, and often overlooked problem, weakness introduced by these libraries. Why would an attacker spend significant effort and time trying to break through the front door of an organisation, when they can instead open a backdoor for themselves?

The purpose of this talk is to raise awareness for the potential problem, with some recommendations of tools and approaches which could help. Discussing past examples where backdoors have been placed into libraries, as well as discussing some of the difficulties to keeping libraries up to date.

==== EY Global Information Security Survey Results ====
'''Speaker''': Shriparna Ghosh

EY runs a Global Information Security Survey (GISS) every year. Responses were collected from over 60 countries representing all industry sectors with more than 1400 participants.

After a year in which organisations have been rocked by a series of large-scale cybersecurity breaches and ongoing recriminations over state-sponsored interventions, EY’s Global Information Security Survey shows which areas were the key areas of focus or areas of investment for various sectors. It also outlines the top trends in the cyber world from a global perspective.

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-59785884189)

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-10-24T19:51:28Z

Swright75: November event added

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''Ernst & Young''' for hosting our upcoming September 2019 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

=== '''Thursday, 21 November 2019''' ===
'''Time''': 18:00 - 20:00 BST

'''Location''': Deloitte Offices, Saltire Court, 20 Castle Terrace, Edinburgh, EH1 2DB

Tickets: Tickets are available on eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-november-tickets-78186324401

=== Description ===
The final OWASP Scotland Chapter meeting of 2019 will take place on Thursday the 21st of November. Many thanks to Deloitte, who has kindly offered to host this event for us. They will also be providing pizza and refreshments on the evening.

We have two great talks lined up for the OWASP Scotland community with Rob McElvanney on "Red Teaming: Simply the BEST" and Colin Cassidy giving us an insight into the "Adventures in the wacky world of control systems".

For attending this event you will be able to claim 2 CPE points.

=== Red Teaming: Simply the BEST ===
'''Speaker''': Rob McElvanney, Deloitte

Using examples of real world attacks, Associate Director Rob McElvanney will discuss lessons learned from recent Red Team exercises, particularly within the CBEST and GBEST frameworks. This session will illustrate some of the methods used by advanced actors to achieve access, allowing them a foothold for lateral movement and privilege escalation. The session will also explore how organisations can improve their chances of defending against such adversaries.

=== Adventures in the wacky world of control systems ===
'''Speaker''': Colin Cassidy

This talk is a grab bag of different ICS topics to give people a flavours of the challenges being faced. The focus will be primarily on the energy industry, but other ICS and critical infrastructure faces similar issues. We will briefly discuss control system changes over time, what caused those changes, what improvements (or not) that they brought. We will cover some real life findings and thoughts from the field, this will include some odd findings, commonly seen issues, and how mistakes can cause surprisingly kinetic problems!

More positively there are solutions and improvements, but a one-size-fits-all solution does not tend to work, even when dealing with very similar sites.

Bio: Colin Cassidy (@parttimesecguy) used to be a software engineer at GE for 15 years working on their Distribution Management System (DMS). He is currently atoning for all his software development sin as a senior security consultant with IOActive. Colin has performed a number of security audits for ICS operators including one of the UKs largest Distribution Network Operators, several windfarms, container ships, shipping terminals, and AMI/smart meter infrastructure. Colin has also presented and Blackhat and Defcon on vulnerabilities found in Industrial Ethernet Switches. In his spare time, he searches for spare time.

== Past Events ==

=== Thursday, 12 September 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': Ernst & Young, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-september-tickets-66503743487)

==== Weaknesses in Software Supply Chains ====
'''Speaker''': Sean Wright

Software development today is a far cry from software development from yesteryear. Gone are the days of developing something from the ground up. Software development now involves “stitching together” numerous libraries and frameworks together to develop the desired system/application. We are now dependent on 3rd party vendors and providers now, more than ever before. This has greatly help to aid the generation of rapid development. However, this helped to introduce a new, and often overlooked problem, weakness introduced by these libraries. Why would an attacker spend significant effort and time trying to break through the front door of an organisation, when they can instead open a backdoor for themselves?

The purpose of this talk is to raise awareness for the potential problem, with some recommendations of tools and approaches which could help. Discussing past examples where backdoors have been placed into libraries, as well as discussing some of the difficulties to keeping libraries up to date.

