https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=WickettOWASP - User contributions [en]2026-05-05T04:34:52ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2013&diff=156222Lonestar Application Security Conference 20132013-07-29T20:22:00Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:LASCON-postcard-small.jpg|800px]]<br />
<br />
===== [http://lascon.org LASCON 2013] is happening on October 22-25th, 2013 in Austin, TX =====<br />
Please see the Official Website http://lascon.org for all details<br />
<br />
[http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
= Welcome =<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend [http://lascon.org LASCON 2013]:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br> <br />
<br />
[https://www.cvent.com/events/lascon-2013/registration-44aa22326b4e44c587b71879f71b7d11.aspx https://www.owasp.org/images/c/c5/LASCON_Register_Now.gif]<br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[http://twitter.com/LASCONATX #LASCONATX]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([http://twitter.com/LASCONATX follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
= Registration =<br />
<br />
== Registration Is Now Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
[https://www.cvent.com/events/lascon-2013/registration-44aa22326b4e44c587b71879f71b7d11.aspx https://www.owasp.org/images/c/c5/LASCON_Register_Now.gif]<br />
<br />
<br />
'''Who Should Attend [http://lascon.org LASCON 2013]:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
= Training =<br />
<br />
See Official LASCON website http://lascon.org/<br />
<br />
= Sessions =<br />
<br />
See Official LASCON website http://lascon.org/<br />
<br />
= Volunteers =<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact paul.griffiths(at)owasp.org to volunteer for a specific area: <br />
<br />
*Room Monitors<br />
*Speakers and Trainers <br />
*Vendors <br />
*Registration<br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
= Sponsors =<br />
<br />
Please visit the [http://lascon.org/sponsorship/ Sponsorship] page for information on sponsoring [http://lascon.org/ LASCON 2013]<br />
<br />
= Venue =<br />
<br />
== Norris Conference Center ==<br />
<br />
[http://lascon.org/ LASCON 2013] will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
= Travel =<br />
<br />
<br />
== Hotel ==<br />
<br />
The Hotel Allandale is located next to the Norris Conference Center. You can call the hotel directly for reservations.<br><br />
<br><br />
Hotel Allandale<br><br />
7685 Northcross Drive, Austin, TX 78757<br><br />
Reservations line, 1-800-851-9111<br><br />
Front Desk, 512-452-9391<br><br />
http://hotelallandale.com<br><br />
<br><br />
Rooms include a full breakfast daily and a social hour Monday-Thursday. Hotel Allandale is walking distance from the Norris Conference Center!<br><br />
<br><br />
[[Image:Allandale.png|400px]]<br />
--><br />
<br />
<headertabs /><br />
<br />
Click for historic information on [http://www.owasp.org/index.php/AppSecUSA_2012 AppSecUSA 2012, LASCON Edition], [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2011 LASCON 2011], [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010]</div>Wicketthttps://wiki.owasp.org/index.php?title=File:LASCON-postcard-small.jpg&diff=156221File:LASCON-postcard-small.jpg2013-07-29T20:21:11Z<p>Wickett: </p>
<hr />
<div></div>Wicketthttps://wiki.owasp.org/index.php?title=Ruby_on_Rails_Cheatsheet&diff=144503Ruby on Rails Cheatsheet2013-02-15T15:31:13Z<p>Wickett: </p>
<hr />
<div>DRAFT CHEAT SHEET - WORK IN PROGRESS<br />
<br />
= Introduction =<br />
<br />
This article intends to provide quick basic Ruby on Rails security tips for developers. The Rails framework abstracts developers from quite a bit of tedious work and provides the means to accomplish complex tasks quickly and with ease. New developers, those unfamiliar with the inner-workings of Rails, likely need a basic set of guidelines to secure fundamental aspects of their application. The intended purpose of this doc is to be that guide.<br />
<br />
= Items =<br />
== Command Injection == <br />
<br />
Ruby offers a function called “eval” which will dynamically build new Ruby code based on Strings. It also has a number of ways to call system commands.<br />
<br />
eval("ruby code here")<br />
System("os command here")<br />
`ls -al /` (backticks contain os command)<br />
Kernel.exec("os command here")<br />
<br />
While the power of these commands is quite useful, extreme care should be taken when using them in a Rails based application. Usually, its just a bad idea. If need be, a whitelist of possible values should be used and any input should be validated as thoroughly as possible.<br />
<br />
== SQL Injection == <br />
<br />
Ruby on Rails is often used with an ORM called ActiveRecord, though it is flexible and can be used with other data sources. Typically very simple Rails applications use methods on the Rails models to query data. Many use cases protect for SQL Injection out of the box. However, it is possible to write code that allows for SQL Injection. <br />
<br />
Here is an example (Rails 2.X style):<br />
<br />
@projects = Project.find(:all, :conditions => “name like #{params[:name]}”)<br />
<br />
A Rails 3.X example:<br />
<br />
name = params[:name]<br />
@projects = Project.where(“name like ‘“ + name + “‘“);<br />
<br />
In both of these cases, the statement is injectable because the name parameter is not escaped. <br />
<br />
Here is the idiom for building this kind of statement:<br />
<br />
@projects = Project.find(:all, :conditions => [ “name like ?”, “#{params[:name]}”] )<br />
<br />
An AREL based solution:<br />
<br />
@projects = Project.where("name like ?", "%#{params[:name]}%")<br />
<br />
Use caution not to build SQL statements based on user controlled input. A list of more realistic and detailed examples is here: [http://rails-sqli.org rails-sqli.org].<br />
<br />
== Cross-site Scripting (XSS) == <br />
<br />
By default, in Rails 3.0 protection against XSS comes as the default behavior. When string data is shown in views, it is escaped prior to being sent back to the browser. This goes a long way, but there are common cases where developers bypass this protection - for example to enable rich text editing. In the event that you want to pass variables to the front end with tags intact, it is tempting to do the following in your .erb file (ruby markup).<br />
<br />
<%= raw @product.name %> <br />
<%= @product.name.html_safe %> These are examples of how NOT to do it!<br />
<%= content_tag @product.name %><br />
<br />
Unfortunately, any field that uses raw like this will be a potential XSS target. Note that there are also widespread misunderstandings about html_safe. [http://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html This writeup] describes the underlying SafeBuffer mechanism in detail. Other tags that change the way strings are prepared for output can introduce similar issues, including content_tag.<br />
<br />
One way to manage cases like this is to use a Rails provided helper method called sanitize:<br />
<br />
<%= sanitize @project.name, :tags => %w(h1 h2 h3 h4 h5), :attributes => %() %><br />
<br />
This eliminates tags other than <nowiki><h1>, <h2>, <h3>, <h4>, <h5></nowiki>. It also disallows attributes on those tags. Note that it is critical to understand the tags you enable here. <nowiki><img></nowiki> may seem like an innocuous tag, but through various attributes on <nowiki><img/></nowiki> that are scriptable such as onError=””. Only by sanitizing only innocuous tags can XSS be prevented.<br />
<br />
A more attractive alternative to using sanitize and real HTML content is to use an alternative markup language for rich text in an application (Examples include: markdown and textile) and disallow HTML tags. This ensures that the input accepted doesn’t include HTML content that could be malicious.<br />
<br />
An often overlooked XSS attack vector is the href value of a link:<br />
<br />
<%= link_to “Personal Website”, @user.website %><br />
<br />
If @user.website contains a link that starts with “javascript:”, the content will execute when a user clicks the generated link:<br />
<br />
<a href=”javascript:alert(‘Haxored’)”>Personal Website</a><br />
<br />
== Sessions ==<br />
<br />
By default, Ruby on Rails uses a Cookie based session store. What that means is that unless you change something, the session will not expire on the server. That means that some default applications may be vulnerable to replay attacks. It also means that sensitive information should never be put in the session.<br />
<br />
The best practice is to use a database based session, which thankfully is very easy with Rails:<br />
<br />
Project::Application.config.session_store :active_record_store<br />
<br />
== Authentication == <br />
<br />
Generally speaking, Rails does not provide authentication by itself. However, most developers using Rails leverage libraries such as Devise or AuthLogic to provide authentication. To enable authentication with Devise, one simply has to put the following in a controller:<br />
<br />
class ProjectController < ApplicationController<br />
before_filter :authenticate_user<br />
<br />
As with other methods, this supports exceptions. Note that by default Devise only requires 6 characters for a password. The minimum can be changed in: /config/initializers/devise.rb<br />
<br />
config.password_length = 8..128<br />
<br />
There are several possible ways to enforce complexity. One is to put a Validator in the user model.<br />
<br />
validate :password_complexity<br />
def password_complexity<br />
if password.present? and not password.match(/\A(?=.*[a-z])(?=.*[A-Z])(?=.*\d).+\z/)<br />
errors.add :password, "must include at least one lowercase letter, one uppercase letter, and one digit"<br />
end<br />
end<br />
<br />
== Insecure Direct Object Reference or Forceful Browsing == <br />
<br />
By default, Ruby on Rails apps use a RESTful uri structure. That means that paths are often intuitive and guessable. To protect against a user trying to access or modify data that belongs to another user, it is important to specifically control actions. Out of the gate on a vanilla Rails application, there is no such built in protection. It is possible to do this by hand at the controller level. <br />
<br />
It is also possible, and probably recommended, to consider resource-based access control libraries such as [https://github.com/ryanb/cancan cancan] to do this. This ensures that all operations on a database object are authorized by the business logic of the application.<br />
<br />
== CSRF (Cross Site Request Forgery) ==<br />
<br />
Ruby on Rails has specific, built in support for CSRF tokens. To enable it, or ensure that it is enabled, find the base ApplicationController and look for a directive such as the following:<br />
<br />
class ApplicationController < ActionController::Base<br />
protect_from_forgery<br />
<br />
Note that the syntax for this type of control includes a way to add exceptions. Exceptions may be useful for API’s or other reasons - but should be reviewed and consciously included. In the example below, the Rails ProjectController will not provide CSRF protection for the show method.<br />
<br />
class ProjectController < ApplicationController<br />
protect_from_forgery :except => :show<br />
<br />
Also note that by default Rails does not provide CSRF protection for any HTTP GET request.<br />
<br />
== Mass Assignment and Strong Parameters == <br />
<br />
Although the major issue with Mass Assignment has been fixed by default in base Rails specifically when generating new projects, it still applies to older and upgraded projects so it is important to understand the issue and to ensure that only attributes that are intended to be modifiable are exposed.<br />
<br />
When working with a model, the attributes on the model will not be accessible to forms being posted unless a programmer explicitly indicates that:<br />
<br />
class Project < ActiveRecord::Base<br />
attr_accessible :name, :admin<br />
end<br />
<br />
With the admin attribute accessible based on the example above, the following could work:<br />
<br />
curl -d “project[name]=triage&project[admin]=1” host:port/projects<br />
<br />
Review accessible attributes to ensure that they should be accessible. If you are working in Rails < 3.2.3 you should ensure that your attributes are whitelisted with the following:<br />
<br />
config.active_record.whitelist_attributes = true<br />
<br />
In Rails 4.0 strong parameters will be the recommended approach for handling attribute visibility. It is also possible to use the strong_parameters gem with Rails 3.x, and the strong_parameters_rails2 gem for Rails 2.3.x applications.<br />
<br />
== Redirects and Forwards == <br />
<br />
Web applications often require the ability to dynamically redirect users based on client-supplied data. To clarify, dynamic redirection usually entails the client including a URL in a parameter within a request to the application. Once received by the application, the user is redirected to the URL specified in the request. For example:<br />
<br />
http://www.example.com/redirect?url=http://www.example_commerce_site.com/checkout<br />
<br />
The above request would redirect the user to http://www.example.com/checkout. The security concern associated with this functionality is leveraging an organization’s trusted brand to phish users and trick them into visiting a malicious site, in our example, “badhacker.com”. Example:<br />
<br />
http://www.example.com/redirect?url=http://badhacker.com<br />
<br />
The obvious fix for this type of vulnerability is to restrict to specific Top-Level Domains (TLDs), statically define specific sites, or map a key to it’s value. Example:<br />
<br />
ACCEPTABLE_URLS = {<br />
‘our_app_1’ => “https://www.example_commerce_site.com/checkout”,<br />
‘our_app_2’ => “https://www.example_user_site.com/change_settings”<br />
}<br />
<br />
http://www.example.com/redirect?url=our_app_1<br />
<br />
def redirect<br />
url = ACCEPTABLE_URLS[“#{params[:url]}”]<br />
redirect_to url if url<br />
end<br />
<br />
If matching user input against a list of approved sites or TLDs against regular expression is a must, it makes sense to leverage a library such as URI.parse() to obtain the host and then take the host value and match it against regular expression patterns. Those regular expressions must, at a minimum, have anchors or there is a greater chance of an attacker bypassing the validation routine.<br />
<br />
Example:<br />
<br />
require ‘uri’<br />
host = URI.parse(“#{params[:url]}”).host<br />
validation_routine(host) if host<br />
def validation_routine(host)<br />
# Validation routine where we use \A and \z as anchors *not* ^ and $<br />
end<br />
<br />
== Dynamic Render Paths == <br />
<br />
In Rails, controller actions and views can dynamically determine which view or partial to render by calling the “render” method. If user input is used in or for the template name, an attacker could cause the application to render an arbitrary view, such as an administrative page.<br />
<br />
Care should be taken when using user input to determine which view to render. If possible, avoid any user input in the name or path to the view.<br />
<br />
== Cross Origin Resource Sharing ==<br />
<br />
Occasionally, a need arises to share resources with another domain. For example, a file-upload function that sends data via an AJAX request to another domain. In these cases, the same-origin rules followed by web browsers must be bent. Modern browsers, in compliance with HTML5 standards, will allow this to occur but in order to do this; a couple precautions must be taken.<br />
<br />
When using a nonstandard HTTP construct, such as an atypical Content-Type header, for example, the following applies:<br />
<br />
The receiving site should whitelist only those domains allowed to make such requests as well as set the Access-Control-Allow-Origin header in both the response to the OPTIONS request and POST request. This is because the OPTIONS request is sent first, in order to determine if the remote or receiving site allows the requesting domain. Next, a second request, a POST request, is sent. Once again, the header must be set in order for the transaction to be shown as successful.<br />
<br />
When standard HTTP constructs are used:<br />
<br />
The request is sent and the browser, upon receiving a response, inspects the response headers in order to determine if the response can and should be processed.<br />
<br />
Note: Do NOT do use the wildcard in the access control header as it allows communication with any site.<br />
Access-Control-Allow-Origin: * (Bad example)<br />
<br />
Whitelist in Rails:<br />
<br />
Gemfile<br />
gem 'rack-cors', :require => 'rack/cors'<br />
<br />
config/application.rb<br />
module Sample<br />
class Application < Rails::Application<br />
config.middleware.use Rack::Cors do<br />
allow do<br />
origins 'someserver.example.com'<br />
resource %r{/users/\d+.json},<br />
:headers => ['Origin', 'Accept', 'Content-Type'],<br />
:methods => [:post, :get]<br />
end<br />
end<br />
end<br />
end<br />
<br />
== Security-related headers ==<br />
<br />
To set a header value, simply access the response.headers object as a hash inside your controller (often in a before/after_filter).<br />
<br />
response.headers['X-header-name'] = 'value'<br />
<br />
'''Rails 4''' provides the "default_headers" functionality that will automatically apply the values supplied. This works for most headers in almost all cases. Note: this does not account for content security policy.<br />
<br />
ActionDispatch::Response.default_headers = { <br />
'X-Frame-Options' => 'DENY', <br />
'X-Content-Type-Options' => 'nosniff', <br />
'X-XSS-Protection' => '1;'<br />
}<br />
<br />
Strict transport security is a special case, it is set in an environment file (e.g. production.rb)<br />
<br />
config.force_ssl = true<br />
<br />
For those not on the edge, there is a library ([https://github.com/twitter/secureheaders secure_headers]) for the same behavior with content security policy abstraction provided. It will automatically apply logic based on the user agent to produce a concise set of headers.<br />
<br />
== Business Logic Bugs ==<br />
<br />
Any application in any technology can contain business logic errors that result in security bugs. Business logic bugs are difficult to impossible to detect using automated tools. The best ways to prevent business logic security bugs are to do code review, pair program and write unit tests.<br />
<br />
== Attack Surface == <br />
<br />
Generally speaking, Rails avoids open redirect and path traversal types of vulnerabilities because of its /config/routes.rb file which dictates what URL’s should be accessible and handled by which controllers. The routes file is a great place to look when thinking about the scope of the attack surface. An example might be as follows:<br />
<br />
match ':controller(/:action(/:id(.:format)))' # this is an example of what NOT to do<br />
<br />
In this case, this route allows any public method on any controller to be called as an action. As a developer, you want to make sure that users can only reach the controller methods intended and in the way intended.<br />
<br />
== Sensitive Files == <br />
<br />
Many Ruby on Rails apps are open source and hosted on publicly available source code repositories. Whether that is the case or the code is committed to a corporate source control system, there are certain files that should be either excluded or carefully managed.<br />
<br />
/config/database.yml - May contain production credentials.<br />
/config/initializers/secret_token.rb - Contains a secret used to hash session cookie.<br />
/db/seeds.rb - May contain seed data including bootstrap admin user.<br />
/db/development.sqlite3 - May contain real data. <br />
<br />
<br />
== Encryption == <br />
<br />
Rails uses OS encryption. Generally speaking, it is always a bad idea to write your own encryption.<br />
<br />
Devise by default uses bcrypt for password hashing, which is an appropriate solution. Typically, the following config causes the 10 stretches for production: /config/initializers/devise.rb<br />
<br />
config.stretches = Rails.env.test? ? 1 : 10<br />
<br />
= Updating Rails and Having a Process for Updating Dependencies = <br />
<br />
In early 2013, a number of critical vulnerabilities were identified in the Rails Framework. Organizations that had fallen behind current versions had more trouble updating and harder decisions along the way, including patching the source code for the framework itself.<br />
<br />
An additional concern with Ruby applications in general is that most libraries (gems) are not signed by their authors. It is literally impossible to build a Rails based project with libraries that come from trusted sources. One good practice might be to audit the gems you are using.<br />
<br />
In general, it is important to have a process for updating dependencies. An example process might define three mechanisms for triggering an update of response: <br />
* Every month/quarter dependencies in general are updated.<br />
* Every week important security vulnerabilities are taken into account and potentially trigger an update.<br />
* In EXCEPTIONAL conditions, emergency updates may need to be applied.<br />
<br />
= Tools =<br />
<br />
Use [http://brakemanscanner.org/ brakeman], an open source code analysis tool for Rails applications, to identify many potential issues. It will not necessarily produce comprehensive security findings, but it can find easily exposed issues. A great way to see potential issues in Rails is to review the brakeman documentation of warning types.<br />
<br />
There are emerging tools that can be used to track security issues in dependency sets, like [http://sourceninja.com SourceNinja].<br />
<br />
Another area of tooling is the security testing tool [http://gauntlt.org Gauntlt] which is built on cucumber and uses gherkin syntax to define attack files.<br />
<br />
<br />
= Authors and Primary Editors = <br />
Matt Konda - mkonda [at] jemurai.com<br/><br />
Neil Matatall neil [at] matatall.com<br/><br />
Ken Johnson cktricky [at] gmail.com<br/><br />
Justin Collins justin [at] presidentbeef.com<br/><br />
Jon Rose - jrose400 [at] gmail.com<br/><br />
Lance Vaughn - lance [at] cabforward.com<br/><br />
Jon Claudius - jonathan.claudius [at] gmail.com<br/><br />
Jim Manico jim [at] owasp.org<br/><br />
Aaron Bedra aaron [at] aaronbedra.com<br/><br />
<br />
= Related Articles and References = <br />
<br />
* [http://guides.rubyonrails.org/security.html The Official Rails Security Guide]<br />
* [https://www.owasp.org/index.php/Category:OWASP_Ruby_on_Rails_Security_Guide_V2 OWASP Ruby on Rails Security Guide]<br />
* [http://code.google.com/p/ruby-security/wiki/Guide The Ruby Security Reviewers Guide]<br />
* [https://groups.google.com/forum/?fromgroups#!forum/rubyonrails-security The Ruby on Rails Security Mailing List]<br />
<br />
= Other Cheatsheets =<br />
{{Cheatsheet_Navigation}}<br />
<br />
[[Category:Cheatsheets]]</div>Wicketthttps://wiki.owasp.org/index.php?title=AppSecUSA_2012&diff=140668AppSecUSA 20122012-12-04T18:00:07Z<p>Wickett: </p>
<hr />
<div>AppSec USA 2012 — LASCON Edition, TX<br><br />
Austin, TX at the Hyatt Regency Hotel Downtown<br><br />
Training: October 23rd-24th — Conference Sessions: October 25th-26th<br><br />
<br><br />
OWASP AppSec conferences bring together industry, government, security researchers, and practitioners to discuss the state of the art in application security.<br><br />
<br><br />
For more information on CFP, CFT, Sponsorship, and registration, '''see the official AppSec USA website at [http://www.appsecusa.org http://www.appsecusa.org]'''<br />
<br />
<br />
=<span style="color:#006699;">AppSec USA 2012 Presentations and Talks</span>=<br />
<br />
<br />
== '''Thursday 25th Oct''' ==<br />
=== <span style="color:#006699;">10:00 am - 10:45 am (Thursday) </span>===<br />
<br />
---- <br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Building Predictable Systems using Behavioral Security Modeling: Functional Security Requirements ==== <br />
<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px; width:100%;" >'''John Benninghoff''' | Developer | [https://www.owasp.org/images/7/7f/Building_Predictable_Systems.pdf Building Predictable Systems using Behavioral Security Modeling - PDF] </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
<br />
==== Top Ten Web Defenses ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jim Manico''' | Mobile | [https://www.owasp.org/images/0/08/Top_10_Defenses_for_Website_Security.pdf Top 10 Defenses for Website Security - PDF] </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Mobile Applications & Proxy Shenanigans ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Dan Amodio''' | Mobile | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Reverse Engineering “Secure” HTTP APIs With An SSL Proxy ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Alejandro Caceres''' | Reverse Engineering | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Gauntlt: Rugged by Example ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jeremiah Shirk, Mani Tadayon, James Wickett''' | Rugged devops | [http://www.slideshare.net/wickett/gauntlt-rugged-by-example Gauntlt Rugged By Example - Slideshare] </span><br />
|}<br />
<br />
=== <span style="color:#006699;">11:00 am - 11:45 am (Thursday)</span> ===<br />
<br />
----<br />
<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Building a Web Attacker Dashboard with ModSecurity and BeEF ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Ryan Barnett''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Sherif Koussa''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Cracking the Code of Mobile Application ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Sreenarayan Ashokkumar''' | Mobile | [https://www.owasp.org/images/c/cd/Cracking_the_Mobile_Application_Code.pdf Cracking the Mobile Application Code - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Hacking .NET Application: Reverse Engineering 101 ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jon Mccoy''' | Reverse Engineering | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Doing the unstuck: How Rugged cultures drive Biz & AppSec Value ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Josh Corman''' | Rugged devops | [https://www.owasp.org/images/d/d5/Doing_the_Unstuck.pdf Doing the unstuck: How Rugged cultures drive Biz & AppSec Value - PDF]</span><br />
|}<br />
<br />
=== <span style="color:#006699;">2:00 pm - 2:45 pm (Thursday)</span> ===<br />
<br />
----<br />
<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Hacking with WebSockets ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Vaagn Toukharian''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Bug Bounty Programs ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice''' | Developer | Presentation Not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== How we tear into that little green man ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Mathew Rowley''' | Mobile | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jerry Hoff''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Put your robots to work: security automation at Twitter ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Justin Collins, Neil Matatall, Alex Smolen''' | Rugged devops | Presentation Not available </span><br />