==== EY Global Information Security Survey Results ====
'''Speaker''': Shriparna Ghosh

EY runs a Global Information Security Survey (GISS) every year. Responses were collected from over 60 countries representing all industry sectors with more than 1400 participants.

After a year in which organisations have been rocked by a series of large-scale cybersecurity breaches and ongoing recriminations over state-sponsored interventions, EY’s Global Information Security Survey shows which areas were the key areas of focus or areas of investment for various sectors. It also outlines the top trends in the cyber world from a global perspective.

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-59785884189)

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-09-19T16:45:29Z

Swright75: /* Past Events */

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''Ernst & Young''' for hosting our upcoming September 2019 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

== Past Events ==

=== Thursday, 12 September 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': Ernst & Young, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-september-tickets-66503743487)

==== Weaknesses in Software Supply Chains ====
'''Speaker''': Sean Wright

Software development today is a far cry from software development from yesteryear. Gone are the days of developing something from the ground up. Software development now involves “stitching together” numerous libraries and frameworks together to develop the desired system/application. We are now dependent on 3rd party vendors and providers now, more than ever before. This has greatly help to aid the generation of rapid development. However, this helped to introduce a new, and often overlooked problem, weakness introduced by these libraries. Why would an attacker spend significant effort and time trying to break through the front door of an organisation, when they can instead open a backdoor for themselves?

The purpose of this talk is to raise awareness for the potential problem, with some recommendations of tools and approaches which could help. Discussing past examples where backdoors have been placed into libraries, as well as discussing some of the difficulties to keeping libraries up to date.

==== EY Global Information Security Survey Results ====
'''Speaker''': Shriparna Ghosh

EY runs a Global Information Security Survey (GISS) every year. Responses were collected from over 60 countries representing all industry sectors with more than 1400 participants.

After a year in which organisations have been rocked by a series of large-scale cybersecurity breaches and ongoing recriminations over state-sponsored interventions, EY’s Global Information Security Survey shows which areas were the key areas of focus or areas of investment for various sectors. It also outlines the top trends in the cyber world from a global perspective.

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-59785884189)

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-08-29T18:32:25Z

Swright75: Added details about second speaker.

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''Ernst & Young''' for hosting our upcoming September 2019 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

=== Thursday, 12 September 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': Ernst & Young, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-september-tickets-66503743487)

==== Weaknesses in Software Supply Chains ====
'''Speaker''': Sean Wright

Software development today is a far cry from software development from yesteryear. Gone are the days of developing something from the ground up. Software development now involves “stitching together” numerous libraries and frameworks together to develop the desired system/application. We are now dependent on 3rd party vendors and providers now, more than ever before. This has greatly help to aid the generation of rapid development. However, this helped to introduce a new, and often overlooked problem, weakness introduced by these libraries. Why would an attacker spend significant effort and time trying to break through the front door of an organisation, when they can instead open a backdoor for themselves?

The purpose of this talk is to raise awareness for the potential problem, with some recommendations of tools and approaches which could help. Discussing past examples where backdoors have been placed into libraries, as well as discussing some of the difficulties to keeping libraries up to date.

==== EY Global Information Security Survey Results ====
'''Speaker''': Shriparna Ghosh

EY runs a Global Information Security Survey (GISS) every year. Responses were collected from over 60 countries representing all industry sectors with more than 1400 participants.

After a year in which organisations have been rocked by a series of large-scale cybersecurity breaches and ongoing recriminations over state-sponsored interventions, EY’s Global Information Security Survey shows which areas were the key areas of focus or areas of investment for various sectors. It also outlines the top trends in the cyber world from a global perspective.

== Past Events ==

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-59785884189)

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-07-26T10:34:31Z

Swright75: /* Acknowledgements */

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''Ernst & Young''' for hosting our upcoming September 2019 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

=== Thursday, 12 September 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': Ernst & Young, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-september-tickets-66503743487)

==== Weaknesses in Software Supply Chains ====
'''Speaker''': Sean Wright

Software development today is a far cry from software development from yesteryear. Gone are the days of developing something from the ground up. Software development now involves “stitching together” numerous libraries and frameworks together to develop the desired system/application. We are now dependent on 3rd party vendors and providers now, more than ever before. This has greatly help to aid the generation of rapid development. However, this helped to introduce a new, and often overlooked problem, weakness introduced by these libraries. Why would an attacker spend significant effort and time trying to break through the front door of an organisation, when they can instead open a backdoor for themselves?

The purpose of this talk is to raise awareness for the potential problem, with some recommendations of tools and approaches which could help. Discussing past examples where backdoors have been placed into libraries, as well as discussing some of the difficulties to keeping libraries up to date.

==== TBD ====
'''Speaker''': TBD

TBD.

== Past Events ==

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-59785884189)

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-07-26T10:17:05Z

Swright75: Added September event.

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''FanDuel''' for hosting our upcoming February 2019 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

=== Thursday, 12 September 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': Ernst & Young, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-september-tickets-66503743487)

==== Weaknesses in Software Supply Chains ====
'''Speaker''': Sean Wright

Software development today is a far cry from software development from yesteryear. Gone are the days of developing something from the ground up. Software development now involves “stitching together” numerous libraries and frameworks together to develop the desired system/application. We are now dependent on 3rd party vendors and providers now, more than ever before. This has greatly help to aid the generation of rapid development. However, this helped to introduce a new, and often overlooked problem, weakness introduced by these libraries. Why would an attacker spend significant effort and time trying to break through the front door of an organisation, when they can instead open a backdoor for themselves?

The purpose of this talk is to raise awareness for the potential problem, with some recommendations of tools and approaches which could help. Discussing past examples where backdoors have been placed into libraries, as well as discussing some of the difficulties to keeping libraries up to date.

==== TBD ====
'''Speaker''': TBD

TBD.

== Past Events ==

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-59785884189)

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-04-25T10:18:47Z

Swright75: Added ticket details.

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''FanDuel''' for hosting our upcoming February 2019 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

'''Tickets''': Tickets are available on EventBrite (https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-59785884189)

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

== Past Events ==

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-04-02T21:09:47Z

Swright75: Added May event

{{Chapter Template|chaptername=Scotland|extra=The chapter leaders are [mailto:sean.wright@owasp.org Sean Wright] and [mailto:rob.jansson@owasp.org Rob Jansson].
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-scotland|emailarchives=http://lists.owasp.org/pipermail/owasp-scotland}}

== Local News ==

Best way to keep up to date with meet-ups and the like is subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter OWASP Scotland Google Group].

You can also now follow us on [https://twitter.com/OWASPScotland Twitter (@OWASPScotland)].

== Acknowledgements ==
A big thank you to '''FanDuel''' for hosting our upcoming February 2019 event. As well as providing the beer and pizza!

== Upcoming Events ==

Signup to the chapter [https://groups.google.com/a/owasp.org/forum/#!forum/scotland-chapter Google Group] to be informed of upcoming events.

=== Thursday, 9 May 2019 ===
'''Time''': 18:00 – 20:00 BST

'''Location''': PwC, 144 Morrison Street, Edinburgh, EH3 8EX

==== Deception, Confusion, Mistrust: Attacks and Defences ====
'''Speaker''': Matt Wixey

This talk will cover 2 topics. The first focuses on Remote Online Social Engineering (ROSE), an emerging long-term attack vector deployed by threat actors to build trust and rapport with targeted users in order to gain access to business networks. I'll provide an outline of attackers' methodologies, why they would want to deploy them, some case studies, and countermeasures. The second is a light-hearted look at ways in which defenders can confuse, deceive, or frustrate attackers on a compromised honeypot or other host, with an emphasis on practical implementation. I'll examine some historic ways in which this has been done, along with some case studies, and then present some new methods I've come up with, with a few demos.

'''Bio'''

Matt leads technical research for the PwC Cyber Security practice in the UK, and is a PhD candidate at University College London. Prior to joining PwC, Matt led a technical R&D team for a law enforcement agency in the UK. His research interests include antivirus and sandboxing technologies, unconventional attack vectors, side-channels, and radio security.