|}<br />
<br />
=== <span style="color:#006699;">3:00 pm - 3:45 pm (Thursday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Exploiting Internal Network Vulns via the Browser using BeEF Bind ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Michele Orru''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Shay Chen''' | Developer | [https://www.owasp.org/images/f/f5/The_Diviner_-_Digital_Clairvoyance_Breakthrough_-_Gaining_Access_to_the_Source_Code_%26_Server_Side_Memory_Structure_of_ANY_Application.pdf Gaining Access to the Source Code & Server Side Memory Structure of ANY Application - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
<br />
==== Demystifying Security in the Cloud: AWS Scout ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jonathan Chittenden''' | Cloud | [https://www.owasp.org/images/0/0f/Demystifying_Security_in_the_Cloud.pdf Demystifying Security in the Cloud - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Ofer Maor''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Rebooting (secure) software development with continuous deployment ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Nick Galbreath''' | Rugged devops | Presentation not available</span> <br />
|}<br />
<br />
=== <span style="color:#006699;">4:00 pm - 4:45 pm (Thursday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Cross Site Port Scanning ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Riyaz Walikar''' | Attack | [https://www.owasp.org/images/8/89/Poking_Servers_with_Facebook-Cross_Site_Port_Scanning.pdf Cross Site Port Scanning - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Analyzing and Fixing Password Protection Schemes ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''John Steven''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Arshan Dabirsiaghi, Alex Emsellem, Matthew Paisner''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== WTF - WAF Testing Framework ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Yaniv Azaria, Amichai Shulman''' | Architecture | [https://www.owasp.org/images/0/00/OWASP-2012-WTF.pdf WAF Testing Framework - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== DevOps Distilled: The DevOps Panel at AppSec USA ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Josh Corman, Nick Galbreath, Gene Kim, David Mortman, James Wickett''' | Rugged devops | [https://www.owasp.org/images/9/90/Corman_AppSecUSA_2012_DevOpsPanel.pdf DevOps Distilled - PDF]</span><br />
|}<br />
<br />
== '''Friday 26th Oct''' ==<br />
=== <span style="color:#006699;">10:00 am - 10:45 am (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Effective approaches to web application security ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Zane Lackey''' | Developer | [https://www.owasp.org/images/b/b4/Effective_approaches_to_web_application_security.pdf Effective approaches to web application security - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Why Web Security Is Fundamentally Broken ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jeremiah Grossman''' | Developer | [https://www.owasp.org/images/9/90/Web_Security_Fundamentally_Broken.pdf Why Web Security Is Fundamentally Broken - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Payback on Web Attackers: Web Honeypots ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Simon Roses Femerling''' | Architecture | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Spin the bottle: Coupling technology and SE for one awesome hack ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''David Kennedy''' | Attack | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Incident Response: Security After Compromise ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Richard Bejtlich''' | Case Studies | Presentation not available</span><br />
|}<br />
<br />
=== <span style="color:#006699;">11:00 am - 11:45 am (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== The Same-Origin Saga ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Brendan Eich''' | Developer | [https://www.owasp.org/images/a/a2/The_Same-Origin_Saga.pdf The Same-Origin Saga - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Hack your way to a degree: a new direction in teaching application security at universities ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Konstantinos Papapanagiotou''' | Developer | [https://www.owasp.org/images/9/9a/OWASP_Hackademic_AppSecUS2012_v1.pdf Hack your way to a degree - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
<br />
==== The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Dan Cornell, Josh Sokol''' | Architecture | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Blended Threats and JavaScript: A Plan for Permanent Network Compromise ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Phil Purviance''' | Attack | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
<br />
==== Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Juan Perez-Etchegoyen, Jordan Santarsieri''' | Case Studies | Presentation not available</span><br />
|}<br />
<br />
=== <span style="color:#006699;">1:00 pm - 1:45 pm (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Builders Vs. Breakers ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Brett Hardin, Matt Konda, Jon Rose''' | Developer | [https://www.owasp.org/images/8/83/OWASP_AppSec_2012-Builders-vs-Breakers.pdf Builders-vs-Breakers - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Real World Cloud Application Security ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jason Chan''' | Cloud | Presentation not available</span> <br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== NoSQL, no security? ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Will Urbanski''' | Architecture | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== SQL Server Exploitation, Escalation, and Pilfering ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Antti Rantasaari, Scott Sutherland''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Iran's real life cyberwar ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Phillip Hallam-Baker''' | Case Studies | [https://www.owasp.org/images/5/59/Iran%E2%80%99s_Real_Life_Cyberwar.pdf Iran’s Real Life Cyberwar - PDF]</span><br />
|}<br />
<br />
=== <span style="color:#006699;">2:00 pm - 2:45 pm (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Get off your AMF and don’t REST on JSON ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Dan Kuykendall''' | Developer | [https://www.owasp.org/images/2/20/Get_off_your_AMF_and_dont_REST_on_JSON-AppSecUSA2012.pdf Get off your AMF and don’t REST on JSON - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Unraveling Some of the Mysteries around DOM-Based XSS ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Dave Wichers''' | Developer | [https://www.owasp.org/images/c/c5/Unraveling_some_Mysteries_around_DOM-based_XSS.pdf Unraveling some Mysteries around DOM-based XSS - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Tobias Gondrom''' | Architecture | [https://www.owasp.org/images/f/fe/OWASP_defending-MITMA_US_2012.pdf Securing the SSL channel against man-in-the-middle attacks - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== XSS & CSRF with HTML5 - Attack, Exploit and Defense ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Shreeraj Shah''' | Attack | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== The Application Security Ponzi Scheme: Stop paying for security failure ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jarret Raim, Matt Tesauro''' | Case Studies | Presentation not available</span><br />
|}<br />
<br />
=== <span style="color:#006699;">3:00 pm - 3:45 pm (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Using Interactive Static Analysis for Early Detection of Software Vulnerabilities ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Bill Chu''' | Developer | [https://www.owasp.org/images/4/46/Interactive_Static_Analysis.pdfInteractive Static Analysis for Early Detection of Software Vulnerabilities - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Origin(al) Sins ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Alex Russell''' | Developer | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== The 7 Qualities of Highly Secure Software ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Mano 'dash4rk' Paul''' | Architecture | [https://www.owasp.org/index.php/File:7_Qualities_of_Highly_Secure_Software.pdf 7 Qualities of Highly Secure Software - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Web Framework Vulnerabilities ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Abraham Kang''' | Attack | [https://www.owasp.org/images/d/db/WebFrameworkVulnerablilitiesAppSecUSA.pdf Web App Framework Based Vulnerabilies - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Web App Crypto - A Study in Failure ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Travis H''' | Case Studies | [https://www.owasp.org/images/2/2f/Web_app_crypto_20121026.pdf Web App Cryptology A Study in Failure - PDF]</span><br />
|}<br />
<br />
=== <span style="color:#006699;">4:00 pm - 4:45 pm (Friday)</span> === <br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Security at Scale ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Yvan Boily''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Four Axes of Evil ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''HD Moore''' | Developer | [https://www.owasp.org/images/6/6f/Four_Axes_of_Evil.pdf Four Axes of Evil - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Pining For the Fjords: The Role of RBAC in Today's Applications ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Wendy Nather''' | Architecture | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Counterintelligence Attack Theory ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Fred Donovan''' | Attack | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Top Strategies to Capture Security Intelligence for Applications ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''John Dickson''' | Case Studies | [https://www.owasp.org/images/8/8c/Top_Strategies_to_Capture_Security_Intelligence_for_Applications_OWASP.pdf Top Strategies to Capture Security Intelligence for Applications - PDF]</span><br />
<br />
|}<br />
<br><br />
<br />
<br />
[[Category:OWASP AppSec Conference]]</div>Wicketthttps://wiki.owasp.org/index.php?title=AppSecUSA_2012&diff=140667AppSecUSA 20122012-12-04T17:59:42Z<p>Wickett: </p>
<hr />
<div>AppSec USA 2012 — LASCON Edition, TX<br><br />
Austin, TX at the Hyatt Regency Hotel Downtown<br><br />
Training: October 23rd-24th — Conference Sessions: October 25th-26th<br><br />
<br><br />
OWASP AppSec conferences bring together industry, government, security researchers, and practitioners to discuss the state of the art in application security.<br><br />
<br><br />
For more information on CFP, CFT, Sponsorship, and registration, '''see the official AppSec USA website at [http://www.appsecusa.org http://www.appsecusa.org]'''<br />
<br />
<br />
=<span style="color:#006699;">AppSec USA 2012 Presentations and Talks</span>=<br />
<br />
<br />
== '''Thursday 25th Oct''' ==<br />
=== <span style="color:#006699;">10:00 am - 10:45 am (Thursday) </span>===<br />
<br />
---- <br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Building Predictable Systems using Behavioral Security Modeling: Functional Security Requirements ==== <br />
<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px; width:100%;" >'''John Benninghoff''' | Developer | [https://www.owasp.org/images/7/7f/Building_Predictable_Systems.pdf Building Predictable Systems using Behavioral Security Modeling - PDF] </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
<br />
==== Top Ten Web Defenses ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jim Manico''' | Mobile | [https://www.owasp.org/images/0/08/Top_10_Defenses_for_Website_Security.pdf Top 10 Defenses for Website Security - PDF] </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Mobile Applications & Proxy Shenanigans ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Dan Amodio''' | Mobile | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Reverse Engineering “Secure” HTTP APIs With An SSL Proxy ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Alejandro Caceres''' | Reverse Engineering | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Gauntlt: Rugged by Example ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jeremiah Shirk, Mani Tadayon, James Wickett''' | Rugged devops | [http://www.slideshare.net/wickett/gauntlt-rugged-by-example Gauntlt Rugged By Example - Slideshare </span><br />
|}<br />
<br />
=== <span style="color:#006699;">11:00 am - 11:45 am (Thursday)</span> ===<br />
<br />
----<br />
<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Building a Web Attacker Dashboard with ModSecurity and BeEF ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Ryan Barnett''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Sherif Koussa''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Cracking the Code of Mobile Application ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Sreenarayan Ashokkumar''' | Mobile | [https://www.owasp.org/images/c/cd/Cracking_the_Mobile_Application_Code.pdf Cracking the Mobile Application Code - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Hacking .NET Application: Reverse Engineering 101 ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jon Mccoy''' | Reverse Engineering | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Doing the unstuck: How Rugged cultures drive Biz & AppSec Value ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Josh Corman''' | Rugged devops | [https://www.owasp.org/images/d/d5/Doing_the_Unstuck.pdf Doing the unstuck: How Rugged cultures drive Biz & AppSec Value - PDF]</span><br />
|}<br />
<br />
=== <span style="color:#006699;">2:00 pm - 2:45 pm (Thursday)</span> ===<br />
<br />
----<br />
<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Hacking with WebSockets ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Vaagn Toukharian''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Bug Bounty Programs ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice''' | Developer | Presentation Not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== How we tear into that little green man ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Mathew Rowley''' | Mobile | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jerry Hoff''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Put your robots to work: security automation at Twitter ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Justin Collins, Neil Matatall, Alex Smolen''' | Rugged devops | Presentation Not available </span><br />
|}<br />
<br />
=== <span style="color:#006699;">3:00 pm - 3:45 pm (Thursday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Exploiting Internal Network Vulns via the Browser using BeEF Bind ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Michele Orru''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Shay Chen''' | Developer | [https://www.owasp.org/images/f/f5/The_Diviner_-_Digital_Clairvoyance_Breakthrough_-_Gaining_Access_to_the_Source_Code_%26_Server_Side_Memory_Structure_of_ANY_Application.pdf Gaining Access to the Source Code & Server Side Memory Structure of ANY Application - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
<br />
==== Demystifying Security in the Cloud: AWS Scout ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jonathan Chittenden''' | Cloud | [https://www.owasp.org/images/0/0f/Demystifying_Security_in_the_Cloud.pdf Demystifying Security in the Cloud - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Ofer Maor''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Rebooting (secure) software development with continuous deployment ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Nick Galbreath''' | Rugged devops | Presentation not available</span> <br />
|}<br />
<br />
=== <span style="color:#006699;">4:00 pm - 4:45 pm (Thursday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Cross Site Port Scanning ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Riyaz Walikar''' | Attack | [https://www.owasp.org/images/8/89/Poking_Servers_with_Facebook-Cross_Site_Port_Scanning.pdf Cross Site Port Scanning - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Analyzing and Fixing Password Protection Schemes ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''John Steven''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Arshan Dabirsiaghi, Alex Emsellem, Matthew Paisner''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== WTF - WAF Testing Framework ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Yaniv Azaria, Amichai Shulman''' | Architecture | [https://www.owasp.org/images/0/00/OWASP-2012-WTF.pdf WAF Testing Framework - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== DevOps Distilled: The DevOps Panel at AppSec USA ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Josh Corman, Nick Galbreath, Gene Kim, David Mortman, James Wickett''' | Rugged devops | [https://www.owasp.org/images/9/90/Corman_AppSecUSA_2012_DevOpsPanel.pdf DevOps Distilled - PDF]</span><br />
|}<br />
<br />
== '''Friday 26th Oct''' ==<br />
=== <span style="color:#006699;">10:00 am - 10:45 am (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Effective approaches to web application security ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Zane Lackey''' | Developer | [https://www.owasp.org/images/b/b4/Effective_approaches_to_web_application_security.pdf Effective approaches to web application security - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Why Web Security Is Fundamentally Broken ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jeremiah Grossman''' | Developer | [https://www.owasp.org/images/9/90/Web_Security_Fundamentally_Broken.pdf Why Web Security Is Fundamentally Broken - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Payback on Web Attackers: Web Honeypots ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Simon Roses Femerling''' | Architecture | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Spin the bottle: Coupling technology and SE for one awesome hack ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''David Kennedy''' | Attack | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Incident Response: Security After Compromise ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Richard Bejtlich''' | Case Studies | Presentation not available</span><br />
|}<br />
<br />
=== <span style="color:#006699;">11:00 am - 11:45 am (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== The Same-Origin Saga ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Brendan Eich''' | Developer | [https://www.owasp.org/images/a/a2/The_Same-Origin_Saga.pdf The Same-Origin Saga - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Hack your way to a degree: a new direction in teaching application security at universities ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Konstantinos Papapanagiotou''' | Developer | [https://www.owasp.org/images/9/9a/OWASP_Hackademic_AppSecUS2012_v1.pdf Hack your way to a degree - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
<br />
==== The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Dan Cornell, Josh Sokol''' | Architecture | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Blended Threats and JavaScript: A Plan for Permanent Network Compromise ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Phil Purviance''' | Attack | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
<br />
==== Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Juan Perez-Etchegoyen, Jordan Santarsieri''' | Case Studies | Presentation not available</span><br />
|}<br />
<br />
=== <span style="color:#006699;">1:00 pm - 1:45 pm (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Builders Vs. Breakers ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Brett Hardin, Matt Konda, Jon Rose''' | Developer | [https://www.owasp.org/images/8/83/OWASP_AppSec_2012-Builders-vs-Breakers.pdf Builders-vs-Breakers - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Real World Cloud Application Security ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jason Chan''' | Cloud | Presentation not available</span> <br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== NoSQL, no security? ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Will Urbanski''' | Architecture | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== SQL Server Exploitation, Escalation, and Pilfering ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Antti Rantasaari, Scott Sutherland''' | Attack | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Iran's real life cyberwar ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Phillip Hallam-Baker''' | Case Studies | [https://www.owasp.org/images/5/59/Iran%E2%80%99s_Real_Life_Cyberwar.pdf Iran’s Real Life Cyberwar - PDF]</span><br />
|}<br />
<br />
=== <span style="color:#006699;">2:00 pm - 2:45 pm (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Get off your AMF and don’t REST on JSON ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Dan Kuykendall''' | Developer | [https://www.owasp.org/images/2/20/Get_off_your_AMF_and_dont_REST_on_JSON-AppSecUSA2012.pdf Get off your AMF and don’t REST on JSON - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Unraveling Some of the Mysteries around DOM-Based XSS ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Dave Wichers''' | Developer | [https://www.owasp.org/images/c/c5/Unraveling_some_Mysteries_around_DOM-based_XSS.pdf Unraveling some Mysteries around DOM-based XSS - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Tobias Gondrom''' | Architecture | [https://www.owasp.org/images/f/fe/OWASP_defending-MITMA_US_2012.pdf Securing the SSL channel against man-in-the-middle attacks - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== XSS & CSRF with HTML5 - Attack, Exploit and Defense ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Shreeraj Shah''' | Attack | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== The Application Security Ponzi Scheme: Stop paying for security failure ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Jarret Raim, Matt Tesauro''' | Case Studies | Presentation not available</span><br />
|}<br />
<br />
=== <span style="color:#006699;">3:00 pm - 3:45 pm (Friday)</span> ===<br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Using Interactive Static Analysis for Early Detection of Software Vulnerabilities ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Bill Chu''' | Developer | [https://www.owasp.org/images/4/46/Interactive_Static_Analysis.pdfInteractive Static Analysis for Early Detection of Software Vulnerabilities - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Origin(al) Sins ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Alex Russell''' | Developer | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== The 7 Qualities of Highly Secure Software ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Mano 'dash4rk' Paul''' | Architecture | [https://www.owasp.org/index.php/File:7_Qualities_of_Highly_Secure_Software.pdf 7 Qualities of Highly Secure Software - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Web Framework Vulnerabilities ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Abraham Kang''' | Attack | [https://www.owasp.org/images/d/db/WebFrameworkVulnerablilitiesAppSecUSA.pdf Web App Framework Based Vulnerabilies - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Web App Crypto - A Study in Failure ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Travis H''' | Case Studies | [https://www.owasp.org/images/2/2f/Web_app_crypto_20121026.pdf Web App Cryptology A Study in Failure - PDF]</span><br />
|}<br />
<br />
=== <span style="color:#006699;">4:00 pm - 4:45 pm (Friday)</span> === <br />
<br />
----<br />
{| cellpadding="5" cellspacing="0" style="background:#F2F5F7; border:1px solid #CCCCCC;" width="100%"<br />
! scope="col" align="left" width="100%" |<br />
==== Security at Scale ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Yvan Boily''' | Developer | Presentation not available</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Four Axes of Evil ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''HD Moore''' | Developer | [https://www.owasp.org/images/6/6f/Four_Axes_of_Evil.pdf Four Axes of Evil - PDF]</span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Pining For the Fjords: The Role of RBAC in Today's Applications ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Wendy Nather''' | Architecture | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" |<br />
==== Counterintelligence Attack Theory ====<br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''Fred Donovan''' | Attack | Presentation not available </span><br />
|-<br />
! scope="col" align="left" width="100%" | <br />
==== Top Strategies to Capture Security Intelligence for Applications ==== <br />
<span style="background:#FFFFFF; border:1px solid #CCCCCC; padding:5px" >'''John Dickson''' | Case Studies | [https://www.owasp.org/images/8/8c/Top_Strategies_to_Capture_Security_Intelligence_for_Applications_OWASP.pdf Top Strategies to Capture Security Intelligence for Applications - PDF]</span><br />
<br />
|}<br />
<br><br />
<br />
<br />
[[Category:OWASP AppSec Conference]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=133671Austin2012-07-31T13:56:51Z<p>Wickett: /* July OWASP Austin Chapter Meeting - Lightning Talks! */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
No Vendor slides please!<br />
<br />
Come present on InfoSec or AppSec related topics. Send your submission to either James Wickett in PDF format.<br />
<br />
'''When:''' July 31st, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' AppSec Lightning Talks!<br />
<br />
'''Speakers'''<br />
<br />
* Doug Landoll<br />
* Matt Malone<br />
* David Hughes (@DavidHugh3s)<br />
* The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems - Josh Sokol (@joshsokol)<br />
* WAF evasion with SSL - David Lister<br />
* Phil Beyer (@pjbeyer)<br />
* #securityisms - The Real APT! - Brian Engle (@brainaengle)<br />
* Re-integration: Don't fear closed systems - Michael Cote (@cote)<br />
* Selling Security - Bill Kasper (aka The Hacker Vaccine) (@hackervaccine)<br />
* Be mean to your code! - James Wickett (@wickett)<br />
* Implementing Social Sign On(SSO+) in an Large Enterprise Single Sign On(SSO) Ecosystem - Jay Hook<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=133539Austin2012-07-26T17:05:52Z<p>Wickett: /* July OWASP Austin Chapter Meeting - Lightning Talks! */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
No Vendor slides please!<br />
<br />
Come present on InfoSec or AppSec related topics. Send your submission to either James Wickett in PDF format.<br />
<br />
'''When:''' July 31st, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' AppSec Lightning Talks!<br />
<br />
'''Speakers'''<br />
<br />
* Karthik Gaekwad (@iteration1)<br />
* David Hughes (@DavidHugh3s)<br />
* The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems - Josh Sokol (@joshsokol)<br />
* WAF evasion with SSL - David Lister<br />
* Phil Beyer (@pjbeyer)<br />