==== Why Security-as-a-Feature Will Never Happen ====
'''Speaker''': Lawrence Munro

In a fairly dystopian view of our Cyber future, this talk discusses the reasons why we still haven't been able to include security as a design feature in applications.This talk goes into detail around the issues with human nature, education, financial requirements and laziness that contribute to the generally grim state of 'cyber' security.

As a security community (especially in Penetration testing), we’re very quick to throw mud and laugh at developers who’re not writing secure code. We also like to tell ourselves about new security issues and keep our learning within the community (as that's where we seek / receive the most praise). We should turn our view externally and reflect on information that we make available and how who we lobby to make positive changes. We simply don't teach people security early enough and position it as an essential design feature when people learn their trade. The general premise of the topic is that as an industry we know that one of the key challenges is that security needs to be 'baked in' at the design level. However, when we are taught the rudiments of Information Technology, security is not inherent or considered. The fundamental lack of security rubrics in education during key learning milestones means that security will always be an afterthought, or the domain of the specialist. If we're not addressing security at this level and providing the masses with a proper education, we'll never win the battle, let alone the war. In my opinion, the fault resides with those providing information to those seeking to learn. Specifically: Universities, Colleges, vendors, commercial providers, your friend Dave from school, authors and anyone who showed their friends how to customise their page on MySpace.com in the early 2000's. In order to validate my assertions, I have audited the occurrence of secure coding learning (at to respective top 25 UK / US universities) in undergraduate software engineering degrees (by module). I have also performed a similar evaluation on commercial offerings and looked at some of the most popular introductory books. I use this secondary data along with my own views to demonstrate the current failures of the industry and propose approaches to remedy this issue.

'''Bio'''

Lawrence Munro is the Worldwide VP of SpiderLabs, a Post-Graduate Student at Oxford University and Director for B-Sides London. My research (and presentation topics) are varied, but often include: red teaming, education in InfoSec and weird side-projects. Lawrence has previously presented his thoughts and research at: Black Hat USA 2018, DEFCON 2017, 44CON 2018, RootCon 2017, B-Sides (Various), ToorCon San Diego 2015.

== Past Events ==

=== Thursday, 21 February 2019 ===
'''Time''': 18:00 – 20:00

'''Location''': FanDuel, Quartermile One (Level 4), 15 Lauriston Place, Edinburgh, EH39EP

We have two great speakers kicking off 2019 for us.

Tickets available here: [https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-february-tickets-55989107929 https://owasp-scotland-november.eventbrite.co.uk]

Many thanks to FanDuel for hosting this event.

==== Seeing what is not there: searching in Windows paths ====
''Speaker'': Margus Lind, Context IS

Windows – designed to make training materials self-improve.

During a recent Windows breakout and privilege escalation training session we stumbled upon several new instances of exploits. While the underlying principles are well known, it is shocking to see such weaknesses exploitable out of the box, even on the latest Windows 10 RS5.

Firstly, the presentation will give a brief overview of the way Windows searches for required commands and DLLs. This will be followed by some practical examples of how it can be exploited to escalate privileges and bypass UAC.

Overall, we’ll see that while Windows makes an ever improving attempt at security features, the spaghetti bowl of legacy features and behaviours remains rather entertaining...

==== A view of the threat landscape ====
''Speaker'': Don Smith, Secureworks

Using examples of real world attacks, Senior Director Don Smith will discuss lessons learned from recent incidents involving determined and persistent adversaries. This session will illustrate the methods used by advanced actors to avoid detection and consolidate their access in compromised environments. The session will also explore how security teams can improve their chances of defending against such adversaries, pragmatic advice with the odd reality check.

=== Thursday, 15 November 2018 ===
'''Time''': 18:00 – 20:00

'''Location''': Ernst & Young, 144 Morrison St, Edinburgh EH3 8EX

We are in for a treat in the final OWASP Scotland chapter meeting for 2018 with presenters from the USA and Spain. We have Matt Nelson, Lee Christensen and Brian Reitz from SpecterOps as well as Simon Goldsmith from EY’s Cyber Security Hub presenting.

Tickets available here: https://owasp-scotland-november.eventbrite.co.uk

Many thanks to EY for hosting this event.