* #securityisms - The Real APT! - Brian Engle (@brainaengle)<br />
* Re-integration: Don't fear closed systems - Michael Cote (@cote)<br />
* Selling Security - Bill Kasper (aka The Hacker Vaccine) (@hackervaccine)<br />
* Be mean to your code! - James Wickett (@wickett)<br />
* Implementing Social Sign On(SSO+) in an Large Enterprise Single Sign On(SSO) Ecosystem - Jay Hook<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=133530Austin2012-07-26T14:34:16Z<p>Wickett: /* July OWASP Austin Chapter Meeting - Lightning Talks! */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
No Vendor slides please!<br />
<br />
Come present on InfoSec or AppSec related topics. Send your submission to either James Wickett in PDF format.<br />
<br />
'''When:''' July 31st, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' AppSec Lightning Talks!<br />
<br />
'''Speakers'''<br />
<br />
* Karthik Gaekwad (@iteration1)<br />
* David Hughes (@DavidHugh3s)<br />
* The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems - Josh Sokol (@joshsokol)<br />
* David Lister<br />
* Phil Beyer (@pjbeyer)<br />
* #securityisms - The Real APT! - Brian Engle (@brainaengle)<br />
* Re-integration: Don't fear closed systems - Michael Cote (@cote)<br />
* Selling Security - Bill Kasper (aka The Hacker Vaccine) (@hackervaccine)<br />
* Be mean to your code! - James Wickett (@wickett)<br />
* Implementing Social Sign On(SSO+) in an Large Enterprise Single Sign On(SSO) Ecosystem - Jay Hook<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=133529Austin2012-07-26T14:25:35Z<p>Wickett: </p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
No Vendor slides please!<br />
<br />
Come present on InfoSec or AppSec related topics. Send your submission to either James Wickett in PDF format.<br />
<br />
'''When:''' July 31st, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' AppSec Lightning Talks!<br />
<br />
'''Speakers'''<br />
<br />
* Karthik Gaekwad<br />
* David Hughes<br />
* The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems - Josh Sokol<br />
* David Lister<br />
* Phil Beyer<br />
* #securityisms - The Real APT! - Brian Engle<br />
* Michael Cote (TENTATIVE)<br />
* Selling Security - Bill Kasper (aka The Hacker Vaccine)<br />
* Be mean to your code! - James Wickett<br />
* Implementing Social Sign On(SSO+) in an Large Enterprise Single Sign On(SSO) Ecosystem - Jay Hook<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=133422Austin2012-07-24T18:43:25Z<p>Wickett: /* July OWASP Austin Chapter Meeting - Lightning Talks! */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
No Vendor slides please!<br />
<br />
Come present on InfoSec or AppSec related topics. Send your submission to either James Wickett in PDF format.<br />
<br />
'''When:''' July 31st, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' AppSec Lightning Talks!<br />
<br />
'''Speakers'''<br />
<br />
Be mean to your code! - James Wickett<br />
Karthik Gaekwad<br />
David Hughes<br />
Ernest Mueller<br />
The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems - Josh Sokol<br />
David Lister<br />
Phil Beyer<br />
#securityisms - The Real APT! - Brian Engle<br />
Michael Cote (TENTATIVE)<br />
Hacker Vaccine<br />
Jay Hook<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=133335Austin2012-07-23T16:10:20Z<p>Wickett: </p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
No Vendor slides please!<br />
<br />
Come present on InfoSec or AppSec related topics. Send your submission to either James Wickett in PDF format.<br />
<br />
'''When:''' July 31st, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' AppSec Lightning Talks!<br />
<br />
'''Speakers'''<br />
<br />
Be mean to your code! - James Wickett<br />
Karthik Gaekwad<br />
David Hughes<br />
Ernest Mueller<br />
The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems - Josh Sokol<br />
David Lister<br />
Phil Beyer<br />
Brian Engle<br />
Michael Cote (TENTATIVE)<br />
Hacker Vaccine<br />
Jay Hook<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=133320Austin2012-07-23T14:47:04Z<p>Wickett: /* July OWASP Austin Chapter Meeting - Lightning Talks! */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
No Vendor slides please!<br />
<br />
Come present on InfoSec or AppSec related topics. Send your submission to either James Wickett in PDF format.<br />
<br />
'''When:''' July 31st, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' AppSec Lightning Talks!<br />
<br />
'''Speakers'''<br />
<br />
James Wickett<br />
Karthik Gaekwad<br />
David Hughes<br />
Ernest Mueller<br />
Josh Sokol<br />
David Lister<br />
Phil Beyer<br />
Brian Engle<br />
Michael Cote (TENTATIVE)<br />
Hacker Vaccine<br />
Jay Hook<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=133319Austin2012-07-23T14:46:37Z<p>Wickett: /* July OWASP Austin Chapter Meeting - Lightning Talks! */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
No Vendor slides please!<br />
<br />
Come present on InfoSec or AppSec related topics. Send your submission to either James Wickett in PDF format.<br />
<br />
'''When:''' July 31st, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' AppSec Lightning Talks!<br />
<br />
'''Speakers'''<br />
<br />
James Wickett<br />
Karthik Gaekwad<br />
David Hughes<br />
Ernest Mueller<br />
Josh Sokol<br />
David Lister<br />
Phil Beyer<br />
Brian Engle<br />
Michael Cote (TENTATIVE)<br />
Hacker Vaccine<br />
Jay Hook<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=132799Austin2012-07-09T16:07:17Z<p>Wickett: /* July OWASP Austin Chapter Meeting - Lightning Talks! */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
<br />
<br />
<br />
<br />
== July Austin Security Professionals Happy Hour (Sponsored by Security Innovation) ==<br />
<br />
<br />
'''Please RSVP so have an idea how many to expect!'''<br />
<br />
'''When''' : Thursday July 12th, from 5-7 PM.<br />
<br />
<br />
'''Where:''' Sherlocks Baker Street Pub and Grill at the corner of 183 and Burnet.<br />
<br />
'''What is it?:''' The Austin Security Professionals happy hour is a monthly gathering of information security professionals from the Austin area, heavily represented by OWASP and ISSA membership. It is a time to enjoy some drinks and food provided by our sponsor, an to get to know other InfoSec professionals. Come on down and hang out with a bunch of hackers and geeks!<br />
<br />
<br />
'''Our Sponsor:''' Security Innovation<br />
<br />
Security Innovation solutions are based on the three pillars of a secure Software Development Lifecycle (SDLC), which feed into one another to<br />
create an ecosystem of repeatable, secure software development - standards, education and assessment. For more than ten years, the company<br />
has helped organizations build internal expertise and reduce application risk. The company's flagship products include TeamMentor, the industry's<br />
largest library of application security eLearning courses, and TeamMentor, "out of the box" secure development standards.<br />
<br />
There will be a $100 Amazon.com card giveaway, so bring a business card! <br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3698065012<br />
<br />
<br />
== July OWASP Austin Chapter Meeting - Lightning Talks! ==<br />
<br />
<br />
Want to try out your presentation skills? Here's your chance! OWASP Austin presents "Lightning Talks" for the July chapter meeting. This will be a back-to-back series of 5 minute, controlled presentations. Lightning talks are an excellent way to hone your presentation skills by testing your ability to present clear ideas with defined time and presentation restrictions. It can also be a lot of fun!<br />
<br />
Here is the criteria:<br />
<br />
Each talk must be 5 minutes in length<br />
Each slide deck will contain exactly 20 slides<br />
The slides will auto-advance every 15 seconds<br />
Try not to be too vendor-oriented.<br />
<br />
We're thinking of an OWASP Top 10 Theme if we can get each of the 10 represented, but submit anything you like! (Preferably InfoSec related.) Send your submission to either James Wickett or David Hughes in PDF format so that we can quickly decide on the ones to be presented.<br />
<br />
'''When:''' July 30th, from 11:30a-1:00pm<br />
<br />
'''Who:''' Why, YOU of course. :-D<br />
<br />
'''Topic:''' Lightning Talks!<br />
<br />
'''Speakers'''<br />
- James Wickett<br />
- Karthik Gaekwad<br />
- David Hughes<br />
- Ernest Mueller<br />
- Josh Sokol<br />
<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have enough for all and be eligible for our monthly book giveaway! (I will make the RSVP link available soon). <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3873941062<br />
<br />
Questions? call: David Hughes (512) 589-4623<br />
<br />
== Future Speakers and Events ==<br />
<br />
<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
'''When:''' June 26th, from 11:30a-1:00pm<br />
<br />
'''Topic:''' Measuring the Root Shell Index <br />
<br />
'''Who:'''HD Moore<br />
<br />
'''Synopis:''' Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.<br />
<br />
'''Cost:''' Free, of course<br />
<br />
'''Food:''' Oh yeah, Taco Deli time! <br />
<br />
'''Location:''' National Instruments, 11500 N. Mopac.Building C<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3697966718 <br />
<br />
----<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
'''When:''' June 14th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
'''When:''' May 29th, from 11:30a-1:00pm<br />
----<br />
<br />
'''Topic: ''' Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
<br />
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.<br />
<br />
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.<br />
<br />
'''Who: Jim Manico and Siri De Licori of WhiteHat Security'''<br />
<br />
<br />
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.<br />
<br />
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.<br />
<br />
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.<br />
<br />
<br />
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.<br />
<br />
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.<br />
<br />
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.<br />
<br />
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.<br />
<br />
'''Cost:''' Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3418570035<br />
<br />
----<br />
<br />
<br />
'''When:''' May 10th, 5:00pm-7:00pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.<br />
<br />
'''Where: ''' Sherlocks<br />
----<br />
<br />
'''When:''' April 24th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
<br />
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.<br />
<br />
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.<br />
<br />
'''Who: ''' Aaron Estes, Cigital<br />
<br />
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3182987401<br />
<br />
<br />
<br />
'''When:'''April 19th, from 5pm-7pm<br />
<br />
'''What: ''' Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.<br />
<br />
'''Where: Sherlocks'''<br />
<br />
----<br />
<br />
'''When:''' March 27th, 1:00pm-5:00pm<br />
<br />
<br />
<br />
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Free, but limited to 30 seats.<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3183041563<br />
<br />
----<br />
<br />
'''When:''' March 27th, 11:30a-1:00pm<br />
<br />
'''Topic: ''' Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
'''Who: ''' Mani Tadayon and Tin Zaw<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/3147433057<br />
<br />
----<br />
<br />
<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=126789Austin2012-03-23T19:34:09Z<p>Wickett: /* March Chapter Meeting. */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br />
=Upcoming Events=<br />
=== March Chapter Meeting.===<br />
<br />
'''When:''' March 27th, from 11:30a-1:00pm<br />
<br />
'''Topic:''': Cucumber and friends: tools for security that matters<br />
<br />
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.<br />
<br />
<br />
'''Speakers:''' Mani Tadayon and Tin Zaw<br />
<br />
<br />
'''Mani Tadayon, Senior Software Engineer, AT&T Interactive'''<br />
<br />
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.<br />
<br />
'''Tin Zaw, OWASP and AT&T Interactive'''<br />
<br />
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.<br />
<br />
Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.<br />
<br />
*Cost:* Free, of course, but please RVSV!<br />
<br />
<br />
<br />
*Food:* Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have<br />
enough for all!<br />
<br />
*Location:* National Instruments, 11500 N. Mopac.<br />
<br />
*Time:* March 27th, 11:30a - 1:00p<br />
<br />
*Questions?* call: David Hughes (512) 589-4623<br />
<br />
RSVP: http://www.eventbrite.com/event/3147433057<br />
<br />
=== Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.===<br />
<br />
'''What:''' Great conversation, and the beer and food are covered! This is a popular montly event with lots of folks from OWASP, ISSA, and others! This is a wonderful networking opportunity!<br />
<br />
'''When:''' April 19th, from 5pm-7pm<br />
<br />
'''Where''': Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
'''How?''' Our Sponsor: Founded in 1948, Robert Half International (RHI) is the world's first and largest specialized staffing firm. RHI is a recognized leader in professional staffing and consulting services, and is the parent company of Protiviti, a global consulting and internal audit firm composed of experts in risk and advisory services.<br />
<br />
Cost: None to you! <br />
<br />
<br />
'''RSVP:'''http://www.eventbrite.com/event/3147495243<br />
<br />
== Future Speakers and Events ==<br />
<br />
* March 27, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: Cucumber and friends: tools for security that matters (Mani Tadayon & Tin Zaw)<br />
* April 19, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour (Sponsored by Robert Half International)<br />
* April 24, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
* May 10, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* May 29, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: "Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
* June 14, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* June 26, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: 'The Jane Austen Software Development Model'(Wendy Nather, 451Group)<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
=Record Hall of Meetings=<br />
<br />
'''When:''' March 8, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fireeye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 28, 2012, 11:30am - 1:00pm <br />
<br />
<br />
'''Topic: ''' Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
<br />
'''Who:''' Matt Tesauro (Rackspace)<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
<br />
'''Cost:''' Always Free<br />
<br />
'''RSVP:''' http://www.eventbrite.com/event/2967474797<br />
----<br />
<br />
<br />
'''Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
<br />
<br />
<br />
'''Who:''' John Steven(Cigital)<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Where:''' Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''When:''' February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
<br />
----<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' Weirdos<br />
<br />
<br />
----<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
=Presentation Archives=<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
=Austin OWASP Chapter Leaders=<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
=Sponsorship Opportunities=<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
=Local News=<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
{{PutInCategory}}<br />
<br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=125170Austin2012-02-28T19:16:17Z<p>Wickett: /* February Chapter Meeting */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
===February Chapter Meeting===<br />
<br />
*Description:Testing From the Cloud: Is the Sky Falling?<br />
<br />
More and more IT is being moved to the cloud, why shouldn't your testing<br />
move there too? This talk will cover what it takes to take your testing<br />
tools from your laptop to the cloud using new features of the OWASP Web<br />
Testing Environment (WTE). WTE allows you to create custom installations<br />
of application security tools in the cloud on demand. Has your IP been<br />
shunned? No problem, kill that cloud instance and startup another. Is<br />
your life as mobile as your phone? No problem, a laptop + Internet =<br />
access to all your favorite tools from anywhere. Multiple clients? No<br />
problem, start an an instance for each one. By the end of this talk,<br />
you'll know all you need to fire up an cloud instance with all of your<br />
favorite tools and start having fun.<br />
<br />
*Slides: [[File:WTE-Cloud-Austin-2012-02.pdf]]<br />
<br />
*Speaker: Matt Tesauro*<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly<br />
involved in many OWASP projects and committees. Matt is the project<br />
leader of the OWASP WTE (Web Testing Environment) which is the source of<br />
the OWASP Live CD Project and Virtual Machines pre-configured with tools<br />
and documentation for testing web applications. Industry designations<br />
include the Certified Information Systems Security Professional (CISSP)<br />
and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics<br />
and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
*Cost:* Free, of course, but please RVSV!<br />
<br />
<br />
<br />
*Food:* Oh yeah, Taco Deli time! Please RSVP so we'll be sure to have<br />
enough for all!<br />
<br />
*Location:* National Instruments, 11500 N. Mopac.<br />
<br />
*Time:* February 28th, 11:30a - 1:00p<br />
<br />
*Questions?* call: David Hughes (512) 589-4623<br />
<br />
*RSVP*: http://www.eventbrite.com/event/2967474797<br />
<br />
<br />
We will be streaming this meeting again. I will post the link soon.<br />
<br />
== Half-Day Threat Modeling Seminar with John Steven of Cigital ==<br />
<br />
<br />
<br />
'''Topic: "Threat Modeling"'''<br />
<br />
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.<br />
<br />
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.<br />
<br />
<br />
'''The Presenter: John Steven'''<br />
<br />
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.<br />
<br />
<br />
'''Location:'''<br />
<br />
<br />
Microsoft Technology Center,<br />
Quarry Oaks 2, 10900 Stonelake Blvd<br />
<br />
<br />
'''Time:'''<br />
<br />
February 9th, from 1:00pm to 4:30pm<br />
<br />
<br />
'''Cost:'''<br />
<br />
The cost is free, but seating is limited, so register soon at the below link!<br />
<br />
http://austinthreatmodel2012.eventbrite.com/<br />
<br />
<br />
This will be an outstanding opportunity that you do no want to miss!! Refreshments will be provided.<br />
<br />
<br />
The meeting will be followed by our regular monthly happy hour. See below! <br />
<br />
<br />
== Austin Information Security Happy Hour ==<br />
<br />
<br />
<br />
'''When:''' February 9th, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cigital) <br />
<br />
'''Where:''' TBD<br />
<br />
Be there for drinks, food and good conversation! RSVP at:<br />
<br />
http://www.eventbrite.com/event/2841728687<br />
<br />
<br />
<br />
== Future Speakers and Events ==<br />
<br />
* December 2011 - No Meeting (Happy Holidays!)<br />
* January 19, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour (Sponsored by SOS Security and Gigamon)<br />
* January 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: What's in Your Program? Application Security Maturity in 2012 (Joel Scambray, Cigital)<br />
* February 9, 2012 - 1 PM to 5 PM - OWASP/ISSA Half-Day Seminar: Threat Modeling (John Steven, Cigital)<br />
* February 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour (Sponsored by Cigital)<br />
* February 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: Testing from the Cloud: Is the Sky Falling?(Matt Tesauro, Rackspace)<br />
* March 8, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour (Sponsored by Fireeye)<br />
* March 27, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* April 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour (Sponsored by Robert Half International)<br />
* April 24, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
* May 10, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* May 29, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: "Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)<br />
* June 14, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* June 26, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: 'The Jane Austen Software Development Model'(Wendy Nather, 451Group)<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: OWASP Lightning Talks<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
==== Record Hall of Meetings ====<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
==== Presentation Archives ====<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
==== Austin OWASP Chapter Leaders ====<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
==== Sponsorship Opportunities ====<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
==== Local News ====<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=File:WTE-Cloud-Austin-2012-02.pdf&diff=125169File:WTE-Cloud-Austin-2012-02.pdf2012-02-28T19:15:12Z<p>Wickett: </p>
<hr />
<div></div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=123193Austin2012-01-25T16:54:10Z<p>Wickett: /* Chapter Meetings */</p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:david.hughes@owasp.org David Hughes, President/Conference Chair], [mailto:benlbroussard@gmail.com Ben Broussard, Vice President],[mailto:josh.sokol@owasp.org Josh Sokol, Conference Chair], [mailto:james.wickett@owasp.org James Wickett, Conference Chair], [mailto:rich.vazquez@gmail.com Rich Vazquez, Board Member], [mailto:ggenung@gmail.com Greg Genung, Board Member]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br><br><br />
<br />
<br />
<br><br> <br />
<br />
==== Chapter Meetings ====<br />
<br />
'''When:''' January 19, 2012, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by SOS Security and Gigamon. They will be giving away an Apple TV!) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' January 31, 2012, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' What's in Your Program? Application Security Maturity in 2012<br />
<br />
Take a tour of the most successful software security initiatives in the world through this presentation of research into application security practices at over 40 well-known companies. From strategy & metrics to penetration testing, this study measured over 100 software security activities across 12 areas, as they are practiced "in the wild." Comparative statistics as well as period-over-period progress will be covered. You'll come away from this presentation armed with the facts to plan, implement, and/or enhance your own software security program based on real-world results.<br />
<br />
'''Who:''' Joel Scambray (Cigital)<br />
<br />
Joel Scambray has over 15 years of experience assisting companies ranging from newly minted startups to members of the Fortune 500 address information security challenges and opportunities. Joel leads Cigital’s Texas regional practice and focuses on developing and sustaining successful client relationships through oversight of delivery, recruiting, and business development at the regional level. He also contributes to the development of consulting practices and products, and influences Cigital’s evolving thought leadership around information security. Joel’s background includes roles as an executive, technical consultant, and entrepreneur. He co-founded and lead information security consulting firm Consciere for 3 years before it was acquired by Cigital in June of 2011. He has been a Senior Director at Microsoft Corporation, where he provided security leadership in Microsoft's online services and Windows divisions. Joel also co-founded security software and services startup Foundstone Inc. and helped lead it to acquisition by McAfee in 2004. Joel is widely recognized as co-author of Hacking Exposed: Network Security Secrets & Solutions, the international best-selling computer security book that first appeared in 1999. He is also lead author of the Hacking Exposed Windows and Web Applications series. Joel holds a BS from the University of California at Davis, a MA from UCLA, and he is a Certified Information Systems Security Professional (CISSP).<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: David Hughes (512) 589-4623. <br />
<br />
[http://www.eventbrite.com/event/2658939961 RSVP on Eventbrite]<br />
<br />
== Future Speakers and Events ==<br />
<br />
* December 2011 - No Meeting (Happy Holidays!)<br />
* January 19, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour (Sponsored by SOS Security and Gigamon)<br />
* January 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: What's in Your Program? Application Security Maturity in 2012 (Joel Scambray, Cigital)<br />
* February 9, 2012 - 1 PM to 5 PM - OWASP/ISSA Half-Day Seminar: Threat Modeling (John Steven, Cigital)<br />
* February 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour (Sponsored by Cigital)<br />
* February 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: Testing from the Cloud: Is the Sky Falling?(Matt Tesauro, Rackspace)<br />
* March 8, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour (Sponsored by Fireeye)<br />
* March 27, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* April 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* April 24, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting: Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)<br />
* May 10, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* May 29, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* June 14, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* June 26, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* July 12, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* July 31, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* August 9, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* August 28, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* September 13, 2012 - 5 PM to 7 PM - Austin Security Professionals Happy Hour<br />
* September 25, 2012 - 11:30 AM to 1 PM - Austin OWASP Meeting<br />
* October 23-26, 2012 - 8 AM to 5 PM - AppSec USA/LASCON 2012 in Austin, TX!<br />
* November 2012 - No Meeting (Happy Holidays!)<br />
* December 2012 - No Meeting (Happy Holidays!)<br />
<br />
==== Record Hall of Meetings ====<br />
<br />
'''When:''' October 28, 2011, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center, Austin, TX<br />
<br />
----<br />
<br />
'''When:''' September 29, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by HP/Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' September 27, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis<br />
<br />
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.<br />
<br />
'''Who:''' Ryan Smith (Praetorian)<br />
<br />
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.<br />
<br />
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 30, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration<br />
<br />
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams. <br />
<br />
In this session we will cover:<br />
<br />
* Prevalence of backdoors and malicious code in third party attacks <br />
<br />
* Definitions and classifications of backdoors and their impact on your applications <br />
<br />
* Methods to identify, track and remediate these vulnerabilities <br />
<br />
'''Who:''' Joe Brady (Veracode)<br />
<br />
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/2064867073 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' August 18, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 28, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Introduction to the OWASP Secure Coding Practices Quick Reference Guide<br />
<br />
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.<br />
<br />
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.<br />
<br />
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.<br />
<br />
<br />
'''Who:''' Keith Turpin CISSP, CSSLP, CRISC (Boeing)<br />
<br />
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations. <br />
<br />
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.<br />
<br />
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association. <br />
<br />
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics. <br />
<br />
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.<br />
<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://www.eventbrite.com/event/1696750025 RSVP on Eventbrite] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' June 17, 2011, 1:30pm - 5:00pm <br />
<br />
'''Topic:''' Penetration Testing with Metasploit Half-Day Seminar<br />
<br />
'''Who:''' Raphael Mudge<br />
<br />
'''Where:''' Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)<br />
<br />
'''NOTE:''' This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com<br />
<br />
----<br />
<br />
'''When:''' May 31, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Why Hackers.org Doesn't Get Hacked<br />
<br />
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.<br />
<br />
'''Who:''' James Flom (SecTheory)<br />
<br />
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.<br />
<br />
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 5, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by FireEye) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' April 26, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Rugged Dev: Building Reliability and Security Into Software<br />
<br />
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness. <br />
<br />
'''Who:''' James Wickett (National Instruments)<br />
<br />
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.<br />
<br />
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 14, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Veracode) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' March 29, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending Using OWASP<br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.<br />
<br />
'''Who:''' Matt Tesauro (Praetorian)<br />
<br />
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.<br />
<br />
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.<br />
<br />
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Infoblox) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' February 22, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Supercharged Password Cracking Techniques<br />
<br />
In the past 2-3 years there have been many important discoveries/releases in<br />
the world of password cracking. Between massive password leaks (like RockYou,<br />
Gawker, etc) and the release of many free tools that take advantage of <br />
the processing power of GPU cards, there are many new techniques/tools/tricks<br />
that security professionals should be taking advantage of while cracking <br />
passwords. But, by default tools you download (Like John the Ripper) do not<br />
take advantage of this.<br />
<br />
Over the past 12 years, Rick has been collecting password hashes from various<br />
large corporations (during authorized penetration tests). For years now, he <br />
has been cracking these passwords, and discovering more and more patterns that<br />
users are using. But the majority of password cracking tools out there<br />
(Such as John the Ripper, L0phtCrack, etc) do not take advantage of these <br />
"human weaknesses" in password creation. So far Rick has cracked almost 4 <br />
million hashes from inside corporate America, and an additional 5+ million <br />
from sources over the Internet.<br />
<br />
During this talk Rick will talk about the current state of password cracking<br />
by walking the attendees through a PWDUMP output file containing 49000+ <br />
real "complex" NTLM passwords) how the default rule-set provided by John <br />
the Ripper can be improved to crack tens of thousands of additional passwords. <br />
Wordlists/Dictionaries will be shared that can help you better crack <br />
passwords (these wordlists were created based on what users are _actually_ <br />
doing in Fortune 500 environments). New "rules" will be given out that were <br />
created to specifically attack the patterns that users are choosing.<br />
<br />
This is relevant to OWASP, because the applications we are developing/securing<br />
almost always have logins and passwords that protect them. But, unlike Operating<br />
Systems, our web applications do not usually have strict password requirements<br />
that users have to meet in order to create an account. We do this as to not<br />
scare away users; but we are placing our OWN systems at risk. <br />
<br />
Even now, sites like Google/Twitter/Facebook only warn the users about poor<br />
passwords, or have a list of 500 passwords that are not allowed. This will<br />
_not_ be the case in 10 years. Lets address this problem now.<br />
<br />
The only way to address the problem, is to first become aware of how bad<br />
our users are at choosing passwords , and what we can do (as developers or<br />
security professionals) to help protect our users from themselves.<br />
<br />
'''Who:''' Rick Redman (Korelogic)<br />
<br />
During his 12 years as a security practitioner, Rick has delivered numerous<br />
application and network penetration tests for a wide range of Fortune 500<br />
and government clients. He serves as KoreLogic's subject matter expert in<br />
advanced password cracking systems and coordinated the "Crack Me if You Can"<br />
Contest at DefCon 2010. Additionally, Rick presents at a variety of security<br />
forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin<br />
Hackers Anonymous). Rick also provides technical security training on<br />
topics such as web application security. Rick also delivers web application<br />
security training to management, developers and security staff. Rick has<br />
served as a member of a penetration testing tiger team supporting Sandia<br />
National Laboratories. Mr. Redman is a graduate of Purdue University with a<br />
degree in Computer Science from the COAST/CERIAS program under Eugene Spafford.<br />
Rick started performing application layer security tests of applications in<br />
2000, before inline web-proxies existed.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 10, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Cisco) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
<br />
'''When:''' January 25, 2011, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Smart Phones with Dumb Apps<br />
<br />
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.<br />
<br />
'''Who:''' Dan Cornell (Principal, Denim Group)<br />
<br />
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 13, 2011, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Rapid7) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' October 29, 2010, 8:00am - 5:00pm <br />
<br />
'''Topic: ''' Lonestar Application Security Conference (LASCON)<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
'''Where:''' Norris Conference Center <br />
<br />
'''Cost:''' $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)<br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --><br />
<br />
----<br />
<br />
'''When:''' September 28, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Technology and Business Risk Management: How Application Security Fits In<br />
<br />
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.<br />
<br />
'''Who:''' Peter Perfetti (Impact Security LLC) <br />
<br />
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 16, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' August 31, 2010, 11:30am - 1:00pm<br />
<br />
'''Topic: ''' Application Assessments Reloaded<br />
<br />
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?<br />
<br />
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.<br />
<br />
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?<br />
<br />
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).<br />
<br />
'''Who:''' Andre Gironda<br />
<br />
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.<br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716.<br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site]<br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757)<br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
==== Presentation Archives ====<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
* August 2011 - [https://www.owasp.org/images/a/a4/Protecting_Your_Applications_From_Backdoors.pdf Protecting Your Applications From Backdoors] by Joe Brady<br />
<br />
* June 2011 Half-Day - [http://www.hick.org/~raffi/austin_slides.pptx Penetration Testing with Metasploit] by Raphael Mudge<br />
<br />
* May 2011 - [https://www.owasp.org/images/2/2e/Hacking_ha_ckers.pptx Why Ha.ckers.org Doesn't Get Hacked] by James Flom<br />
<br />
* February 2011 - [http://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf Supercharged Password Cracking Techniques] by Rick Redmond<br />
<br />
*September 2010 - [http://www.owasp.org/images/9/97/Technology_and_Business_Risk_Management_How_Application_Security_Fits_In.pdf Technology and Business Risk Management: How Application Security Fits In]<br />
<br />
*August 2010 - [http://www.owasp.org/images/1/16/Owasp-austin-2010-gironda-reloaded.ppt Application Assessments Reloaded]<br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization] by Josh Sokol<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System] by Josh Sokol<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More] by Josh Sokol<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
==== Austin OWASP Chapter Leaders ====<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
==== Sponsorship Opportunities ====<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.setsolutions.com Set Solutions], [http://www.bluecoat.com Blue Coat Systems],[http://www.fireeye.com FireEye], [http://www.veracode.com Veracode], [http://www.expandingsecurity.com Expanding Security], [http://www.infoblox.com Infoblox], [http://www.cisco.com Cisco], [http://www.rapid7.com Rapid7], [http://www.f5.com F5], [http://www.accuvant.com Accuvant], and [http://www.whitehatsec.com WhiteHat Security] for their sponsorships during the past year. <br />
<br />
A huge thank you as well to [http://www.netiq.com NetIQ] for becoming an OWASP Foundation Corporate Sponsor through our chapter!<br />
<br />
==== Local News ====<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2011&diff=119652Lonestar Application Security Conference 20112011-10-28T14:24:20Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:Lascon800x191.png|800px]]<br />
<br />
===== Click [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 here] for information on LASCON 2010. =====<br />
<br />
===== SAVE THE DATE: LASCON 2011 is happening on October 28th, 2011 in Austin, TX =====<br />
<br />
[http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br> <br />
<br />
[http://www.regonline.com/954716 https://www.owasp.org/images/c/c5/LASCON_Register_Now.gif]<br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
[http://www.regonline.com/954716 https://www.owasp.org/images/c/c5/LASCON_Register_Now.gif]<br />
<br />
{|<br />
|-<br />
| [https://www.regonline.com/?eventID=954716&rTypeID=480930 Non-Members (Includes a 1 year OWASP membership)]<br />
| $125 Until 7/31/2011 <br />
| $175 Until 9/30/2011<br />
| $225 After 9/30/2011<br />
|-<br />
| [https://www.regonline.com/?eventID=954716&rTypeID=480929 OWASP Members]<br />
| $75 Until 7/31/2011<br />
| $125 Until 9/30/2011<br />
| $175 After 9/30/2011<br />
|-<br />
| [https://www.regonline.com/?eventID=954716&rTypeID=480932 Students with valid Student ID (must be shown at the door)]<br />
| $50 Until 7/31/2011<br />
| $75 Until 9/30/2011<br />
| $100 After 9/30/2011<br />
|}<br />
<br />
'''Who Should Attend LASCON 2011:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Training ====<br />
<br />
We are pleased to announce that this year we will be adding on two different training classes the day before the Lonestar Application Security Conference (LASCON) on '''Thursday, October 27, 2011'''. These training classes are unlike those you see at most conferences both in content and cost. If you have already registered for LASCON, simply go to http://www.regonline.com/lascon2011 and select the "Already Registered?" link. Log in with the e-mail address you registered with and then select to edit your "Agenda". Place a check mark in the box for the training you would like to attend (or the FREE happy hour) and select "Continue" to check out. If you have not already registered for LASCON, you will have the ability to add the training of your choice on the "Agenda" screen of registration. The trainings are as follows:<br><br />
<br />
'''<u>TRAINING 1 ($250):</u>'''<br><br />
'''Title: Advanced Threat Tactics with Armitage and Metasploit'''<br><br />
<br />
Metasploit is a powerful exploit framework and a must-have tool for penetration testers. Armitage builds a workflow on top of the Metasploit framework and exposes its most advanced capabilities. This demonstration and lab oriented session will teach you Metasploit and Armitage for the purpose of emulating adversary tactics. This course will start with the basics and quickly take you into the workflow of modern threats. You'll learn how to create trojan files, manage covert HTTP and HTTPS communications, set up social engineering attacks, and use pivoting to take over a network.<br><br />
<br />
To participate in the labs, you must have VMWare Player, VMWare Fusion, or VMWare Workstation installed.<br><br />
<br />
Raphael has put up some additional information on this class on his website at http://www.fastandeasyhacking.com/threats.<br><br />
<br />
'''Biography:'''<br><br />
Raphael Mudge is a Washington, DC, based code hacker working on a new startup effort. He is the developer of the open source Armitage for Metasploit. Raphael regularly writes and speaks on security topics. His work has appeared in USENIX ;login:, Linux Journal, and Hakin9. Previously, Raphael worked as a security researcher, software engineer, penetration tester, and system administrator.<br><br />
<br />
'''<u>TRAINING 2 ($250):</u>'''<br><br />
'''Title: Bootstrapping Your Application Security Program'''<br><br />
<br />
This training class is for new managers & leads accountable for integrating Application Security into their enterprise. The course will walk through various success factors, including a mixture of strategy, policy, and technology considerations. The course will help attendees develop incremental plans they can employ to make both short-term and long-term measurable improvements to their enterprise Application Security.<br><br />
<br />
Topics that will be covered include:<br><br />
*Goal Setting<br />
*Running effective pilot programs<br />
*Working with vendors<br />
*Roles & responsibilities in application security<br />
*Getting buy-in from management, development, business, IT, etc.<br />
*Meeting compliance needs (PCI & others)<br />
*Measuring success & ROI<br />
*Reporting to management<br />
*Scaling your program<br />
<br />
'''Biography:'''<br><br />
Bankim Tejani specializes in helping large companies stand up application security programs. Currently a Managing Consultant ofat Fortify, An HP Company, Bankim works with leading financials, technology companies, government agencies, and other corporations. He helps them strategically inject application security processes and technologies into their SDLCs while trying to minimize impact on time to market and maximize ROI. His prior experience begins with software development and transitions to network security research, red teaming, information security research, and application security consulting & training.<br><br />
<br />
Seats in these trainings will be very limited and registrants will be accepted on a first-come, first-served basis. Sign up today!<br />
<br />
==== Sessions ====<br />
<br />
See http://lascon.org/<br />
<br />
==== Volunteers ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)owasp.org to volunteer for a specific area: <br />
<br />
*Room Monitors<br />
*Speakers and Trainers <br />
*Vendors <br />
*Registration<br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Sponsors ====<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Symantec.png|250px|link=http://www.symantec.com]] &nbsp;&nbsp;&nbsp;&nbsp;<br />
| [[Image:Fortify.png|250px|link=http://www.fortify.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Impactsecurityllc.png|150px|link=http://www.impactsecurityllc.net]] &nbsp;&nbsp;&nbsp;&nbsp;<br />
<br>'''Impact Security LLC'''<br />
| [[Image:IBM.png|150px|link=http://www.ibm.com]]<br />
| [[Image:Imperva_2color_RGB.jpg|250px|link=http://www.imperva.com]]<br />
| [[Image:Whitehat.gif|250px|link=http://www.whitehatsec.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]] &nbsp;&nbsp;&nbsp;&nbsp;<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]] &nbsp;&nbsp;&nbsp;&nbsp;<br />
| [[Image:radware.png|150px|link=http://www.radware.com]] &nbsp;&nbsp;&nbsp;&nbsp;<br />
| [[Image:Cigital.png|150px|link=http://www.cigital.com]]<br />
|-<br />
| [[Image:Atsec.png|150px|link=http://www.atsec.com]] &nbsp;&nbsp;&nbsp;&nbsp;<br />
| [[Image:Fireeye.png|150px|link=http://www.fireeye.com]] &nbsp;&nbsp;&nbsp;&nbsp;<br />
| [[Image:Symplified.png|150px|link=http://www.symplified.com]] &nbsp;&nbsp;&nbsp;&nbsp;<br />
|<br />
|}<br />
== Lanyard Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Praetorian.png|200px|link=http://www.praetorian.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
== Happy Hour Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|}<br />
== Breakfast Taco Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Honeyapps.jpg|150px|link=http://www.honeyapps.com]]<br />
|}<br />
<br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2011 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
==== Hotel ====<br />
<br />
We have partnered with the Hotel Allandale, located right next to the Norris Conference Center, for this year's conference. You can call the hotel and mention that you would like the $90/night LASCON rate and they should be able to assist you.<br><br />
<br />
Hotel Allandale<br><br />
7685 Northcross Drive<br><br />
Austin, TX 78757<br><br />
<br><br />
http://hotelallandale.com<br><br />
<br><br />
The rooms are $90 for a King size room and includes a full breakfast daily and a social hour Monday-Thursday. Hotel Allandale is walking distance from the Norris Conference Center!<br />
<br />
[[Image:Allandale.png|400px]]<br />
<br />
==== Sponsorship Options ====<br />
<br />
== Booth Sponsorship Opportunities ==<br />
[[Image:Lascon_2011_booth_sponsorships.png|500px]]<br />
<br />
== A La Carte Sponsorship Opportunities ==<br />
[[Image:Lascon_2011_a_la_carte_1.png|700px]]<br />
[[Image:Lascon_2011_a_la_carte_2.png|700px]]<br />
<br />
Please [mailto:lascon@owasp.org contact us] for more information. <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2011 that will take place at the Norris Conference Center in Austin, TX on October 28, 2011. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2011 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 19th at 12PM CST (GMT -6) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2011<br />
<br><br />
Conference Website: http://www.lascon.org <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_Chapter_Events]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=AppSec_USA_2011_chapters_workshop_agenda&diff=117725AppSec USA 2011 chapters workshop agenda2011-09-21T02:22:21Z<p>Wickett: /* Participants */</p>
<hr />
<div> Join Remotely: https://www3.gotomeeting.com/join/627842590<br />
<br />
== General Information ==<br />
<br />
As part of [http://www.appsecusa.org/ AppSec USA 2011], on '''Wednesday, September 21,2011 at 12:00h-15:00h''' at the Minneapolis Convention Center (Room # TBA), the Global Chapter Committee is organizing a chapter leader workshop for all the chapter leaders that attend the conference. ''Please note that this Workshop will take place on the day before the Conference starts.''<br />
<br />
'''Discussion topics include:'''<br />
* How to improve the current Chapter Leader Handbook?<br />
* How to start and support new chapters within Canada and the United States?<br />
* How to support inactive chapters within Canada and the United States?<br />
* What Governance model is required for OWASP chapters?<br />
* How can the Global Chapters Committee facilitate the North American chapters?<br />
* ...<br />
<br />
<br />
<br />
== Funding to Attend Workshop ==<br />
<br />
If you need financial assistance to attend the Chapter Leader Workshop at AppSec USA, please submit a request to [mailto:tin.zaw@owasp.org Tin Zaw] and [mailto:sarah.baso@owasp.org Sarah Baso] by '''August 8, 2011'''. <br />
<br />
<br />
Funding for your attendance to the workshop should be worked out in the following order. <br />
<br />
# Ask your employer to fund your trip to AppSec USA conference.<br />
# Utilize your chapter funds.<br />
# Ask the chapter committee for funding assistance. <br />
<br />
<br />
While we wish we could fund every chapter leader, due to the limited amount of budget allocated for this event, we may not be able to fund 100% to all the requests. After August 8, we will make funding decision in a fair and transparent manner. When you apply for funding, please highlight your past contributions to OWASP and your future plans for the local chapter and OWASP. <br />
<br />
<br />
== Agenda ==<br />
<br />
Proposed agenda (open for discussion): <br />
<br />
{| border="0" align="center" style="width: 80%;"<br />
|-<br />
! align="center" colspan="3" | Minneapolis Convention Center - Room TBA<br />
|-<br />
| style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 15%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 12:00 - 12:15 <br />
| align="left" colspan="2" style="background: rgb(194, 194, 194) none repeat scroll 0% 0%; width: 75%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Welcome and Introductions<br />
|-<br />
| style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 15%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 12:15 - 1:00 <br />
| align="center" colspan="2" style="background: rgb(242, 242, 242) none repeat scroll 0% 0%; width: 75%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''Handling chapter finances''' <br />
''Introduction &amp; moderation: Tin Zaw, Participation: All '' <br />
<br />
Current chapter handbook [[:Chapter Handbook: Managing Money|section]] to be elaborated. <br />
<br />
|-<br />
| style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 15%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 1:00 - 1:15<br />
| align="left" colspan="2" style="background: rgb(194, 194, 194) none repeat scroll 0% 0%; width: 75%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Coffee Break<br />
|-<br />
| style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 15%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 1:15 - 2:00<br />
| align="center" colspan="2" style="background: rgb(242, 242, 242) none repeat scroll 0% 0%; width: 75%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''Top 10 advice for new and veteran chapter leaders''' <br />
''Introduction &amp; moderation: Tin Zaw, Participation: All'' <br />
<br />
Create list [https://www.owasp.org/index.php/Talk:AppSec_USA_2011_chapters_workshop_agenda upfront and add action, impact and required support] from the Chapters Committee. <br />
<br />
|-<br />
| style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 15%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 2:00 - 2:10<br />
| align="left" colspan="2" style="background: rgb(194, 194, 194) none repeat scroll 0% 0%; width: 75%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | Break<br />
|-<br />
| style="background: rgb(123, 138, 189) none repeat scroll 0% 0%; width: 15%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | 2:10 - 2:55<br />
| align="center" colspan="2" style="background: rgb(242, 242, 242) none repeat scroll 0% 0%; width: 75%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" | '''How to cross-pollinate success between Canadian and US chapters?''' <br />
''Introduction &amp; moderation: Tin Zaw, Participation: All'' <br />
<br />
Look for good pollinator mechanisms and [https://www.owasp.org/index.php/Talk:AppSec_USA_2011_chapters_workshop_agenda define 7 goals] to be accomplished by AppSec USA 2012 in Austin, Texas.<br />
<br />
|}<br />
<br />
<br />
== Participants ==<br />
<br />
'''If you plan to attend, please fill in your name and chapter below:'''<br />
<br />
* Tin Zaw (Global Chapters Committee Chair) - Los Angeles Chapter <br />
* Sarah Baso (Global Chapters Committee Administrator)<br />
* Mandeep Khera (Bay Area Chapter Leader and Global Chapter Committee member)<br />
* Tom Brennan (New York City Metro Leader and International Board of Directors)<br />
* Kelly Santalucia (New York City Chapter Administrator / Global Membership Committee Administrator)<br />
* Sherif Koussa (Ottawa Chapter Leader)<br />
* Brian Van Norman (Cincinnati Chapter)<br />
* Jon Bango (Atlanta Chapter)<br />
* James Wickett (Austin Chapter)<br />
<br />
== Remote Participation ==<br />
<br />
There will be WiFi, so we can set up a Skype or WebEx conference call for people who want to listen in or participate remotely. <br />
<br />
Contact [mailto:sarah.baso@owasp.org Sarah Baso] if you are interested in participating remotely.<br />
<br />
<br />
== Chapters Workshop at AppSec EU ==<br />
<br />
[https://docs.google.com/a/owasp.org/document/d/1PrGmwy1pxs2cb4LyewXS4TonbzAY7nORWvj-NJYaEnk/edit?hl=en_US Minutes from Workshop]<br />
<br />
[[AppSecEU 2011 chapters workshop agenda]]<br />
<br />
<br />
== Revising the Chapter Leader Handbook ==<br />
<br />
We hope to make time and space available to do hands-on work revising the [[Chapter Leader Handbook]], details TBA.<br />
<br />
<br />
== Questions? ==<br />
<br />
Contact [mailto:sarah.baso@owasp.org Sarah Baso] or [mailto:tin.zaw@owasp.org Tin Zaw] <br />
<br />
<br />
<br />
[[Category:Global_Chapters_Committee]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Global_Chapter_Committee_-_Application_8&diff=117248Global Chapter Committee - Application 82011-09-13T12:08:46Z<p>Wickett: </p>
<hr />
<div>[[How to Join a Committee|Click here to return to 'How to Join a Committee' page]] <br />