'''Cyber Infusion: Security in Innovation for Financial Services'''

''Speaker'': Simon Goldsmith, EY

It's almost become a cliché to say that "digital transformation (DX) is changing the way we do things". Technology enabled transformation is changing the way we interact, how we do business and the speed at which we innovate. It´s also changing the way we need to look at security.

Cyber Infusion is about ensuring security is embedded into how we innovate, rather than the more costly and practically ineffective approach of “bolting it on”. It means security has to operate less as the external “policeman” and more as a “guide” within the team to help chart a course. While there are business imperatives, digital and Open Banking inherently brings cyber risks: with greater connectivity, more data, more parties and more identities to manage, there is greater opportunity for increasingly industrialised and innovative threats to compromise systems, as well as greater regulatory attention and the potential for vulnerabilities to exist.

In this discussion, we will outline the nature and issues around Cyber Infusion in financial services innovation and a case study from an Open Banking programme showing where good practice can not only ensure a compliant and secure capability, but also add value through differentiation.

Bio: Simon leads the Innovation and Infusion team in EY’s EMEIA Financial Services Cyber Centre of Excellence. His team’s role is to develop new security approaches for EY’s financial services clients and integrate with EY´s digital transformation and financial crime capabilities to help other teams secure their innovation.

'''Outlander: Traveling Back in Time for Windows Attack Paths'''

''Speaker'': Matt Nelson (@enigma0x3), Lee Christensen (@tifkin_) and Brian Reitz (@brian_psu), SpecterOps

Microsoft Windows is built on a number of technologies that seemed like good ideas at the time.

In practice these were often poorly implemented, overly ambitious, difficult to understand, and insecure by default: a great combination for pentesters.

We'll examine two technologies in the Windows graveyard, COM and RPC, that are still in modern versions of Windows and provide multiple attack paths for pentesters.

We'll go over our methodology for enumerating and discovering the lesser-known features of these technologies, and how the attack surface still remains largely untested in 2018.

===Thursday, 20 September 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': FanDuel, Quartermile One, Level 4, 15 Lauriston Place, Edinburgh, EH39EP

The next OWASP Scotland Chapter meeting pencilled in the diary for Thursday 20th September. Many thanks to Fanduel, who has kindly offered to host this event for us. They will also be providing pizza and beer!

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite:

https://owasp-scotland-chapter-meeting-september-tickets.eventbrite.co.uk

'''DNS over TLS / DNS over HTTPS - The privacy magic bullet?'''

Speaker: Sean Wright

ith the introduction of Cloudflares new DNS service there was much hype around how it supported DNS over HTTPS and how this would help privacy. This talk investigates some potential short comings with this technology and how it is still possible in some cases to have information leaked about what site is being visited.

'''Raising Organisational Security Awareness with CTFs'''

Speaker: Rob Jansson

Capture the Flag (CTF) events are run frequently throughout the security community and conferences around the globe. Outside of security this is commonly unknown territory and means little to Joe Bloggs. Everyone within an organisation is responsible for security, whether it be data entry, developers, infrastructure / hosting services etc.; and security is often seen a blocker or some sort of black magic. This talk will walk you through how a CTF event was run within an organisation to raise security awareness amongst its employees, the challenges, successes and failures encountered. At the end of the talk you should have a good idea how to get one setup and whether you’d want to incorporate this into your organisation’s security programme.

===Monday, 21 May 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': Ernst & Young,144 Morrison St, Edinburgh EH3 8EX

We are pleased to let you know we have the second 2018 OWASP Scotland Chapter meeting pencilled in the diary for Monday 21st of May. Many thanks to EY who has kindly offered to host this event for us.

On this occasion we have the pleasure of having Tal Mozes do a talk on ‘Cyber Terror’. Tal comes from an impressive background in information security; and is currently a Partner at EY leading their Hacktics Cyber Security Center.

In the second talk Rob will be presenting on ‘Responsible Disclosure – The Good, the Bad and the Ugly’.

For attending this event you will be able to claim 2 CPE points.

Tickets available on Eventbrite: https://www.eventbrite.co.uk/e/owasp-scotland-chapter-meeting-may-tickets-45703255668

'''Cyber Terror'''

Speaker: Tal Mozes

Most of us, cyber security professionals, help in the fighting of cybercrime.