<br />
----<br />
<br />
{| border="0" align="center" style="width:100%"<br />
|-<br />
! align="center" style="background:#4058A0; color:white" colspan="2" | <font color="white">'''COMMITTEE APPLICATION FORM'''</font><br />
|-<br />
| align="center" style="width:25%; background:#7B8ABD" | '''Applicant's Name''' <br />
| align="left" style="width:85%; background:#cccccc" colspan="1" | <font color="black">Josh Sokol</font><br />
|-<br />
| align="center" style="width:25%; background:#7B8ABD" | '''Current and past OWASP Roles''' <br />
| align="left" style="width:85%; background:#cccccc" colspan="1" | Austin OWASP President, LASCON Co-Chair, Austin OWASP Vice President<br />
|-<br />
| align="center" style="width:25%; background:#7B8ABD" | '''Committee Applying for''' <br />
| align="left" style="width:85%; background:#cccccc" colspan="1" | Global Chapter Committee<br />
|}<br />
<br />
----<br />
<br />
<br> <br />
<br />
----<br />
<br />
Please be aware that for an application to be considered by the board, '''you MUST have 5 recommendations'''. An incomplete application will not be considered for vote. <br />
<br />
----<br />
<br />
<br> <br />
<br />
----<br />
<br />
{| border="0" align="center" style="width:100%"<br />
|-<br />
! align="center" colspan="8" style="background:#4058A0; color:white" | <font color="white">'''COMMITTEE RECOMMENDATIONS'''</font><br />
|-<br />
! align="center" style="background:white; color:white" | <font color="black"></font> <br />
! align="center" style="background:#7B8ABD; color:white" | <font color="black">'''Who Recommends/Name'''</font> <br />
! align="center" style="background:#7B8ABD; color:white" | <font color="black">'''Role in OWASP'''</font> <br />
! align="center" style="background:#7B8ABD; color:white" | <font color="black">'''Recommendation Content'''</font><br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''1''' <br />
| align="center" style="width:20%; background:#cccccc" | Greg Genung <br />
| align="center" style="width:20%; background:#cccccc" | Austin OWASP Membership Director, LASCON Volunteer <br />
| align="center" style="width:57%; background:#cccccc" | Josh and I have worked together through the Austin OWASP chapter for the last 5 years. He has been a tremendous individual contributor to the security community - but specifically - has been a huge proponent for OWASP in Texas. He has supported each of the growing chapters in Houston, Dallas, and San Antonio - as well as his efforts in Austin with our local chapter. In addition, Josh (and James Wickett) took it upon themselves to start the LASCON conference, which in its first year was a trememdous success. Finally - Josh is reliable. When he says he is going to do something - it gets done. I reccomend Josh for this role and believe he would be a benefit to this committee.&nbsp;<br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''2''' <br />
| align="center" style="width:20%; background:#cccccc" | David Hughes <br />
| align="center" style="width:20%; background:#cccccc" | Austin OWASP leader, LASCON Volunteer <br />
| align="center" style="width:57%; background:#cccccc" | Josh has proven his ability time and again to accomplish great things. He does what he sets out to do, and because of this he has contributed greatly to the huge success of the Austin OWASP chapter as well as the tremendous success of the LASCON conference. I highly recommend Josh and believe that his efforts on any committee would be highly valued and effective.<br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''3''' <br />
| align="center" style="width:20%; background:#cccccc" | Mano 'dash4rk' Paul <br />
| align="center" style="width:20%; background:#cccccc" | CEO, SecuRisk Solutions and Express Certification; (ISC)2 Software Assurance Advisor, Speaker/Panelist in OWASP conferences <br />
| align="center" style="width:57%; background:#cccccc" | As President of the Austin OWASP chapter, Josh has been instrumental in building the Austin OWASP chapter to be a vibrant and active chapter. His leadership in building the local chapter is commendable and I strongly feel that his experience would be a valuable fit for the Global Chapter committee. Josh comes with my highest recommendations.<br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''4''' <br />
| align="center" style="width:20%; background:#cccccc" | James Wickett<br />
| align="center" style="width:20%; background:#cccccc" | Austin&nbsp;OWASP Vice President and Past President, LASCON&nbsp;Co-Chair<br />
| align="center" style="width:57%; background:#cccccc" | Most of the things said about Josh here are things I&nbsp;would have said if I&nbsp;were in the first few recommenders.&nbsp; Josh has a strong commitment to excellence, a determined will to get things done and makes people feel welcome.&nbsp; He has a proven track record of success and I&nbsp;highly recommend him for this position.&nbsp;&nbsp;<br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''5''' <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:57%; background:#cccccc" | <br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''10''' <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:57%; background:#cccccc" | <br />
|}<br />
<br />
----</div>Wicketthttps://wiki.owasp.org/index.php?title=Global_Conferences_Committee_-_Application_10&diff=109983Global Conferences Committee - Application 102011-05-04T16:52:46Z<p>Wickett: </p>
<hr />
<div>[[How to Join a Committee|Click here to return to 'How to Join a Committee' page]] <br />
<br />
----<br />
<br />
{| border="0" align="center" style="width:100%"<br />
|-<br />
! align="center" style="background:#4058A0; color:white" colspan="2" | <font color="white">'''COMMITTEE APPLICATION FORM'''</font><br />
|-<br />
| align="center" style="width:25%; background:#7B8ABD" | '''Applicant's Name''' <br />
| align="left" style="width:85%; background:#cccccc" colspan="1" | <font color="black">Josh Sokol</font><br />
|-<br />
| align="center" style="width:25%; background:#7B8ABD" | '''Current and past OWASP Roles''' <br />
| align="left" style="width:85%; background:#cccccc" colspan="1" | Austin OWASP President, LASCON Co-Chair, Austin OWASP Vice President<br />
|-<br />
| align="center" style="width:25%; background:#7B8ABD" | '''Committee Applying for''' <br />
| align="left" style="width:85%; background:#cccccc" colspan="1" | Global Conferences Committee<br />
|}<br />
<br />
----<br />
<br />
<br> <br />
<br />
----<br />
<br />
Please be aware that for an application to be considered by the board, '''you MUST have 5 recommendations'''. An incomplete application will not be considered for vote. <br />
<br />
----<br />
<br />
<br> <br />
<br />
----<br />
<br />
{| border="0" align="center" style="width:100%"<br />
|-<br />
! align="center" style="background:#4058A0; color:white" colspan="8" | <font color="white">'''COMMITTEE RECOMMENDATIONS'''</font><br />
|-<br />
! align="center" style="background:white; color:white" | <font color="black"></font><br />
! align="center" style="background:#7B8ABD; color:white" | <font color="black">'''Who Recommends/Name'''</font><br />
! align="center" style="background:#7B8ABD; color:white" | <font color="black">'''Role in OWASP'''</font><br />
! align="center" style="background:#7B8ABD; color:white" | <font color="black">'''Recommendation Content'''</font><br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''1''' <br />
| align="center" style="width:20%; background:#cccccc" | James Wickett<br />
| align="center" style="width:20%; background:#cccccc" | VP&nbsp;of Austin OWASP&nbsp;Chapter<br />
| align="center" style="width:57%; background:#cccccc" | Josh is a hard worker and has led the OWASP&nbsp;Austin chapter for 2010 and 2011. &nbsp;Josh has been an instrumental part of the chapter even before that time and has served in many capacities to make OWASP&nbsp;successful in Austin--from communication to members to arranging food for events to speaking at meetings. &nbsp;I&nbsp;highly recommend Josh and I&nbsp;know that he would make a good addition to the committee. &nbsp;<br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''2''' <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:57%; background:#cccccc" | <br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''3''' <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:57%; background:#cccccc" | <br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''4''' <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:57%; background:#cccccc" | <br />
|-<br />
| align="center" style="width:3%; background:#cccccc" | '''5''' <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:20%; background:#cccccc" | <br />
| align="center" style="width:57%; background:#cccccc" | <br />
|}<br />
<br />
----</div>Wicketthttps://wiki.owasp.org/index.php?title=Global_Industry_Committee_-_Application_6&diff=105766Global Industry Committee - Application 62011-02-24T22:33:15Z<p>Wickett: </p>
<hr />
<div>[[How to Join a Committee|Click here to return to 'How to Join a Committee' page]] <br />
<br />
----<br />
<br />
{| border="0" align="center" style="width: 100%;"<br />
|-<br />
! align="center" style="background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" colspan="2" | <font color="white">'''COMMITTEE APPLICATION FORM'''</font><br />
|-<br />
| align="center" style="width: 25%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | '''Applicant's Name''' <br />
| align="left" style="width: 85%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" colspan="1" | <font color="black">Nishi Kumar</font><br />
|-<br />
| align="center" style="width: 25%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | '''Current and past OWASP Roles''' <br />
| align="left" style="width: 85%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" colspan="1" | OWASP CBT Project lead and part of OWASP Global Education Committee<br />
|-<br />
| align="center" style="width: 25%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | '''Committee Applying for''' <br />
| align="left" style="width: 85%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" colspan="1" | Global Industry Committee<br />
|}<br />
<br />
----<br />
<br />
<br> <br />
<br />
----<br />
<br />
Please be aware that for an application to be considered by the board, '''you MUST have 5 recommendations'''. An incomplete application will not be considered for vote. <br />
<br />
----<br />
<br />
<br> <br />
<br />
----<br />
<br />
{| border="0" align="center" style="width: 100%;"<br />
|-<br />
! align="center" style="background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" colspan="8" | <font color="white">'''COMMITTEE RECOMMENDATIONS'''</font><br />
|-<br />
! align="center" style="background: none repeat scroll 0% 0% white; color: white;" | <font color="black"></font> <br />
! align="center" style="background: none repeat scroll 0% 0% rgb(123, 138, 189); color: white;" | <font color="black">'''Who Recommends/Name'''</font> <br />
! align="center" style="background: none repeat scroll 0% 0% rgb(123, 138, 189); color: white;" | <font color="black">'''Role in OWASP'''</font> <br />
! align="center" style="background: none repeat scroll 0% 0% rgb(123, 138, 189); color: white;" | <font color="black">'''Recommendation Content'''</font><br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''1''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Giorgio Fedon <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Owasp Italy TD <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Nishi is a talented professional with specific knowledge about large corporates needs for Appsec<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''2''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Keith Turpin <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Project Leader <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Nishi represents a large financial sector service and technology provider. She brings extensive industry knowledge and represents a customer set that can directly benefit from OWASP projects. As a industry partner she brings a user based view that will help provide a useful perspective to the committee. Combine this with her excellent technical knowledge as a system architect and she will be an asset as a committee member.<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''3''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Dinis Cruz <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | [[O2 Platform]] project leader <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Nishi is going to add a lot of value to this committee. She is a good representative to the type of Industry contact OWASP needs to reach out, and the quality of her contributions to OWASP projects (like the CTB) speak for themselves<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''4''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Anurag Agarwal <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Project Leader <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Nishi is very dynamic and hard working. She has practical experience in handling appsec in a big company. Her experience and knowledge is crucial in OWASP's mission<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''5''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Greg Genung <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Austin OWASP Membership Director, LASCON Board Member, and OWASP Global&nbsp;Connections Committee Applicant <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Nishi's contributions to OWASP over the last 4 years that I have known her have been large and non-trivial. She jumps right in and supports any OWASP activity with energy for the organization and passion for her trade. Nishi was a contributor to the&nbsp;successful OWASP LASCON in Texas. Her professionalism, leadership, and knowledge in App-Sec makes her a shoe-in for education-related activies, especially community outreach &amp;&nbsp;industry outreach.<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''--''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Joe Bernik<span style="white-space: pre;" class="Apple-tab-span"> </span> <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Former Chapter lead and Commitee member<span style="white-space: pre;" class="Apple-tab-span"> </span> <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Nishi Welcome to the OWASP &nbsp;Industry commitee and thank you for what I know will be a great contribution!<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''--''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Alexander Fry <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | GIC Member <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | In addition to the other stellar recommendations for Nishi; she works hard, does good work, and completes projects. In the GIC, we have a large number of projects to complete and I know Nishi's contributions will be appreciated.<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''--''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | James Wickett<br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | OWASP Austin Chapter VP, LASCON Co-Founder <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Nishi was crucial to the success of LASCON and did a wonderful job on the board. She does a great job at whatever she puts her mind to. Also, she is pretty dang funny and outgoing and lets be honest, that is a rarity in the security community. I fully recommend her for this position.<br />
|}<br />
<br />
----</div>Wicketthttps://wiki.owasp.org/index.php?title=Global_Membership_Committee_-_Application_4&diff=100348Global Membership Committee - Application 42011-01-13T22:36:34Z<p>Wickett: </p>
<hr />
<div>[[How to Join a Committee|Click here to return to 'How to Join a Committee' page]] <br />
<br />
----<br />
<br />
{| border="0" align="center" class="FCK__ShowTableBorders" style="width: 100%;"<br />
|-<br />
! align="center" colspan="2" style="background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | <font color="#ffffff">'''COMMITTEE APPLICATION FORM'''</font><br />
|-<br />
| align="center" style="width: 25%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | '''Applicant's Name''' <br />
| align="left" style="width: 85%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <font color="#000000">Greg Genung</font><br />
|-<br />
| align="center" style="width: 25%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | '''Current and past OWASP Roles''' <br />
| align="left" style="width: 85%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Austin OWASP Membership Director.<br />
|-<br />
| align="center" style="width: 25%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | '''Committee Applying for''' <br />
| align="left" style="width: 85%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | OWASP Global Membership Committee.<br />
|}<br />
<br />
----<br />
<br />
<br> <br />
<br />
----<br />
<br />
Please be aware that for an application to be considered by the board, '''you MUST have 5 recommendations'''. An incomplete application will not be considered for vote. <br />
<br />
----<br />
<br />
<br> <br />
<br />
----<br />
<br />
{| border="0" align="center" class="FCK__ShowTableBorders" style="width: 100%;"<br />
|-<br />
! align="center" colspan="8" style="background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | <font color="#ffffff">'''COMMITTEE RECOMMENDATIONS'''</font><br />
|-<br />
! align="center" style="background: none repeat scroll 0% 0% white; color: white;" | <font color="#000000"></font> <br />
! align="center" style="background: none repeat scroll 0% 0% rgb(123, 138, 189); color: white;" | <font color="#000000">'''Who Recommends/Name'''</font> <br />
! align="center" style="background: none repeat scroll 0% 0% rgb(123, 138, 189); color: white;" | <font color="#000000">'''Role in OWASP'''</font> <br />
! align="center" style="background: none repeat scroll 0% 0% rgb(123, 138, 189); color: white;" | <font color="#000000">'''Recommendation Content'''</font><br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''1''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Josh&nbsp;Sokol <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Austin OWASP&nbsp;President <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Greg has served as our Austin&nbsp;OWASP Membership Director for the past year and has been instrumental in raising our membership levels and awareness of OWASP&nbsp;in the community.&nbsp; Under his leadership we went from under a dozen members in the Austin chapter to almost a hundred.&nbsp; He is always coming up with new ideas and ways to drive people to our chapter and help to evangelize security within our community.&nbsp; It would be very selfish of us to want to keep his amazing ideas just to our chapter so it is with great pleasure that I'd like to recommend Greg's nomination to the OWASP&nbsp;Global Membership Committee.<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''2''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | James Wickett<br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | Austin Chapter Vice President<br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | I&nbsp;recommend Greg for the committee. There are a lot of things I could say about Greg but the easiest is to say that I&nbsp;echo Josh 100%.&nbsp; One thing I&nbsp;would add is that Greg was instrumental to the success of LASCON.&nbsp; In addition to working on the board, Greg was the face of the conference as the leader for speaker introductions and really helped keep the conference running smoothly.<br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''3''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''4''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
|-<br />
| align="center" style="width: 3%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | '''5''' <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
| align="center" style="width: 57%; background: none repeat scroll 0% 0% rgb(204, 204, 204);" | <br />
|}<br />
<br />
----</div>Wicketthttps://wiki.owasp.org/index.php?title=Category:OWASP_AppSec_Conference&diff=99713Category:OWASP AppSec Conference2011-01-11T00:05:02Z<p>Wickett: /* 2011 Conferences and events */</p>
<hr />
<div>__NOTOC__<br />
The OWASP AppSec conference series is dedicated to bringing together industry, government, and security researchers and practitioners to discuss the state of the art in application security. This series was launched in the U.S. in the Fall of 2004 and in Europe in the Spring of 2005 and this has rapidly grown into a world wide phenomenon which now includes the U.S., Europe, Asia, Australia, and Israel. All of the presentations from our previous conferences can be downloaded from the agenda pages for each conference.<br />
<br />
Check out OWASP's conferences for the past two years on [http://maps.google.com/maps/ms?hl=en&gl=us&ie=UTF8&oe=UTF8&msa=0&msid=102471112605576686928.00046255c51af35309c77 Google Maps].<br />
<br />
<br />
==2011 Conferences Schedule==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2011 GLOBAL APPSEC EVENTS<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction/Keynote<br />
|-<br />
|[[Summit_2011|OWASP Summit 2011]]<br />
| February 8th - February 11th<br />
| Lisbon (Torres Vedras), Portugal<br />
| Entire Board, Commitee Members<br />
|-<br />
| Global AppSec North America<br />
| September 19th - September 23rd<br />
| Minneapolis, MN, USA<br />
| Entire Board<br />
|-<br />
| Global AppSec Europe<br />
| June (TBC)<br />
| TBC<br />
| Entire Board<br />
|-<br />
| Global AppSec South America <br />
| October 11 - 14th 2011<br />
| Porto Alegre, Brazil<br />
| TBD<br />
<br />
|}<br />
<br />
== 2011 Conferences and events ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2011 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction/Keynote<br />
|-<br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2011 LASCON]<br />
| October 28th, 2011<br />
| Austin, TX, USA<br />
| TBD<br />
|}<br />
<br />
==2010 Conferences Schedule==<br />
<br />
Local chapters can plan half or full-day events in their region, please [https://spreadsheets.google.com/a/owasp.org/viewform?hl=en&formkey=dFN1R2NIMTNROXN3dml4ZEcxXzJQYXc6MQ#gid=0 Contact Us] for support getting your event organized.<br />
<br />
For information on planning an official OWASP Foundation AppSec conferences with sponsors, please refer to [[How_to_Host_a_Conference]].<br />
<br />
<b>The Call for 2011 Conferences is now open.</b> Planning a great event takes time, so if you wish to host a conference in 2011 please submit a proposal detailing the venue and a detailed budget to the [http://www.owasp.org/index.php/Global_Conferences_Committee Global Conferences Committee]. The 2011 schedule is filling up quickly, so get started right away! OWASP Board members will be [http://www.owasp.org/index.php/How_to_Host_a_Conference#tab=BOARD_MEMBER_ROLE participating]in OWASP events as listed below. <br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 GLOBAL APPSEC EVENTS<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction/Keynote<br />
|-<br />
| [http://www.owasp.org/index.php/AppSec_Brasil_2010#tab=About AppSec Brazil]<br />
| November 16th - November 19th<br />
| Campinas, SP, Brazil<br />
| Dinis Cruz<br />
|}<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_AppSec_DC_2010 AppSec DC 2010]<br />
| November 8th - November 11th<br />
| Washington, DC<br />
| U.S. Board Members<br />
|-<br />
|[http://www.owasp.org/index.php/2010_BASC_Homepage Boston Application Security Conference 2010]<br />
| November 20th<br />
| Cambridge, MA<br />
|-<br />
| [http://www.owasp.org/index.php/IBWAS10 IBWAS]<br />
| November 25th - November 26th<br />
| Portugal<br />
| Dinis Cruz<br />
|-<br />
| [[BeNeLux OWASP Day 2010]]<br />
| December 1st - 2nd<br />
| Eindhoven, The Netherlands<br />
| Seba<br />
|}<br />
<br />
== 2010 Conferences and events - Completed ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction<br />
|-<br />
| [[OWASP_AppSec_Research_2010_-_Stockholm,_Sweden|OWASP AppSec Research 2010]] <br />
| June 21st - June 24th<br />
| Stockholm, Sweden<br />
| Dave Wichers, Tom Brennan, Seba<br />
|-<br />
| [http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2010 Froc 2010] <br />
| June 2nd<br />
| Denver, Colorodo, USA<br />
| Tom Brennan<br />
|-<br />
| [[OWASP_Day_Mexico_2010 | OWASP Day Mexico (at Aguascalientes)]]<br />
| June 4th<br />
| Aguascalientes, Mexico<br />
| Tom Brennan<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_Day_Argentina_2010 OWASP Day, Argentina 2010]<br />
|June 30<br />
|Buenos Aries<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 New Zealand Day]<br />
| July 15th<br />
| Auckland, New Zealand<br />
|-<br />
| [[AppSec US 2010, CA]]<br />
| September 7th - September 10th<br />
| Irvine, CA<br />
| Jeff Williams, Tom Brennan, Dave Wichers<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_IRELAND_2010 AppSec Ireland 2010]<br />
| September 17th<br />
| Dublin, Ireland<br />
| Eoin Keary<br />
|-<br />
| [[OWASP AppSec Germany 2010 Conference]]<br />
| October 20th<br />
| Nürnberg, Germany<br />
| Tom Brennan<br />
|-<br />
| [http://rochestersecurity.org Rochester Security Summit]<br />
| October 20th -October 21st<br />
| Rocheter, NY, USA<br />
| TBD<br />
|-<br />
| [http://www.owasp.org/index.php/OWASP_China_Summit_2010 OWASP China Summit 2010]<br />
| October 20th -October 23rd<br />
| Beijing, China<br />
| Tom Brennan<br />
|-<br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON]<br />
| October 29th, 2010<br />
| Austin, TX, USA<br />
| Matt Tesauro<br />
|}<br />
<br />
== 2009 Conferences and Events==<br />
<br />
; November 4th 2009 - [[Italy OWASP Day 4]] <br />
<br />
; November 11th 2009 - [http://www.owasp.org/index.php/Summit_2009 OWASP Global Summit 2009] - Washington, D.C.<br />
<br />
; November 10th-13th 2009 - [[OWASP_AppSec_US_2009_-_Washington_DC |OWASP AppSec US 2009]] - Washington, D.C.<br />
<br />
; November 17-20, 2009 - [http://www.owasp.org/index.php/Category:India App Sec India]<br />
<br />
; December 2nd 2009 - [[BeNeLux_OWASP_Day_2009|BeNeLux Day]]<br />
<br />
; December 10-11, 2009 - [[OWASP AppSec Iberia 2009|IBWAS'09 - Iberic Web Application Security Conference (Spain and Portugal)]] - Madrid, Spain<br />
<br />
; October 13, 2009 - [http://www.owasp.org/index.php/OWASP_AppSec_Germany_2009_Conference#tab=Anmeldung_und_Preise German Conference]<br />
<br />
; October 27-30 2009 - [[AppSec_CPLP_2009 |OWASP AppSec Brazil 2009]]<br />
: Conference and tutorials at Câmara dos Deputados, Anexo II, Praça dos Três Poderes<br />
<br />
; October 28-29 2009 - [http://rochestersecurity.org/ 4th annual Rochester Security Summit]<br />
<br />
; September 10, 2009 - [[OWASP_Ireland_AppSec_2009_Conference|OWASP AppSec Ireland 09]]<br />
<br />
; August 26, 2009 - [[AppSec_Academia_Symposium|AppSec Academia Symposium]]<br />
<br />
; August 24, 2009 [[OWASP_Minneapolis_St_Paul_2009_Conference| Minneapolis/St Paul half day event]]<br />
<br />
; July 2009 - [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]] - New Zealand<br />
: July 13th - 2 track conference, University of Auckland, Auckland, New Zealand (Registrations are Open)<br />
<br />
; May 2009 - [[OWASP_AppSec_Europe_2009_-_Poland |OWASP AppSec Europe 2009]] - Poland<br />