Most of our threat agents are opportunists, ideologists, organized crime and other Advanced Adversaries. But between those threat agents there are also terrorists, which are using the latest technologies to plant terror. From information warfare, to targeted attacks, what motivates them, what can they do and how can we all help in preventing the next digital terror attack.

'''Responsible Disclosure – The Good, the Bad and the Ugly'''

Speaker: Rob Jansson

What is responsible disclosure and is it something that would help protect your company from cyber attack? In this talk we will examine the benefits of having a responsible disclosure policy in place, what can go wrong and get ugly (really fast!).

=== Wednesday, 14 March 2018 ===
'''Time''': 18:00 - 20:00

'''Location''': PwC offices, 144 Morrison Street, Edinburgh, EH3 8EX

We are pleased to let you know we have the first 2018 OWASP Scotland Chapter meeting pencilled in the diary for Wednesday 14th March. Many thanks to PwC who has kindly offered to host this event for us.

We are still confirming speakers so please save the date and await further information in the near future.

If you would like to present, please drop Sean or Rob an email with a brief blurb of the proposed subject. We will review all submissions and get back to you.

For attending this event you will be able to claim 2 CPE points.

'''Website Discovery & Managing the Shadow Estate'''

Speaker: James Penny

There’s been a lot of writing and talks about the problem of Shadow IT – where users are working on their own cloud services, devices, and using unapproved software to get around “restrictive” or unresponsive controls.

A variation on this theme that’s talked about less is the “Shadow Estate” – services and websites that are launched without proper oversight and assent from departments that should be vital stakeholders. The core issue remains the same: the more controls we try to implement, the more project teams who don’t share our priorities will attempt to avoid them.

This talk explores a few possible reasons for this phenomenon, and the steps we in security can and have been taking to mitigate it.

'''Analyst, Engineer or Consultant?'''

Speaker:Harry McLaren

A looks at common roles with cybersecurity from the perspective of a Managing Consultant who’s been through several in quick succession and an introspective analysis of what makes a successful cybersecurity professional.

Tickets available on Eventbrite: https://owasp-scotland-march-2018.eventbrite.co.uk

=== Wednesday, 4 October 2017 ===
'''Time''': 18:00

'''Location''': Secureworks,

1 Tanfield,

Edinburgh,

EH3 5DA

To attend, please register here for the event [https://owasp-scotland-oct-2017.eventbrite.co.uk https://owasp-scotland-oct-2017.eventbrite.co.uk.] Places are limited, so please only register if you will definitely be attending.

<nowiki>*</nowiki> Please note that if your name is not on the list, you will be unlikely to enter the venue.

'''Revocation is broken, here's how we're fixing it'''

''Speaker'': Scott Helme

The certificates we obtain from a Certificate Authority underpin trust on the web. The problem is that if we lose the key for our certificate an attacker can use that certificate to successfully impersonate us for as long as it's valid, potentially years. We need a way to revoke the trust in these certificates so that they can't be abused but all current revocation mechanisms are largely useless. Let's look at the new mechanisms being introduced to address the problem of revocation.

=== Thursday, 31 August 2017 ===
Hope everyone is enjoying the summer and ready for the next OWASP Scotland Chapter meeting as we have secured two great talks for you. Please see blurbs below for details and Edinburgh University are again very kindly providing us with meeting space.

We have had great feedback from the previous event and look forward to seeing you all at the end of August. Very likely to be networking opportunities after the talks over a refreshment at a nearby watering hole.

'''Time''': 18:30

'''Location''': MF2 on the 4th floor,

Informatics Forum,

10 CrichtonStreet,

Edinburgh,

EH8 9AB
====Deconstructing WannaCry====
''Speaker'': James Slaughter

- Who, What, Where, Why and How.

- Or, how I actioned the incident and learned more about the malware to help our organization weather one of the largest malware events to occur in recent history.

====Driving Remediation in Large Organisations====
''Speaker:'' Andrew Scott

Congratulations! Your vulnerability scanning, penetration testing and bug bounty programmes are all running really well. But what about remediation? When it comes to fixing the problems identified by the various assurance programmes it’s easy to become swamped by the sheer volume and not make enough progress on actual fixes. How do you sort the must fixes from the nice to haves and how do you push the fix rate up and the time to fix down? I’ll look at a number of the challenges here and some solutions.