: May 11th-14th - 3 track conference and 8 tutorials, Park In Hotel, Krakow, Poland<br />
<br />
; March 2009 - [[OWASP_Software_Assurance_Day_DC_2009|OWASP Software Assurance Day DC 2009 (in conjunction with the DHS/DOD/NIST Software Assurance Forum)]]<br />
: March 13th, 1-Day Conference in McLean, Virginia<br />
<br />
; March 2009 - [[Front_Range_OWASP_Conference_2009|Front Range OWASP Conference 2009 (aka SNOWFroc)]]<br />
: March 5th, 2nd Annual 1-Day Conference in Denver, Colorado<br />
<br />
; February 2009 - [[OWASP_AU_Conference_2009|OWASP AppSec Australia 2009]] - Gold Coast<br />
: Feb 25th-27th - Training & Conference, Gold Coast Convention Center, QLD Australia<br />
<br />
; February 2009 - [[Italy_OWASP_Day_3 |Day 3 Italy]]<br />
: Feb 23rd - OWASP Day III: "Web Application Security: research meets industry" - Bari (Italy)<br />
<br />
=== 2008 ===<br />
; November 2008 - [[OWASP_Germany_2008_Conference | OWASP Germany Conference]]<br />
: November 25th - 1-Day Conference in Frankfurt, Germany<br />
<br />
; November 2008 - [[OWASP_EU_Summit_2008 | OWASP Summit 2008 - Portugal]]<br />
: November 3rd - 7th - Working Sessions, Conference & Training, Algarve, Portugal<br />
<br />
; October 2008 - [[OWASP AppSec Asia 2008 - Taiwan]]<br />
: October 27th - 28th - NTUH International Convention Centre, Taipei, Taiwan<br />
<br />
; October 2008 - [[OWASP_Minneapolis_St_Paul_2008_Conference | OWASP Minnesota Conference]]<br />
: October 21st - University of Minnesota's St. Paul Student Center<br />
<br />
; September 2008 - [[OWASP_NYC_AppSec_2008_Conference | OWASP AppSec U.S. 2008 - New York City]]<br />
: September 22nd - 25th - Conference & Training, Park Central Hotel, NYC<br />
<br />
; September 2008 - [[OWASP_Israel_2008_Conference | OWASP Israel 2008 - Herzliya, Israel]]<br />
: September 14th - The Interdisciplinary Center Herzliya, Israel<br />
<br />
; August 2008 - [[OWASP_AppSec_India_Conference_2008 | OWASP AppSec India 2008 - Delhi, India]]<br />
: August 20th - 21st - Conference & Training<br />
<br />
; June 10th 2008 - [[Front_Range_Web_Application_Security_Summit_Planning_Page | Front Range Web Application Security Conference]] - Denver, CO<br />
<br />
; May 2008 - [[OWASP_AppSec_Europe_2008_-_Belgium | OWASP AppSec Europe 2008 - Ghent, Belgium]]<br />
: May 19th - 22nd - Conference & Training, Ghent University, Belgium (view [[OWASP_AppSec_Europe_2008_-_Belgium#Agenda_and_Presentations_-_May_21-22|agenda and presentations]])<br />
<br />
; February 2008 - [[OWASP_Australia_AppSec_2008_Conference | OWASP Australia AppSec 2008 Conference]] <br />
: February 27th-29th - Training & Conference, Gold Coast Convention Center, QLD Australia<br />
<br />
=== 2007 ===<br />
; December 2007 - [[OWASP_Israel_2007_Conference | OWASP Israel AppSec 2007 Conference]]<br />
: December 3rd, 2007 - Interdisciplinary Center (IDC) Herzliya, Israel<br />
<br />
; November 2007 - [[OWASP & WASC AppSec 2007 Conference | OWASP & WASC AppSec U.S. 2007 - San Jose, California]]<br />
: November 12-15 - at eBay in San Jose, CA. (view [[7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda#OWASP_.26_WASC_AppSec_2007_Conference_Schedule_-_Nov_14-15_.28San_Jose_2007.29|agenda and presentations]])<br />
<br />
; September 2007 - [[OWASP_AppSec_Asia_2007 | OWASP AppSec Asia 2007 - Taiwan]]<br />
: September 27 - in Taipei, Taiwan. <br />
<br />
; May 2007 - [[OWASP_AppSec_Europe_2007_-_Italy | OWASP AppSec Europe 2007 - Italy]]<br />
: May 15th-17th - in Milan, Italy. (view [[OWASP_AppSec_Europe_2007_-_Italy/Agenda|agenda and presentations]])<br />
<br />
=== 2004-2006 ===<br />
<br />
; October 2006 - [[OWASP AppSec Seattle 2006| OWASP AppSec U.S. 2006 - Seattle, Washington]]<br />
: October 16th-18th - in Seattle, Washington. (view [[OWASP_AppSec_Seattle_2006/Agenda|agenda and presentations]]) <br />
<br />
; May 2006 - [[OWASP AppSec Europe 2006| OWASP AppSec Europe 2006 - Belgium ]]<br />
: Held in Leuven, Belgium (view [[AppSec Europe 2006/Agenda|agenda and presentations]])<br />
<br />
; October 2005 - [[OWASP AppSec Washington 2005|OWASP AppSec U.S. 2005 - Washington D.C.]]<br />
: Held at NIST in Gaithersburg, MD (view [[AppSec Washington 2005/Agenda|agenda and presentations]])<br />
<br />
; April 2005 - [[OWASP AppSec Europe 2005|OWASP AppSec Europe 2005 - London]]<br />
: Held at Royal Holloway University in London (view [[AppSec Europe 2005/Agenda|agenda and presentations]])<br />
<br />
; November 2004 - [[OWASP AppSec NYC 2004|OWASP AppSec U.S. 2004 - New York City]]<br />
: Held at Stevens Institute in New Jersey (view [[AppSec NYC 2004|agenda and presentations]])<br />
<br />
<center><br><br />
More [http://www.owasp.org/index.php/Category:OWASP_AppSec_Conference-archive Conference Archives - Click Here]</center><br />
<br />
<br />
[[Category:OWASP AppSec Conference]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Category:OWASP_AppSec_Conference&diff=99712Category:OWASP AppSec Conference2011-01-10T23:50:05Z<p>Wickett: /* 2011 Conferences and events */</p>
<hr />
<div>__NOTOC__<br />
The OWASP AppSec conference series is dedicated to bringing together industry, government, and security researchers and practitioners to discuss the state of the art in application security. This series was launched in the U.S. in the Fall of 2004 and in Europe in the Spring of 2005 and this has rapidly grown into a world wide phenomenon which now includes the U.S., Europe, Asia, Australia, and Israel. All of the presentations from our previous conferences can be downloaded from the agenda pages for each conference.<br />
<br />
Check out OWASP's conferences for the past two years on [http://maps.google.com/maps/ms?hl=en&gl=us&ie=UTF8&oe=UTF8&msa=0&msid=102471112605576686928.00046255c51af35309c77 Google Maps].<br />
<br />
<br />
==2011 Conferences Schedule==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2011 GLOBAL APPSEC EVENTS<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction/Keynote<br />
|-<br />
|[[Summit_2011|OWASP Summit 2011]]<br />
| February 8th - February 11th<br />
| Lisbon (Torres Vedras), Portugal<br />
| Entire Board, Commitee Members<br />
|-<br />
| Global AppSec North America<br />
| September 19th - September 23rd<br />
| Minneapolis, MN, USA<br />
| Entire Board<br />
|-<br />
| Global AppSec Europe<br />
| June (TBC)<br />
| TBC<br />
| Entire Board<br />
|-<br />
| Global AppSec South America <br />
| October 11 - 14th 2011<br />
| Porto Alegre, Brazil<br />
| TBD<br />
<br />
|}<br />
<br />
== 2011 Conferences and events ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2011 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction<br />
|-<br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2011 LASCON]<br />
| October 28th, 2011<br />
| Austin, TX, USA<br />
| TBD<br />
|}<br />
<br />
==2010 Conferences Schedule==<br />
<br />
Local chapters can plan half or full-day events in their region, please [https://spreadsheets.google.com/a/owasp.org/viewform?hl=en&formkey=dFN1R2NIMTNROXN3dml4ZEcxXzJQYXc6MQ#gid=0 Contact Us] for support getting your event organized.<br />
<br />
For information on planning an official OWASP Foundation AppSec conferences with sponsors, please refer to [[How_to_Host_a_Conference]].<br />
<br />
<b>The Call for 2011 Conferences is now open.</b> Planning a great event takes time, so if you wish to host a conference in 2011 please submit a proposal detailing the venue and a detailed budget to the [http://www.owasp.org/index.php/Global_Conferences_Committee Global Conferences Committee]. The 2011 schedule is filling up quickly, so get started right away! OWASP Board members will be [http://www.owasp.org/index.php/How_to_Host_a_Conference#tab=BOARD_MEMBER_ROLE participating]in OWASP events as listed below. <br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 GLOBAL APPSEC EVENTS<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction/Keynote<br />
|-<br />
| [http://www.owasp.org/index.php/AppSec_Brasil_2010#tab=About AppSec Brazil]<br />
| November 16th - November 19th<br />
| Campinas, SP, Brazil<br />
| Dinis Cruz<br />
|}<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_AppSec_DC_2010 AppSec DC 2010]<br />
| November 8th - November 11th<br />
| Washington, DC<br />
| U.S. Board Members<br />
|-<br />
|[http://www.owasp.org/index.php/2010_BASC_Homepage Boston Application Security Conference 2010]<br />
| November 20th<br />
| Cambridge, MA<br />
|-<br />
| [http://www.owasp.org/index.php/IBWAS10 IBWAS]<br />
| November 25th - November 26th<br />
| Portugal<br />
| Dinis Cruz<br />
|-<br />
| [[BeNeLux OWASP Day 2010]]<br />
| December 1st - 2nd<br />
| Eindhoven, The Netherlands<br />
| Seba<br />
|}<br />
<br />
== 2010 Conferences and events - Completed ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction<br />
|-<br />
| [[OWASP_AppSec_Research_2010_-_Stockholm,_Sweden|OWASP AppSec Research 2010]] <br />
| June 21st - June 24th<br />
| Stockholm, Sweden<br />
| Dave Wichers, Tom Brennan, Seba<br />
|-<br />
| [http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2010 Froc 2010] <br />
| June 2nd<br />
| Denver, Colorodo, USA<br />
| Tom Brennan<br />
|-<br />
| [[OWASP_Day_Mexico_2010 | OWASP Day Mexico (at Aguascalientes)]]<br />
| June 4th<br />
| Aguascalientes, Mexico<br />
| Tom Brennan<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_Day_Argentina_2010 OWASP Day, Argentina 2010]<br />
|June 30<br />
|Buenos Aries<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 New Zealand Day]<br />
| July 15th<br />
| Auckland, New Zealand<br />
|-<br />
| [[AppSec US 2010, CA]]<br />
| September 7th - September 10th<br />
| Irvine, CA<br />
| Jeff Williams, Tom Brennan, Dave Wichers<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_IRELAND_2010 AppSec Ireland 2010]<br />
| September 17th<br />
| Dublin, Ireland<br />
| Eoin Keary<br />
|-<br />
| [[OWASP AppSec Germany 2010 Conference]]<br />
| October 20th<br />
| Nürnberg, Germany<br />
| Tom Brennan<br />
|-<br />
| [http://rochestersecurity.org Rochester Security Summit]<br />
| October 20th -October 21st<br />
| Rocheter, NY, USA<br />
| TBD<br />
|-<br />
| [http://www.owasp.org/index.php/OWASP_China_Summit_2010 OWASP China Summit 2010]<br />
| October 20th -October 23rd<br />
| Beijing, China<br />
| Tom Brennan<br />
|-<br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON]<br />
| October 29th, 2010<br />
| Austin, TX, USA<br />
| Matt Tesauro<br />
|}<br />
<br />
== 2009 Conferences and Events==<br />
<br />
; November 4th 2009 - [[Italy OWASP Day 4]] <br />
<br />
; November 11th 2009 - [http://www.owasp.org/index.php/Summit_2009 OWASP Global Summit 2009] - Washington, D.C.<br />
<br />
; November 10th-13th 2009 - [[OWASP_AppSec_US_2009_-_Washington_DC |OWASP AppSec US 2009]] - Washington, D.C.<br />
<br />
; November 17-20, 2009 - [http://www.owasp.org/index.php/Category:India App Sec India]<br />
<br />
; December 2nd 2009 - [[BeNeLux_OWASP_Day_2009|BeNeLux Day]]<br />
<br />
; December 10-11, 2009 - [[OWASP AppSec Iberia 2009|IBWAS'09 - Iberic Web Application Security Conference (Spain and Portugal)]] - Madrid, Spain<br />
<br />
; October 13, 2009 - [http://www.owasp.org/index.php/OWASP_AppSec_Germany_2009_Conference#tab=Anmeldung_und_Preise German Conference]<br />
<br />
; October 27-30 2009 - [[AppSec_CPLP_2009 |OWASP AppSec Brazil 2009]]<br />
: Conference and tutorials at Câmara dos Deputados, Anexo II, Praça dos Três Poderes<br />
<br />
; October 28-29 2009 - [http://rochestersecurity.org/ 4th annual Rochester Security Summit]<br />
<br />
; September 10, 2009 - [[OWASP_Ireland_AppSec_2009_Conference|OWASP AppSec Ireland 09]]<br />
<br />
; August 26, 2009 - [[AppSec_Academia_Symposium|AppSec Academia Symposium]]<br />
<br />
; August 24, 2009 [[OWASP_Minneapolis_St_Paul_2009_Conference| Minneapolis/St Paul half day event]]<br />
<br />
; July 2009 - [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]] - New Zealand<br />
: July 13th - 2 track conference, University of Auckland, Auckland, New Zealand (Registrations are Open)<br />
<br />
; May 2009 - [[OWASP_AppSec_Europe_2009_-_Poland |OWASP AppSec Europe 2009]] - Poland<br />
: May 11th-14th - 3 track conference and 8 tutorials, Park In Hotel, Krakow, Poland<br />
<br />
; March 2009 - [[OWASP_Software_Assurance_Day_DC_2009|OWASP Software Assurance Day DC 2009 (in conjunction with the DHS/DOD/NIST Software Assurance Forum)]]<br />
: March 13th, 1-Day Conference in McLean, Virginia<br />
<br />
; March 2009 - [[Front_Range_OWASP_Conference_2009|Front Range OWASP Conference 2009 (aka SNOWFroc)]]<br />
: March 5th, 2nd Annual 1-Day Conference in Denver, Colorado<br />
<br />
; February 2009 - [[OWASP_AU_Conference_2009|OWASP AppSec Australia 2009]] - Gold Coast<br />
: Feb 25th-27th - Training & Conference, Gold Coast Convention Center, QLD Australia<br />
<br />
; February 2009 - [[Italy_OWASP_Day_3 |Day 3 Italy]]<br />
: Feb 23rd - OWASP Day III: "Web Application Security: research meets industry" - Bari (Italy)<br />
<br />
=== 2008 ===<br />
; November 2008 - [[OWASP_Germany_2008_Conference | OWASP Germany Conference]]<br />
: November 25th - 1-Day Conference in Frankfurt, Germany<br />
<br />
; November 2008 - [[OWASP_EU_Summit_2008 | OWASP Summit 2008 - Portugal]]<br />
: November 3rd - 7th - Working Sessions, Conference & Training, Algarve, Portugal<br />
<br />
; October 2008 - [[OWASP AppSec Asia 2008 - Taiwan]]<br />
: October 27th - 28th - NTUH International Convention Centre, Taipei, Taiwan<br />
<br />
; October 2008 - [[OWASP_Minneapolis_St_Paul_2008_Conference | OWASP Minnesota Conference]]<br />
: October 21st - University of Minnesota's St. Paul Student Center<br />
<br />
; September 2008 - [[OWASP_NYC_AppSec_2008_Conference | OWASP AppSec U.S. 2008 - New York City]]<br />
: September 22nd - 25th - Conference & Training, Park Central Hotel, NYC<br />
<br />
; September 2008 - [[OWASP_Israel_2008_Conference | OWASP Israel 2008 - Herzliya, Israel]]<br />
: September 14th - The Interdisciplinary Center Herzliya, Israel<br />
<br />
; August 2008 - [[OWASP_AppSec_India_Conference_2008 | OWASP AppSec India 2008 - Delhi, India]]<br />
: August 20th - 21st - Conference & Training<br />
<br />
; June 10th 2008 - [[Front_Range_Web_Application_Security_Summit_Planning_Page | Front Range Web Application Security Conference]] - Denver, CO<br />
<br />
; May 2008 - [[OWASP_AppSec_Europe_2008_-_Belgium | OWASP AppSec Europe 2008 - Ghent, Belgium]]<br />
: May 19th - 22nd - Conference & Training, Ghent University, Belgium (view [[OWASP_AppSec_Europe_2008_-_Belgium#Agenda_and_Presentations_-_May_21-22|agenda and presentations]])<br />
<br />
; February 2008 - [[OWASP_Australia_AppSec_2008_Conference | OWASP Australia AppSec 2008 Conference]] <br />
: February 27th-29th - Training & Conference, Gold Coast Convention Center, QLD Australia<br />
<br />
=== 2007 ===<br />
; December 2007 - [[OWASP_Israel_2007_Conference | OWASP Israel AppSec 2007 Conference]]<br />
: December 3rd, 2007 - Interdisciplinary Center (IDC) Herzliya, Israel<br />
<br />
; November 2007 - [[OWASP & WASC AppSec 2007 Conference | OWASP & WASC AppSec U.S. 2007 - San Jose, California]]<br />
: November 12-15 - at eBay in San Jose, CA. (view [[7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda#OWASP_.26_WASC_AppSec_2007_Conference_Schedule_-_Nov_14-15_.28San_Jose_2007.29|agenda and presentations]])<br />
<br />
; September 2007 - [[OWASP_AppSec_Asia_2007 | OWASP AppSec Asia 2007 - Taiwan]]<br />
: September 27 - in Taipei, Taiwan. <br />
<br />
; May 2007 - [[OWASP_AppSec_Europe_2007_-_Italy | OWASP AppSec Europe 2007 - Italy]]<br />
: May 15th-17th - in Milan, Italy. (view [[OWASP_AppSec_Europe_2007_-_Italy/Agenda|agenda and presentations]])<br />
<br />
=== 2004-2006 ===<br />
<br />
; October 2006 - [[OWASP AppSec Seattle 2006| OWASP AppSec U.S. 2006 - Seattle, Washington]]<br />
: October 16th-18th - in Seattle, Washington. (view [[OWASP_AppSec_Seattle_2006/Agenda|agenda and presentations]]) <br />
<br />
; May 2006 - [[OWASP AppSec Europe 2006| OWASP AppSec Europe 2006 - Belgium ]]<br />
: Held in Leuven, Belgium (view [[AppSec Europe 2006/Agenda|agenda and presentations]])<br />
<br />
; October 2005 - [[OWASP AppSec Washington 2005|OWASP AppSec U.S. 2005 - Washington D.C.]]<br />
: Held at NIST in Gaithersburg, MD (view [[AppSec Washington 2005/Agenda|agenda and presentations]])<br />
<br />
; April 2005 - [[OWASP AppSec Europe 2005|OWASP AppSec Europe 2005 - London]]<br />
: Held at Royal Holloway University in London (view [[AppSec Europe 2005/Agenda|agenda and presentations]])<br />
<br />
; November 2004 - [[OWASP AppSec NYC 2004|OWASP AppSec U.S. 2004 - New York City]]<br />
: Held at Stevens Institute in New Jersey (view [[AppSec NYC 2004|agenda and presentations]])<br />
<br />
<center><br><br />
More [http://www.owasp.org/index.php/Category:OWASP_AppSec_Conference-archive Conference Archives - Click Here]</center><br />
<br />
<br />
[[Category:OWASP AppSec Conference]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Category:OWASP_AppSec_Conference&diff=99711Category:OWASP AppSec Conference2011-01-10T23:49:39Z<p>Wickett: </p>
<hr />
<div>__NOTOC__<br />
The OWASP AppSec conference series is dedicated to bringing together industry, government, and security researchers and practitioners to discuss the state of the art in application security. This series was launched in the U.S. in the Fall of 2004 and in Europe in the Spring of 2005 and this has rapidly grown into a world wide phenomenon which now includes the U.S., Europe, Asia, Australia, and Israel. All of the presentations from our previous conferences can be downloaded from the agenda pages for each conference.<br />
<br />
Check out OWASP's conferences for the past two years on [http://maps.google.com/maps/ms?hl=en&gl=us&ie=UTF8&oe=UTF8&msa=0&msid=102471112605576686928.00046255c51af35309c77 Google Maps].<br />
<br />
<br />
==2011 Conferences Schedule==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2011 GLOBAL APPSEC EVENTS<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction/Keynote<br />
|-<br />
|[[Summit_2011|OWASP Summit 2011]]<br />
| February 8th - February 11th<br />
| Lisbon (Torres Vedras), Portugal<br />
| Entire Board, Commitee Members<br />
|-<br />
| Global AppSec North America<br />
| September 19th - September 23rd<br />
| Minneapolis, MN, USA<br />
| Entire Board<br />
|-<br />
| Global AppSec Europe<br />
| June (TBC)<br />
| TBC<br />
| Entire Board<br />
|-<br />
| Global AppSec South America <br />
| October 11 - 14th 2011<br />
| Porto Alegre, Brazil<br />
| TBD<br />
<br />
|}<br />
<br />
== 2011 Conferences and events ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2011 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction<br />
|-<br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON]<br />
| October 28th, 2011<br />
| Austin, TX, USA<br />
| TBD<br />
|}<br />
<br />
<br />
<br />
<br />
<br />
==2010 Conferences Schedule==<br />
<br />
Local chapters can plan half or full-day events in their region, please [https://spreadsheets.google.com/a/owasp.org/viewform?hl=en&formkey=dFN1R2NIMTNROXN3dml4ZEcxXzJQYXc6MQ#gid=0 Contact Us] for support getting your event organized.<br />
<br />
For information on planning an official OWASP Foundation AppSec conferences with sponsors, please refer to [[How_to_Host_a_Conference]].<br />
<br />
<b>The Call for 2011 Conferences is now open.</b> Planning a great event takes time, so if you wish to host a conference in 2011 please submit a proposal detailing the venue and a detailed budget to the [http://www.owasp.org/index.php/Global_Conferences_Committee Global Conferences Committee]. The 2011 schedule is filling up quickly, so get started right away! OWASP Board members will be [http://www.owasp.org/index.php/How_to_Host_a_Conference#tab=BOARD_MEMBER_ROLE participating]in OWASP events as listed below. <br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 GLOBAL APPSEC EVENTS<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction/Keynote<br />
|-<br />
| [http://www.owasp.org/index.php/AppSec_Brasil_2010#tab=About AppSec Brazil]<br />
| November 16th - November 19th<br />
| Campinas, SP, Brazil<br />
| Dinis Cruz<br />
|}<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_AppSec_DC_2010 AppSec DC 2010]<br />
| November 8th - November 11th<br />
| Washington, DC<br />
| U.S. Board Members<br />
|-<br />
|[http://www.owasp.org/index.php/2010_BASC_Homepage Boston Application Security Conference 2010]<br />
| November 20th<br />
| Cambridge, MA<br />
|-<br />
| [http://www.owasp.org/index.php/IBWAS10 IBWAS]<br />
| November 25th - November 26th<br />
| Portugal<br />
| Dinis Cruz<br />
|-<br />
| [[BeNeLux OWASP Day 2010]]<br />
| December 1st - 2nd<br />
| Eindhoven, The Netherlands<br />
| Seba<br />
|}<br />
<br />
== 2010 Conferences and events - Completed ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! 2010 Regional And Local Events<br />
! DATE<br />
! LOCATION<br />
! OWASP Introduction<br />
|-<br />
| [[OWASP_AppSec_Research_2010_-_Stockholm,_Sweden|OWASP AppSec Research 2010]] <br />
| June 21st - June 24th<br />
| Stockholm, Sweden<br />
| Dave Wichers, Tom Brennan, Seba<br />
|-<br />
| [http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2010 Froc 2010] <br />
| June 2nd<br />
| Denver, Colorodo, USA<br />
| Tom Brennan<br />
|-<br />
| [[OWASP_Day_Mexico_2010 | OWASP Day Mexico (at Aguascalientes)]]<br />
| June 4th<br />
| Aguascalientes, Mexico<br />
| Tom Brennan<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_Day_Argentina_2010 OWASP Day, Argentina 2010]<br />
|June 30<br />
|Buenos Aries<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_New_Zealand_Day_2010 New Zealand Day]<br />
| July 15th<br />
| Auckland, New Zealand<br />
|-<br />
| [[AppSec US 2010, CA]]<br />
| September 7th - September 10th<br />
| Irvine, CA<br />
| Jeff Williams, Tom Brennan, Dave Wichers<br />
|-<br />
|[http://www.owasp.org/index.php/OWASP_IRELAND_2010 AppSec Ireland 2010]<br />
| September 17th<br />
| Dublin, Ireland<br />
| Eoin Keary<br />
|-<br />
| [[OWASP AppSec Germany 2010 Conference]]<br />
| October 20th<br />
| Nürnberg, Germany<br />
| Tom Brennan<br />
|-<br />
| [http://rochestersecurity.org Rochester Security Summit]<br />
| October 20th -October 21st<br />
| Rocheter, NY, USA<br />
| TBD<br />
|-<br />
| [http://www.owasp.org/index.php/OWASP_China_Summit_2010 OWASP China Summit 2010]<br />
| October 20th -October 23rd<br />
| Beijing, China<br />
| Tom Brennan<br />
|-<br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON]<br />
| October 29th, 2010<br />
| Austin, TX, USA<br />
| Matt Tesauro<br />
|}<br />
<br />
== 2009 Conferences and Events==<br />
<br />
; November 4th 2009 - [[Italy OWASP Day 4]] <br />
<br />
; November 11th 2009 - [http://www.owasp.org/index.php/Summit_2009 OWASP Global Summit 2009] - Washington, D.C.<br />
<br />
; November 10th-13th 2009 - [[OWASP_AppSec_US_2009_-_Washington_DC |OWASP AppSec US 2009]] - Washington, D.C.<br />
<br />
; November 17-20, 2009 - [http://www.owasp.org/index.php/Category:India App Sec India]<br />
<br />
; December 2nd 2009 - [[BeNeLux_OWASP_Day_2009|BeNeLux Day]]<br />
<br />
; December 10-11, 2009 - [[OWASP AppSec Iberia 2009|IBWAS'09 - Iberic Web Application Security Conference (Spain and Portugal)]] - Madrid, Spain<br />
<br />
; October 13, 2009 - [http://www.owasp.org/index.php/OWASP_AppSec_Germany_2009_Conference#tab=Anmeldung_und_Preise German Conference]<br />
<br />
; October 27-30 2009 - [[AppSec_CPLP_2009 |OWASP AppSec Brazil 2009]]<br />
: Conference and tutorials at Câmara dos Deputados, Anexo II, Praça dos Três Poderes<br />
<br />
; October 28-29 2009 - [http://rochestersecurity.org/ 4th annual Rochester Security Summit]<br />
<br />
; September 10, 2009 - [[OWASP_Ireland_AppSec_2009_Conference|OWASP AppSec Ireland 09]]<br />
<br />
; August 26, 2009 - [[AppSec_Academia_Symposium|AppSec Academia Symposium]]<br />
<br />
; August 24, 2009 [[OWASP_Minneapolis_St_Paul_2009_Conference| Minneapolis/St Paul half day event]]<br />
<br />
; July 2009 - [[OWASP_New_Zealand_Day_2009|OWASP New Zealand Day 2009]] - New Zealand<br />
: July 13th - 2 track conference, University of Auckland, Auckland, New Zealand (Registrations are Open)<br />
<br />
; May 2009 - [[OWASP_AppSec_Europe_2009_-_Poland |OWASP AppSec Europe 2009]] - Poland<br />
: May 11th-14th - 3 track conference and 8 tutorials, Park In Hotel, Krakow, Poland<br />
<br />
; March 2009 - [[OWASP_Software_Assurance_Day_DC_2009|OWASP Software Assurance Day DC 2009 (in conjunction with the DHS/DOD/NIST Software Assurance Forum)]]<br />
: March 13th, 1-Day Conference in McLean, Virginia<br />
<br />
; March 2009 - [[Front_Range_OWASP_Conference_2009|Front Range OWASP Conference 2009 (aka SNOWFroc)]]<br />
: March 5th, 2nd Annual 1-Day Conference in Denver, Colorado<br />
<br />
; February 2009 - [[OWASP_AU_Conference_2009|OWASP AppSec Australia 2009]] - Gold Coast<br />
: Feb 25th-27th - Training & Conference, Gold Coast Convention Center, QLD Australia<br />
<br />
; February 2009 - [[Italy_OWASP_Day_3 |Day 3 Italy]]<br />
: Feb 23rd - OWASP Day III: "Web Application Security: research meets industry" - Bari (Italy)<br />
<br />
=== 2008 ===<br />
; November 2008 - [[OWASP_Germany_2008_Conference | OWASP Germany Conference]]<br />
: November 25th - 1-Day Conference in Frankfurt, Germany<br />
<br />
; November 2008 - [[OWASP_EU_Summit_2008 | OWASP Summit 2008 - Portugal]]<br />
: November 3rd - 7th - Working Sessions, Conference & Training, Algarve, Portugal<br />
<br />
; October 2008 - [[OWASP AppSec Asia 2008 - Taiwan]]<br />
: October 27th - 28th - NTUH International Convention Centre, Taipei, Taiwan<br />
<br />
; October 2008 - [[OWASP_Minneapolis_St_Paul_2008_Conference | OWASP Minnesota Conference]]<br />
: October 21st - University of Minnesota's St. Paul Student Center<br />
<br />
; September 2008 - [[OWASP_NYC_AppSec_2008_Conference | OWASP AppSec U.S. 2008 - New York City]]<br />
: September 22nd - 25th - Conference & Training, Park Central Hotel, NYC<br />
<br />
; September 2008 - [[OWASP_Israel_2008_Conference | OWASP Israel 2008 - Herzliya, Israel]]<br />
: September 14th - The Interdisciplinary Center Herzliya, Israel<br />
<br />
; August 2008 - [[OWASP_AppSec_India_Conference_2008 | OWASP AppSec India 2008 - Delhi, India]]<br />
: August 20th - 21st - Conference & Training<br />
<br />
; June 10th 2008 - [[Front_Range_Web_Application_Security_Summit_Planning_Page | Front Range Web Application Security Conference]] - Denver, CO<br />
<br />
; May 2008 - [[OWASP_AppSec_Europe_2008_-_Belgium | OWASP AppSec Europe 2008 - Ghent, Belgium]]<br />
: May 19th - 22nd - Conference & Training, Ghent University, Belgium (view [[OWASP_AppSec_Europe_2008_-_Belgium#Agenda_and_Presentations_-_May_21-22|agenda and presentations]])<br />
<br />
; February 2008 - [[OWASP_Australia_AppSec_2008_Conference | OWASP Australia AppSec 2008 Conference]] <br />
: February 27th-29th - Training & Conference, Gold Coast Convention Center, QLD Australia<br />
<br />
=== 2007 ===<br />
; December 2007 - [[OWASP_Israel_2007_Conference | OWASP Israel AppSec 2007 Conference]]<br />
: December 3rd, 2007 - Interdisciplinary Center (IDC) Herzliya, Israel<br />
<br />
; November 2007 - [[OWASP & WASC AppSec 2007 Conference | OWASP & WASC AppSec U.S. 2007 - San Jose, California]]<br />