== Sponsors ==

If you would like to sponsor the OWASP Scotland chapter, please get in contact with [mailto:sean.wright@owasp.org Sean Wright] or [mailto:rob.jansson@owasp.org Rob Jansson].
[[Category:Chapters]]
[[Category:United Kingdom]]
[[Category:Europe]]

Scotland

2019-03-16T11:59:02Z

Swright75: /* Acknowledgements */

Scotland

2019-03-16T11:58:18Z

Swright75: Updated to use Google Groups for signup instead

Scotland

2019-03-16T11:55:58Z

Swright75: Moved recent event to past events

Scotland

2019-02-18T13:33:53Z

Swright75: Updated details of Don's talk

Scotland

2019-02-06T12:29:12Z

Swright75: Added February event

Scotland

2018-11-15T22:56:33Z

Swright75: Moved November event to past events

Scotland

2018-10-30T18:04:55Z

Swright75: /* Upcoming Events */

Scotland

2018-10-30T18:04:04Z

Swright75: /* Acknowledgements */

Scotland

2018-10-30T18:03:18Z

Swright75: Update the time of the November event

Scotland

2018-10-30T15:37:45Z

Swright75: /* Upcoming Events */

Scotland

2018-10-16T15:11:09Z

Swright75: /* Upcoming Events */

Scotland

2018-10-16T15:10:37Z

Swright75: /* Upcoming Events */

Scotland

2018-10-16T15:09:58Z

Swright75: /* Upcoming Events */

Scotland

2018-10-10T16:19:32Z

Swright75: Moved past event to Past Events section

Scotland

2018-08-25T09:13:49Z

Swright75: /* Upcoming Events */

Scotland

2018-08-25T09:13:24Z

Swright75: /* Acknowledgements */

Scotland

2018-08-25T09:12:08Z

Swright75: Added details for September event.

Scotland

2018-05-22T12:47:40Z

Swright75: Moved recent event to past event, as well as removed old events from the Past Events section.

Scotland

2018-05-02T21:27:13Z

Swright75: Added ticket details

Scotland

2018-05-02T21:24:10Z

Swright75: Added details about May's event.

Scotland

2018-03-19T21:51:02Z

Swright75: Added acknowledgements section

Scotland

2018-03-19T21:47:08Z

Swright75: Fixed formatting issues

Scotland

2018-03-19T21:46:05Z

Swright75: Fixed formatting

Scotland

2018-03-19T21:44:24Z

Swright75: Updated the events section, as well as the sponsors section.

Scotland

2018-03-04T15:26:15Z

Swright75: Corrected date

Scotland

2018-02-19T13:49:13Z

Swright75: Corrected day for next event

Scotland

2018-02-15T20:50:59Z

Swright75: Added speaker details for upcoming event.

Scotland

2018-02-12T20:03:18Z

Swright75: Changed date of March deven

Scotland

2018-02-05T22:50:17Z

Swright75: Updated with the new event in March

Scotland

2017-10-30T16:23:20Z

Swright75: Updated to new Twitter name

Scotland

2017-10-30T16:18:32Z

Swright75: Added Twitter link.

Scotland

2017-09-27T12:21:18Z

Swright75: Fixed EventBrite group

Scotland

2017-09-27T07:57:38Z

Swright75: Added October event

Scotland

2017-09-26T06:06:01Z

Swright75: Moved previous event to past events

Scotland

2017-07-20T14:32:22Z

Swright75: Added August event

Scotland

2017-05-19T21:16:38Z

Swright75: Moved May event into the Past Events section.

Scotland

2017-05-15T00:08:58Z

Swright75: Added additional speaker for May event

Scotland

2017-04-25T14:53:27Z

Swright75: Removed bold from headings

Scotland

2017-04-25T14:26:55Z

Swright75: Improved layout of new event

Scotland

2017-04-25T14:24:30Z

Swright75: Added event information for 18 May event.

Scotland

2017-03-30T20:52:52Z

Swright75: Minor formating