: November 12-15 - at eBay in San Jose, CA. (view [[7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda#OWASP_.26_WASC_AppSec_2007_Conference_Schedule_-_Nov_14-15_.28San_Jose_2007.29|agenda and presentations]])<br />
<br />
; September 2007 - [[OWASP_AppSec_Asia_2007 | OWASP AppSec Asia 2007 - Taiwan]]<br />
: September 27 - in Taipei, Taiwan. <br />
<br />
; May 2007 - [[OWASP_AppSec_Europe_2007_-_Italy | OWASP AppSec Europe 2007 - Italy]]<br />
: May 15th-17th - in Milan, Italy. (view [[OWASP_AppSec_Europe_2007_-_Italy/Agenda|agenda and presentations]])<br />
<br />
=== 2004-2006 ===<br />
<br />
; October 2006 - [[OWASP AppSec Seattle 2006| OWASP AppSec U.S. 2006 - Seattle, Washington]]<br />
: October 16th-18th - in Seattle, Washington. (view [[OWASP_AppSec_Seattle_2006/Agenda|agenda and presentations]]) <br />
<br />
; May 2006 - [[OWASP AppSec Europe 2006| OWASP AppSec Europe 2006 - Belgium ]]<br />
: Held in Leuven, Belgium (view [[AppSec Europe 2006/Agenda|agenda and presentations]])<br />
<br />
; October 2005 - [[OWASP AppSec Washington 2005|OWASP AppSec U.S. 2005 - Washington D.C.]]<br />
: Held at NIST in Gaithersburg, MD (view [[AppSec Washington 2005/Agenda|agenda and presentations]])<br />
<br />
; April 2005 - [[OWASP AppSec Europe 2005|OWASP AppSec Europe 2005 - London]]<br />
: Held at Royal Holloway University in London (view [[AppSec Europe 2005/Agenda|agenda and presentations]])<br />
<br />
; November 2004 - [[OWASP AppSec NYC 2004|OWASP AppSec U.S. 2004 - New York City]]<br />
: Held at Stevens Institute in New Jersey (view [[AppSec NYC 2004|agenda and presentations]])<br />
<br />
<center><br><br />
More [http://www.owasp.org/index.php/Category:OWASP_AppSec_Conference-archive Conference Archives - Click Here]</center><br />
<br />
<br />
[[Category:OWASP AppSec Conference]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=91349Lonestar Application Security Conference 20102010-10-13T15:36:25Z<p>Wickett: /* Registration Is Now Open! */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Registration Link] | Speaker List Posted! | [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
'''Sorry, the CFP has ended for LASCON 2010. Maybe next year?'''<br />
<!--<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
--><br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Register Here]<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members (Includes a 1 year OWASP membership)<br />
| $150 Until 10/26/2010 <br />
| $200 After 10/26/2010<br />
|-<br />
| OWASP Members <br />
| $100 Until 10/26/2010 <br />
| $150 After 10/26/2010<br />
|-<br />
| Students with valid Student ID (must be shown at the door) <br />
| $80 Until 10/26/2010 <br />
| $130 After 10/26/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)owasp.org to volunteer for a specific area: <br />
<br />
*Room Monitors<br />
*Speakers and Trainers <br />
*Vendors <br />
*Registration<br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
<br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
We have partnered with the Embassy Suites in the Arboretum and you can book rooms at using the discount code: LAS at 1-800-362-2779 or you can <br />
[http://embassysuites.hilton.com/en/es/groups/personalized/AUSESES-LAS-20101025/index.jhtml?WT.mc_id=POG Book your room online.]<br />
<br />
Embassy Suites Austin - Arboretum<br />
9505 Stonelake Boulevard<br />
Austin, Texas <br />
78759<br />
<br />
The rooms are $139 for a double or queen, includes hot breakfast and shuttle to/from the event.<br />
<br />
[http://embassysuites.hilton.com/en/es/groups/personalized/AUSESES-LAS-20101025/index.jhtml?WT.mc_id=POG Book your room online with the LASCON discount.]<br />
<br />
==== Sponsors ====<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| '''YOUR COMPANY NAME AND LOGO COULD BE HERE'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
| [[Image:Whitehat.jpg|274px|link=http://www.whitehatsec.com]]<br />
| [[Image:Splunk.jpg|link=http://www.splunk.com]]<br />
| [[Image:Impactsecurityllc.png|link=http://www.impactsecurityllc.net]]<br>'''Impact Security LLC'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:K2share.gif|150px|link=http://www.k2share.com]]<br />
| [[Image:Dexa.jpg|150px|link=http://www.dexasystems.com]]<br />
| [[Image:Expandingsecurity.jpg|150px|link=http://www.expandingsecurity.com]]<br>'''Expanding Security'''<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|-<br />
| &nbsp; &nbsp; &nbsp; &nbsp; [[Image:Fortify.png|150px|link=http://www.fortify.com]]<br />
| [[Image:Veracode.gif|150px|link=http://www.veracode.com]]<br />
| [[Image:Praetorian.jpg|150px|link=http://www.praetorian.com]]<br />
| [[Image:Denim-group.png|150px|link=http://www.denimgroup.com]]<br />
|}<br />
<br />
== Badge Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
<br />
<br />
==== Sponsorship Options ====<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=90425Lonestar Application Security Conference 20102010-09-30T19:28:04Z<p>Wickett: /* Silver Sponsors */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Registration Link] | Speaker List Posted! | [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
'''Sorry, the CFP has ended for LASCON 2010. Maybe next year?'''<br />
<!--<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
--><br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Register Here]<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members (Includes a 1 year OWASP membership)<br />
| $100 Until 9/24/2010 <br />
| $150 After 9/24/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/24/2010 <br />
| $100 After 9/24/2010<br />
|-<br />
| Students with valid Student ID (must be shown at the door) <br />
| $30 Until 9/24/2010 <br />
| $50 After 9/24/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)owasp.org to volunteer for a specific area: <br />
<br />
*Room Monitors<br />
*Speakers and Trainers <br />
*Vendors <br />
*Registration<br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
<br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
We have partnered with the Embassy Suites in the Arboretum and you can book rooms at using the discount code: LAS at 1-800-362-2779 or you can <br />
[http://embassysuites.hilton.com/en/es/groups/personalized/AUSESES-LAS-20101025/index.jhtml?WT.mc_id=POG Book your room online.]<br />
<br />
Embassy Suites Austin - Arboretum<br />
9505 Stonelake Boulevard<br />
Austin, Texas <br />
78759<br />
<br />
The rooms are $139 for a double or queen, includes hot breakfast and shuttle to/from the event.<br />
<br />
[http://embassysuites.hilton.com/en/es/groups/personalized/AUSESES-LAS-20101025/index.jhtml?WT.mc_id=POG Book your room online with the LASCON discount.]<br />
<br />
==== Sponsors ====<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| '''YOUR COMPANY NAME AND LOGO COULD BE HERE'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
| [[Image:Whitehat.jpg|274px|link=http://www.whitehatsec.com]]<br />
| [[Image:Splunk.jpg|link=http://www.splunk.com]]<br />
| [[Image:Impactsecurityllc.png|link=http://www.impactsecurityllc.net]]<br>'''Impact Security LLC'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:K2share.gif|150px|link=http://www.k2share.com]]<br />
| [[Image:Dexa.jpg|150px|link=http://www.dexasystems.com]]<br />
| [[Image:Expandingsecurity.jpg|150px|link=http://www.expandingsecurity.com]]<br>'''Expanding Security'''<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|-<br />
| &nbsp; &nbsp; &nbsp; &nbsp; [[Image:Fortify.png|150px|link=http://www.fortify.com]]<br />
| [[Image:Veracode.gif|150px|link=http://www.veracode.com]]<br />
| [[Image:Praetorian.jpg|150px|link=http://www.praetorian.com]]<br />
| [[Image:Denim-group.png|150px|link=http://www.denimgroup.com]]<br />
|}<br />
<br />
== Badge Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
<br />
<br />
==== Sponsorship Options ====<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=File:Denim-group.png&diff=90424File:Denim-group.png2010-09-30T19:26:58Z<p>Wickett: </p>
<hr />
<div></div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=89276Lonestar Application Security Conference 20102010-09-14T15:57:22Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Registration Link] | Speaker List Posted! | [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
'''Sorry, the CFP has ended for LASCON 2010. Maybe next year?'''<br />
<!--<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
--><br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Register Here]<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members (Includes a 1 year OWASP membership)<br />
| $100 Until 9/24/2010 <br />
| $150 After 9/24/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/24/2010 <br />
| $100 After 9/24/2010<br />
|-<br />
| Students with valid Student ID (must be shown at the door) <br />
| $30 Until 9/24/2010 <br />
| $50 After 9/24/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)owasp.org to volunteer for a specific area: <br />
<br />
*Room Monitors<br />
*Speakers and Trainers <br />
*Vendors <br />
*Registration<br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
<br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
We have partnered with the Embassy Suites in the Arboretum and you can book rooms at using the discount code: LAS at 1-800-362-2779 or you can <br />
[http://embassysuites.hilton.com/en/es/groups/personalized/AUSESES-LAS-20101025/index.jhtml?WT.mc_id=POG Book your room online.]<br />
<br />
Embassy Suites Austin - Arboretum<br />
9505 Stonelake Boulevard<br />
Austin, Texas <br />
78759<br />
<br />
The rooms are $139 for a double or queen, includes hot breakfast and shuttle to/from the event.<br />
<br />
[http://embassysuites.hilton.com/en/es/groups/personalized/AUSESES-LAS-20101025/index.jhtml?WT.mc_id=POG Book your room online with the LASCON discount.]<br />
<br />
==== Sponsors ====<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| '''YOUR COMPANY NAME AND LOGO COULD BE HERE'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
| [[Image:Whitehat.jpg|274px|link=http://www.whitehatsec.com]]<br />
| [[Image:Splunk.jpg|link=http://www.splunk.com]]<br />
| [[Image:Impactsecurityllc.png|link=http://www.impactsecurityllc.net]]<br>'''Impact Security LLC'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:K2share.gif|150px|link=http://www.k2share.com]]<br />
| [[Image:Dexa.jpg|150px|link=http://www.dexasystems.com]]<br />
| [[Image:Expandingsecurity.jpg|150px|link=http://www.expandingsecurity.com]]<br>'''Expanding Security'''<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|-<br />
| &nbsp; &nbsp; &nbsp; &nbsp; [[Image:Fortify.png|150px|link=http://www.fortify.com]]<br />
| [[Image:Veracode.gif|150px|link=http://www.veracode.com]]<br />
| [[Image:Praetorian.jpg|150px|link=http://www.praetorian.com]]<br />
|}<br />
== Badge Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
<br />
<br />
==== Sponsorship Options ====<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=89264Lonestar Application Security Conference 20102010-09-14T14:45:20Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Registration Link] | Bummer dude, the Call For Papers is over, but the speaker list is coming soon | [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
'''Sorry, the CFP has ended for LASCON 2010. Maybe next year?'''<br />
<!--<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
--><br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Register Here]<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members (Includes a 1 year OWASP membership)<br />
| $100 Until 9/24/2010 <br />
| $150 After 9/24/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/24/2010 <br />
| $100 After 9/24/2010<br />
|-<br />
| Students with valid Student ID (must be shown at the door) <br />
| $30 Until 9/24/2010 <br />
| $50 After 9/24/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)owasp.org to volunteer for a specific area: <br />
<br />
*Room Monitors<br />
*Speakers and Trainers <br />
*Vendors <br />
*Registration<br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
<br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
We have partnered with the Embassy Suites in the Arboretum and will have a discount code and link for registration shortly. <br />
<br />
==== Sponsors ====<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| '''YOUR COMPANY NAME AND LOGO COULD BE HERE'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
| [[Image:Whitehat.jpg|274px|link=http://www.whitehatsec.com]]<br />
| [[Image:Splunk.jpg|link=http://www.splunk.com]]<br />
| [[Image:Impactsecurityllc.png|link=http://www.impactsecurityllc.net]]<br>'''Impact Security LLC'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:K2share.gif|150px|link=http://www.k2share.com]]<br />
| [[Image:Dexa.jpg|150px|link=http://www.dexasystems.com]]<br />
| [[Image:Expandingsecurity.jpg|150px|link=http://www.expandingsecurity.com]]<br>'''Expanding Security'''<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|-<br />
| &nbsp; &nbsp; &nbsp; &nbsp; [[Image:Fortify.png|150px|link=http://www.fortify.com]]<br />
| [[Image:Veracode.gif|150px|link=http://www.veracode.com]]<br />
| [[Image:Praetorian.jpg|150px|link=http://www.praetorian.com]]<br />
|}<br />
== Badge Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
<br />
<br />
==== Sponsorship Options ====<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=89262Lonestar Application Security Conference 20102010-09-14T14:16:26Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Registration Link] | Bummer dude, the Call For Papers is over, but the speaker list is coming soon | [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br><br />
[[Image:LACON2010Schedule.png|800px|link=http://www.lascon.org|LASCON 2010 Schedule]]<br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
'''Sorry, the CFP has ended for LASCON 2010. Maybe next year?'''<br />
<!--<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
--><br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Register Here]<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members (Includes a 1 year OWASP membership)<br />
| $100 Until 9/24/2010 <br />
| $150 After 9/24/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/24/2010 <br />
| $100 After 9/24/2010<br />
|-<br />
| Students with valid Student ID (must be shown at the door) <br />
| $30 Until 9/24/2010 <br />
| $50 After 9/24/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)owasp.org to volunteer for a specific area: <br />
<br />
*Room Monitors<br />
*Speakers and Trainers <br />
*Vendors <br />
*Registration<br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
<br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
We have partnered with the Embassy Suites in the Arboretum and will have a discount code and link for registration shortly. <br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| '''YOUR COMPANY NAME AND LOGO COULD BE HERE'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
| [[Image:Whitehat.jpg|274px|link=http://www.whitehatsec.com]]<br />
| [[Image:Splunk.jpg|link=http://www.splunk.com]]<br />
| [[Image:Impactsecurityllc.png|link=http://www.impactsecurityllc.net]]<br>'''Impact Security LLC'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:K2share.gif|150px|link=http://www.k2share.com]]<br />
| [[Image:Dexa.jpg|150px|link=http://www.dexasystems.com]]<br />
| [[Image:Expandingsecurity.jpg|150px|link=http://www.expandingsecurity.com]]<br>'''Expanding Security'''<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|-<br />
| &nbsp; &nbsp; &nbsp; &nbsp; [[Image:Fortify.png|150px|link=http://www.fortify.com]]<br />
| [[Image:Veracode.gif|150px|link=http://www.veracode.com]]<br />
| [[Image:Praetorian.jpg|150px|link=http://www.praetorian.com]]<br />
|}<br />
== Badge Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=88502Lonestar Application Security Conference 20102010-09-01T19:48:10Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Registration Link] | Bummer dude, the Call For Papers is over, but the speaker list is coming soon | [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Register Here]<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| '''YOUR COMPANY NAME AND LOGO COULD BE HERE'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
| [[Image:Whitehat.jpg|274px|link=http://www.whitehatsec.com]]<br />
| [[Image:Splunk.jpg|link=http://www.splunk.com]]<br />
| [[Image:Impactsecurityllc.png|link=http://www.impactsecurityllc.net]]<br>'''Impact Security LLC'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:K2share.gif|150px|link=http://www.k2share.com]]<br />
| [[Image:Dexa.jpg|150px|link=http://www.dexasystems.com]]<br />
| [[Image:Expandingsecurity.jpg|150px|link=http://www.expandingsecurity.com]]<br>'''Expanding Security'''<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|-<br />
| &nbsp; &nbsp; &nbsp; &nbsp; [[Image:Fortify.png|150px|link=http://www.fortify.com]]<br />
| [[Image:Veracode.gif|150px|link=http://www.veracode.com]]<br />
| [[Image:Praetorian.jpg|150px|link=http://www.praetorian.com]]<br />
|}<br />
== Badge Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=88501Lonestar Application Security Conference 20102010-09-01T19:46:52Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Registration Link] | [http://www.easychair.org/conferences/?conf=lascon2010 Hey Speakers! Submit Proposals Here] | [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''[http://guest.cvent.com/d/vdqf7g/4W You can register for the conference here]''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Register Here]<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| '''YOUR COMPANY NAME AND LOGO COULD BE HERE'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
| [[Image:Whitehat.jpg|274px|link=http://www.whitehatsec.com]]<br />
| [[Image:Splunk.jpg|link=http://www.splunk.com]]<br />
| [[Image:Impactsecurityllc.png|link=http://www.impactsecurityllc.net]]<br>'''Impact Security LLC'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:K2share.gif|150px|link=http://www.k2share.com]]<br />
| [[Image:Dexa.jpg|150px|link=http://www.dexasystems.com]]<br />
| [[Image:Expandingsecurity.jpg|150px|link=http://www.expandingsecurity.com]]<br>'''Expanding Security'''<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|-<br />
| &nbsp; &nbsp; &nbsp; &nbsp; [[Image:Fortify.png|150px|link=http://www.fortify.com]]<br />
| [[Image:Veracode.gif|150px|link=http://www.veracode.com]]<br />
| [[Image:Praetorian.jpg|150px|link=http://www.praetorian.com]]<br />
|}<br />
== Badge Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=88479Lonestar Application Security Conference 20102010-09-01T14:32:56Z<p>Wickett: /* LASCON is happening on October 29th, 2010 in Austin, TX */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Registration Link] | [http://www.easychair.org/conferences/?conf=lascon2010 Hey Speakers! Submit Proposals Here] | [http://twitter.com/LASCONATX Follow LASCONATX on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interested in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Is Now Open! ==<br />
<br />
[http://guest.cvent.com/d/vdqf7g/4W Register Here]<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
== Platinum Sponsors ==<br />
{|<br />
|-<br />
| '''YOUR COMPANY NAME AND LOGO COULD BE HERE'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Gold Sponsors ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
| [[Image:Whitehat.jpg|274px|link=http://www.whitehatsec.com]]<br />
| [[Image:Splunk.jpg|link=http://www.splunk.com]]<br />
| [[Image:Impactsecurityllc.png|link=http://www.impactsecurityllc.net]]<br>'''Impact Security LLC'''<br />
|-<br />
| &nbsp;<br />
|}<br />
== Silver Sponsors ==<br />
{|<br />
|-<br />
| [[Image:K2share.gif|150px|link=http://www.k2share.com]]<br />
| [[Image:Dexa.jpg|150px|link=http://www.dexasystems.com]]<br />
| [[Image:Expandingsecurity.jpg|150px|link=http://www.expandingsecurity.com]]<br>'''Expanding Security'''<br />
| [[Image:Trustwave.jpg|150px|link=http://www.trustwave.com]]<br />
|-<br />
| &nbsp; &nbsp; &nbsp; &nbsp; [[Image:Fortify.png|150px|link=http://www.fortify.com]]<br />
| [[Image:Veracode.gif|150px|link=http://www.veracode.com]]<br />
| [[Image:Praetorian.jpg|150px|link=http://www.praetorian.com]]<br />
|}<br />
== Badge Sponsor ==<br />
{|<br />
|-<br />
| [[Image:Gemalto.jpg|185px|link=http://www.gemalto.com]]<br />
|-<br />
| &nbsp;<br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=86870Austin2010-07-26T21:33:11Z<p>Wickett: </p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:josh.sokol@ni.com Josh Sokol, President], [mailto:wickett@gmail.com James Wickett, Vice President], [mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair], [mailto:ggenung@denimgroup.com Greg Genung, Membership Chair], and the former chapter president is [mailto:cdewitt@indepthsec.com Cris Dewitt]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br />
{| cellspacing="5" cellpadding="5" border="0" width="600"<br />
|-<br />
| [[Image:OWASP Lascon Logo.gif|right|117x87px]] <br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 Austin OWASP is hosting LASCON 2010 Lonestar Application Security Conference 2010]<br />
| [http://austinowasp.ning.com/ Austin OWASP Ning Site]<br />
<br />
|}<br />
<br />
<br> <br />
<br />
<br> <br />
<br />
==== Chapter Meetings ====<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett (512) 964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
== Future Speakers and Events ==<br />
<br />
July 27, 2010 - Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security (@ National Instruments) <br />
<br />
August 12, 2010 - Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
August 31, 2010 - Application Assessments Reloaded (@ National Instruments) <br />
<br />
September 16, 2010 - Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
September 28, 2010 - Technology and Business Risk Management: How Application Security Fits In (@ National Instruments) <br />
<br />
October 26, 2010 - No Meeting (Come to [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010!]) <br />
<br />
October 29, 2010 - [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010] (@ Norris Conference Center, Austin, TX) <br />
<br />
November 2010 - No Meeting (Happy Holidays!) <br />
<br />
December 2010 - No Meeting (Happy Holidays!) <br />
<br />
==== Record Hall of Meetings ====<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716 begin_of_the_skype_highlighting (512) 619-6716 end_of_the_skype_highlighting. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
==== Presentation Archives ====<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization]<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System]<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More]<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
==== Austin OWASP Whitepapers ====<br />
<br />
*Whitepapers go here<br />
<br />
<br> <br />
<br />
==== Austin OWASP Chapter Leaders ====<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
[mailto:sfoster@austinnetworking.com Scott Foster, Membership Chair] - (512) 637-9824 <br />
<br />
==== Sponsorship Opportunities ====<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.whitehatsec.com WhiteHat Security], [http://www.expandingsecurity.com Expanding Security], the [http://www.denimgroup.com Denim Group], [http://www.fortify.com Fortify], [http://www.bluecoat.com/ Blue Coat Systems], [http://www.setsolutions.com Set Solutions], and [http://www.praetorian.com Praetorian] for their sponsorships during the past year. <br />
<br />
==== Local News ====<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=86869Austin2010-07-26T21:32:28Z<p>Wickett: </p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:josh.sokol@ni.com Josh Sokol, President], [mailto:wickett@gmail.com James Wickett, Vice President], [mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair], [mailto:ggenung@denimgroup.com Greg Genung, Membership Chair], and the former chapter president is [mailto:cdewitt@indepthsec.com Cris Dewitt]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br />
{| cellspacing="5" cellpadding="5" border="0" width="600"<br />
|-<br />
| [[Image:OWASP Lascon Logo.gif|right|117x87px]] <br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 Austin OWASP is hosting LASCON 2010 Lonestar Application Security Conference 2010]<br />
| [http://austinowasp.ning.com/ Austin OWASP Ning Site]<br />
<br />
|}<br />
<br />
<br> <br />
<br />
<br> <br />
<br />
==== Chapter Meetings ====<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security<br />
<br />
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors. <br />
<br />
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.<br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
== Future Speakers and Events ==<br />
<br />
July 27, 2010 - Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security (@ National Instruments) <br />
<br />
August 12, 2010 - Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
August 31, 2010 - Application Assessments Reloaded (@ National Instruments) <br />
<br />
September 16, 2010 - Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
September 28, 2010 - Technology and Business Risk Management: How Application Security Fits In (@ National Instruments) <br />
<br />
October 26, 2010 - No Meeting (Come to [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010!]) <br />
<br />
October 29, 2010 - [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010] (@ Norris Conference Center, Austin, TX) <br />
<br />
November 2010 - No Meeting (Happy Holidays!) <br />
<br />
December 2010 - No Meeting (Happy Holidays!) <br />
<br />
==== Record Hall of Meetings ====<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716 begin_of_the_skype_highlighting (512) 619-6716 end_of_the_skype_highlighting. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
==== Presentation Archives ====<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization]<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System]<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More]<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
==== Austin OWASP Whitepapers ====<br />
<br />
*Whitepapers go here<br />
<br />
<br> <br />
<br />
==== Austin OWASP Chapter Leaders ====<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
[mailto:sfoster@austinnetworking.com Scott Foster, Membership Chair] - (512) 637-9824 <br />
<br />
==== Sponsorship Opportunities ====<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.whitehatsec.com WhiteHat Security], [http://www.expandingsecurity.com Expanding Security], the [http://www.denimgroup.com Denim Group], [http://www.fortify.com Fortify], [http://www.bluecoat.com/ Blue Coat Systems], [http://www.setsolutions.com Set Solutions], and [http://www.praetorian.com Praetorian] for their sponsorships during the past year. <br />
<br />
==== Local News ====<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=86649Lonestar Application Security Conference 20102010-07-17T15:04:37Z<p>Wickett: /* LASCON is happening on October 29th, 2010 in Austin, TX */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
Registration Link (Coming soon) | [http://www.easychair.org/conferences/?conf=lascon2010 Hey Speakers! Submit Proposals Here] | [http://twitter.com/LASCON10 Follow LASCON10 on Twitter] | [http://www.norriscenters.com/Austin/ Norris Conference Center]<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
|<br />
<br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=86648Lonestar Application Security Conference 20102010-07-17T15:03:42Z<p>Wickett: /* LASCON is happening on October 29th, 2010 in Austin, TX */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | Registration Link (Coming soon) | [http://www.easychair.org/conferences/?conf=lascon2010 Hey Speakers! Submit Proposals Here] | [http://twitter.com/LASCON10 Follow LASCON10 on Twitter] <br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
|<br />
<br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=86647Lonestar Application Security Conference 20102010-07-17T15:03:16Z<p>Wickett: /* Sponsors */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | Registration Link (Coming soon) | [http://www.easychair.org/conferences/?conf=lascon2010 Submit Proposals] | [http://twitter.com/LASCON10 Follow LASCON10 on Twitter] <br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/2/24/LASCON_Sponsorship_Options.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:james.wickett@owasp.org James Wickett] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:LASCON_2010_Sponsors.jpg]]<br />
<br />
[[Image:LASCON_2010_Additional.jpg]]<br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
|<br />
<br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=86472Lonestar Application Security Conference 20102010-07-14T19:22:53Z<p>Wickett: /* LASCON is happening on October 29th, 2010 in Austin, TX */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | Registration Link (Coming soon) | [http://www.easychair.org/conferences/?conf=lascon2010 Submit Proposals] | [http://twitter.com/LASCON10 Follow LASCON10 on Twitter] <br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/b/b3/OWASP_sponsorship_Irvine.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:kate.hartmann@owasp.org Kate Hartmann] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:IrvineSponsors.png]] <br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
| <br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=86471Lonestar Application Security Conference 20102010-07-14T19:22:26Z<p>Wickett: /* LASCON is happening on October 29th, 2010 in Austin, TX */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | [http:// Registration Link (Coming soon)] | [http://www.easychair.org/conferences/?conf=lascon2010 Submit Proposals] | [http://twitter.com/LASCON10 Follow LASCON10 on Twitter] <br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/b/b3/OWASP_sponsorship_Irvine.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:kate.hartmann@owasp.org Kate Hartmann] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:IrvineSponsors.png]] <br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
| <br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=86470Lonestar Application Security Conference 20102010-07-14T19:21:59Z<p>Wickett: /* LASCON is happening on October 29th, 2010 in Austin, TX */</p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | [http:// Registration Link (Coming soon)] | [http://www.easychair.org/conferences/?conf=lascon2010 Submit Proposals] | [http://twitter.com/LASCON10 Follow LASCON10 on Twitter] \\<br />
<br />
<br> <!-- Header --><br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/b/b3/OWASP_sponsorship_Irvine.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:kate.hartmann@owasp.org Kate Hartmann] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:IrvineSponsors.png]] <br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
| <br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=86469Lonestar Application Security Conference 20102010-07-14T18:37:12Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
===== LASCON is happening on October 29th, 2010 in Austin, TX =====<br />
<br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | [http:// Registration Link (Coming soon)] | [http://www.easychair.org/conferences/?conf=lascon2010 Submit Proposals] <br />
<br />
<br> <!-- Header --> <br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/b/b3/OWASP_sponsorship_Irvine.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:kate.hartmann@owasp.org Kate Hartmann] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:IrvineSponsors.png]] <br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
| <br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=86468Lonestar Application Security Conference 20102010-07-14T18:36:48Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
<br />
== LASCON is happening on October 29th, 2010 in Austin, TX ==<br />
<br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | [http:// Registration Link (Coming soon)] | [http://www.easychair.org/conferences/?conf=lascon2010 Submit Proposals] <br />
<br />
<br> <!-- Header --> <br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/b/b3/OWASP_sponsorship_Irvine.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:kate.hartmann@owasp.org Kate Hartmann] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:IrvineSponsors.png]] <br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
| <br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=85981Lonestar Application Security Conference 20102010-07-08T15:57:18Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | [http:// Registration Link (Coming soon)] | [http://www.easychair.org/conferences/?conf=lascon2010 Submit Proposals] <br />
<br />
<br> <!-- Header --> <br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/b/b3/OWASP_sponsorship_Irvine.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:kate.hartmann@owasp.org Kate Hartmann] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:IrvineSponsors.png]] <br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
| <br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Lonestar_Application_Security_Conference_2010&diff=85980Lonestar Application Security Conference 20102010-07-08T15:56:45Z<p>Wickett: </p>
<hr />
<div>__NOTOC__ <br />
<br />
[[Image:OWASP Lascon Logo.gif|LASCON 2010 Banner]] <br />
<br />
[http://www.norriscenters.com/Austin/ Norris Conference Center] | [http:// Registration Link (Coming soon)] | [http://www.easychair.org/conferences/?conf=lascon2010 Submit Proposals] <br />
<br />
<br> <!-- Header --> <br />
<br />
==== Welcome ====<br />
<br />
{| style="width: 100%;"<br />
|-<br />
| style="width: 100%; color: rgb(0, 0, 0);" | <br />
{| style="background: none repeat scroll 0% 0% transparent; width: 100%; -moz-background-inline-policy: continuous;"<br />
|-<br />
| style="width: 95%; color: rgb(0, 0, 0);" | <br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> '''The full Lonestar Application Security Conference (LASCON) Schedule coming soon.''' <br />
<br />
'''You can register for the conference soon''' <!-- Mediawiki needs all these spaces --> <br />
<br />
<br> <br />
<br />
|}<br />
<br />
<!-- Twitter Box --> <br />
<br />
| style="border: 0px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0);" | <!-- DON'T REMOVE ME, I'M STRUCTURAL <br />
<br />
{|<br />
|-<br />
| style="border: 1px solid rgb(204, 204, 204); width: 100%; font-size: 95%; color: rgb(0, 0, 0); background-color: rgb(236, 236, 236);" | <br />
<!--<br />
Use the '''[https://twitter.com/appsec2010 #AppSec2010]''' hashtag for your tweets (What are [http://hashtags.org/ hashtags]?) <br />
<br />
'''@AppSec2010 Twitter Feed ([https://twitter.com/appsec2010 follow us on Twitter!])''' <twitter>appec2010</twitter>--> <br> <br />
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | <br><br />
|}<br />
<br />
<br><!-- End Banner --> <br />
<br />
==== Call for Papers/Training ====<br />
<br />
OWASP is currently soliciting papers for the Lonestar Application Security Conference (LASCON) 2010 that will take place at the Norris Conference Center in Austin, TX on October 29, 2010. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 <br />
<br />
We are seeking people and organizations that want to present on any of the following topics (in no particular order): <br />
<br />
- Business Risks with Application Security<br />
- Starting and Managing Secure Development Lifecycle Programs<br />
- Web Services and XML Application Security<br />
- Metrics for Application Security<br />
- Application Threat Modeling<br />
- Hands-on Source Code Review<br />
- Web Application Security Testing<br />
- OWASP Tools and Projects<br />
- Secure Coding Practices (J2EE/.NET/Ruby)<br />
- Web Application Security countermeasures<br />
- Technology specific presentations on security such as AJAX, XML, etc<br />
- New Cutting-edge Application Security trends<br />
- Anything else relating to OWASP and Application Security<br />
<br />
<br />
To make a submission you must include&nbsp;: <br />
<br />
- Presenter(s) name(s)<br />
- Presenter(s) Email and/or Phone number(s)<br />
- Presenter(s) bio(s)<br />
- Title<br />
- One Page Abstract<br />
- Links to past presentations (if available)<br />
- Any supporting research/tools (will not be released outside of CFP committee)<br />
<br />
<br> Submission deadline is August 30th at 12PM PST (GMT -8) <br />
<br />
<br />
Not everyone who submits a proposal will be able to get to present at LASCON due to limited timeslots. Also, in no way does sponsorship factor into the CFP committee's selection. Speaking slots are not for sale. <br />
<br />
Submit Proposals to: http://www.easychair.org/conferences/?conf=lascon2010 Conference Website: http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 <br />
<br />
<br> Please forward to all interested practitioners and colleagues. <br />
<br />
<br> <br />
<br />
==== Registration ====<br />
<br />
== Registration Not Yet Open! ==<br />
<br />
OWASP [[Membership]] ($50 annual membership fee) gets you a discount on registration. <br />
<br />
{|<br />
|-<br />
| Non-Members <br />
| $100 Until 9/15/2010 <br />
| $150 After 9/15/2010<br />
|-<br />
| OWASP Members <br />
| $50 Until 9/15/2010 <br />
| $100 After 9/15/2010<br />
|-<br />
| Students with valid Student ID <br />
| $30 Until 9/15/2010 <br />
| $50 After 9/15/2010<br />
|}<br />
<br />
'''Who Should Attend LASCON 2010:''' <br />
<br />
*Application Developers <br />
*Application Testers and Quality Assurance <br />
*Application Project Management and Staff <br />
*Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff <br />
*Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance <br />
*Security Managers and Staff <br />
*Executives, Managers, and Staff Responsible for IT Security Governance <br />
*IT Professionals Interesting in Improving IT Security<br><br />
<br />
<br> For student discount, you must present proof of current enrollment when picking up your badge. No exceptions. <br />
<br />
==== Volunteer ====<br />
<br />
== Volunteers Needed! ==<br />
<br />
Get involved! <br />
<br />
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers! <br />
<br />
<br> Please contact james.wickett(at)ni.com to volunteer for a specific area: <br />
<br />
*Security <br />
*Speakers and Trainers <br />
*Vendors <br />
*Facilities<br />
<br />
More opportunities and areas will be added as time goes on. Our [[Image:Volunteer Sheet.doc]] can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon. <br />
<br />
<br> <br />
<br />
==== Training ====<br />
<br />
Coming Soon <br />
<br />
==== Venue ====<br />
<br />
== Norris Conference Center ==<br />
<br />
LASCON 2010 will be taking place at the [http://www.norriscenters.com/Austin/ Norris Conference Center] in Austin, TX. <br />
<br />
<br> <br />
<br />
==== Hotel ====<br />
<br />
==== Sponsors ====<br />
<br />
== Sponsors ==<br />
<br />
We are currently soliciting sponsors for the LASCON 2010 Conference. Please refer to our [http://www.owasp.org/images/b/b3/OWASP_sponsorship_Irvine.pdf List of Sponsorship Opportunities] <br />
<br />
Please contact [mailto:kate.hartmann@owasp.org Kate Hartmann] for more information. <br />
<br />
Slots are going fast so contact us to sponsor today! <br />
<br />
[[Image:IrvineSponsors.png]] <br />
<br />
{| cellspacing="10" border="0" align="center" style="background: none repeat scroll 0% 0% transparent; -moz-background-inline-policy: continuous; color: white;"<br />
|-<br />
| <br />
== Platinum Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Gold Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
== Silver Sponsors ==<br />
<br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| <br> <br />
| <br> <br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Organizational Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|-<br />
| &nbsp;<br />
|-<br />
| <br />
=== Reception Sponsors ===<br />
<br />
| <br><br />
|-<br />
| <br />
=== Coffee Sponsors ===<br />
<br />
| <br> <br />
| <br><br />
|}<br />
<br />
==== Travel ====<br />
<br />
== Traveling to the Austin Metro Area ==<br />
<br />
<headertabs /> <br />
<br />
[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_AppSec_USA]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=85979Austin2010-07-08T15:40:36Z<p>Wickett: </p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:josh.sokol@ni.com Josh Sokol, President], [mailto:wickett@gmail.com James Wickett, Vice President], [mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair], [mailto:ggenung@denimgroup.com Greg Genung, Membership Chair], and the former chapter president is [mailto:cdewitt@indepthsec.com Cris Dewitt]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br />
{| cellspacing="5" cellpadding="5" border="0" width="600"<br />
|-<br />
| [[Image:OWASP Lascon Logo.gif|right|117x87px]] <br />
| [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 Austin OWASP is hosting LASCON 2010 Lonestar Application Security Conference 2010]<br />
| [http://austinowasp.ning.com/ Austin OWASP Ning Site]<br />
<br />
|}<br />
<br />
<br> <br />
<br />
<br> <br />
<br />
==== Chapter Meetings ====<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security <br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
== Future Speakers and Events ==<br />
<br />
June 29, 2010 - AJAX Security (@ National Instruments) <br />
<br />
July 15 2010 - Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
July 27, 2010 - Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security (@ National Instruments) <br />
<br />
August 12, 2010 - Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
August 31, 2010 - Application Assessments Reloaded (@ National Instruments) <br />
<br />
September 16, 2010 - Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
September 28, 2010 - Technology and Business Risk Management: How Application Security Fits In (@ National Instruments) <br />
<br />
October 26, 2010 - No Meeting (Come to [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010!]) <br />
<br />
October 29, 2010 - [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010] (@ Norris Conference Center, Austin, TX) <br />
<br />
November 2010 - No Meeting (Happy Holidays!) <br />
<br />
December 2010 - No Meeting (Happy Holidays!) <br />
<br />
==== Record Hall of Meetings ====<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716 begin_of_the_skype_highlighting (512) 619-6716 end_of_the_skype_highlighting. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
==== Presentation Archives ====<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization]<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System]<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More]<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
==== Austin OWASP Whitepapers ====<br />
<br />
*Whitepapers go here<br />
<br />
<br> <br />
<br />
==== Austin OWASP Chapter Leaders ====<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
[mailto:sfoster@austinnetworking.com Scott Foster, Membership Chair] - (512) 637-9824 <br />
<br />
==== Sponsorship Opportunities ====<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.whitehatsec.com WhiteHat Security], [http://www.expandingsecurity.com Expanding Security], the [http://www.denimgroup.com Denim Group], [http://www.fortify.com Fortify], and [http://www.bluecoat.com/ Blue Coat Systems] for their sponsorships during the past year. <br />
<br />
==== Local News ====<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
[[Category:Texas]]</div>Wicketthttps://wiki.owasp.org/index.php?title=Austin&diff=85978Austin2010-07-08T15:33:52Z<p>Wickett: </p>
<hr />
<div>{{Chapter Template|chaptername=Austin|extra=The chapter leadership includes: [mailto:josh.sokol@ni.com Josh Sokol, President], [mailto:wickett@gmail.com James Wickett, Vice President], [mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair], [mailto:ggenung@denimgroup.com Greg Genung, Membership Chair], and the former chapter president is [mailto:cdewitt@indepthsec.com Cris Dewitt]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-austin|emailarchives=http://lists.owasp.org/pipermail/owasp-austin}} <br />
<br />
[http://austinowasp.ning.com/ Austin OWASP Ning Site] <br />
<br />
[[Image:OWASP Lascon Logo.gif|left|167x125px]] <br />
[http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 Austin OWASP is hosting LASCON 2010 (Lonestar Application Security Conference 2010)] <br />
<br />
<br />
<br />
<br />
==== Chapter Meetings ====<br />
<br />
'''When:''' July 15, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' July 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security <br />
<br />
'''Who:''' John Marler (Imperva) <br />
<br />
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security. <br />
<br />
John is a graduate of Texas A&amp;M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking &amp; design specializations, CheckPoint firewall, and TippingPoint IPS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' August 12, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
== Future Speakers and Events ==<br />
<br />
June 29, 2010 - AJAX Security (@ National Instruments) <br />
<br />
July 15 2010 - Austin Security Professionals Happy Hour (Sponsored by Praetorian) <br />
<br />
July 27, 2010 - Data Attack Anatomy: Stopping Bad Guys &amp; Satisfying Auditors with Pragmatic Database Security (@ National Instruments) <br />
<br />
August 12, 2010 - Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
August 31, 2010 - Application Assessments Reloaded (@ National Instruments) <br />
<br />
September 16, 2010 - Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant) <br />
<br />
September 28, 2010 - Technology and Business Risk Management: How Application Security Fits In (@ National Instruments) <br />
<br />
October 26, 2010 - No Meeting (Come to [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010!]) <br />
<br />
October 29, 2010 - [http://www.owasp.org/index.php/Lonestar_Application_Security_Conference_2010 LASCON 2010] (@ Norris Conference Center, Austin, TX) <br />
<br />
November 2010 - No Meeting (Happy Holidays!) <br />
<br />
December 2010 - No Meeting (Happy Holidays!) <br />
<br />
==== Record Hall of Meetings ====<br />
<br />
'''When:''' June 29, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' AJAX Security <br />
<br />
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them. <br />
<br />
*Introduction to AJAX <br />
*Security Issues with architecture <br />
*Toolkits <br />
*Toolkit Security Concerns <br />
*Bridges and Issues <br />
*Attacking AJAX <br />
*Defending AJAX <br />
*Securing the Code <br />
*Best Practices <br />
*Other Issues and Concerns <br />
*Q and A<br />
<br />
'''Who:''' Brad Causey <br />
<br />
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' June 17, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Set Solutions) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' May 25, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Javascript Hijacking <br />
<br />
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion. <br />
<br />
'''Who:''' Ben Broussard (UT Austin) <br />
<br />
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus. <br />
<br />
'''Topic: ''' Attacking Intranets from the Web Using DNS Rebinding <br />
<br />
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization. <br />
<br />
'''Who:''' James Wickett (National Instruments) <br />
<br />
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&amp;D department. Current certifications: CISSP, GCFW, GWAS <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716 begin_of_the_skype_highlighting (512) 619-6716 end_of_the_skype_highlighting. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' May 20, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by BlueCoat) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' April 27, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Automated vs. Manual Security: You can't filter The Stupid <br />
<br />
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques. <br />
<br />
<br> Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool. <br />
<br />
'''Who:''' Charles Henderson (Trustwave) <br />
<br />
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' April 22, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Fortify) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' March 30, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Enterprise Application Security Practices: Real-world Tips and Techniques <br />
<br />
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program. <br />
<br />
'''Who:''' Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.) <br />
<br />
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&amp;M University and a BS in Computer Science from Texas A&amp;M-Corpus Christi, and is a certified CISSP. <br />
<br />
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington. <br />
<br />
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' March 18, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Professionals Happy Hour (Sponsored by Denim Group) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' February 23, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Advanced Persistent Threat - What Does it Mean for Application Security? <br />
<br />
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall. <br />
<br />
'''Who:''' Matt Pour (Blue Coat Systems) <br />
<br />
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' February 11, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour (Sponsored by WhiteHat Security) <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' January 26, 2010, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Reducing Your Data Security Risk Through Tokenization <br />
<br />
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation. <br />
<br />
'''Who:''' Josh Sokol (National Instruments) <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Josh Sokol (512) 619-6716. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' January 14, 2010, 5:00pm - 7:00pm <br />
<br />
'''What: '''Austin Security Executives Happy Hour <br />
<br />
'''Where:''' Sherlock's (9012 Research Blvd, Austin, TX 78757) <br />
<br />
----<br />
<br />
'''When:''' November 17, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Tracking the progress of an SDL program: lessons from the gym <br />
<br />
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress. <br />
<br />
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally. <br />
<br />
'''Who:''' Cassio Goldschmidt (Symantec) <br />
<br />
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests. <br />
<br />
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' October 27, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Vulnerability Management In An Application Security World <br />
<br />
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. <br />
<br />
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups. <br />
<br />
'''Who:''' Dan Cornell (Denim Group) <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
[http://austinowasp.ning.com/ RSVP on the Austin OWASP Ning Site] <br />
<br />
----<br />
<br />
'''When:''' September 29, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' OWASP ROI: Optimize Security Spending using OWASP <br />
<br />
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars. <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&amp;M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&amp;M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' August 25, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Threat Modeling <br />
<br />
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise. <br />
<br />
'''Who:''' Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team <br />
<br />
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software. <br />
<br />
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000. <br />
<br />
Howard is an editor of IEEE Security &amp; Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' July 28, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Slowloris: A DOS tool for Apache <br />
<br />
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' June 25, 2009, 5:00pm - 8:00pm <br />
<br />
'''Topic: ''' OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!! <br />
<br />
'''Where:''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' June 30, 2009, 3:30pm - 5:00pm <br />
<br />
'''Topic: ''' Web 2.0 Cryptology - A Study in Failure <br />
<br />
'''Who:''' Travis <br />
<br />
'''Travis's Bio:''' Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here: <br />
<br />
http://www.subspacefield.org/security/security_concepts.html <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' May 26, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Clickjack This! <br />
<br />
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code. <br />
<br />
'''Who:''' RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: James Wickett 512-964-6227. <br />
<br />
----<br />
<br />
'''When:''' April 28, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Architecting Secure Web Systems <br />
<br />
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you. <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog] and recently presented at the TRISC 2009 Conference. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' April 23rd, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP April Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' March 31, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' PCI Compliance and Web App Security <br />
<br />
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly. <br />
<br />
Topics covered include: <br />
<br />
What do an ASV really do.<br />
<br />
What does a QSA really do.<br />
<br />
What does an ASV scan really pick up.<br />
<br />
Are you really secure when you are compliant.<br />
<br />
A product neutral look at how to get the most out of your compliance push.<br />
<br />
'''Who:''' Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org &lt;http://www.pcicomplianceguide.org/&gt; and addresses the "Ask the Expert" questions on the site. <br />
<br />
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP). <br />
<br />
<br> '''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' February 24, 2009, 11:30am - 1:00pm <br />
<br />
'''Topic: ''' Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data <br />
<br />
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored: <br />
<br />
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions; <br />
<br />
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and <br />
<br />
3. Compliance and Software development life cycle approaches. <br />
<br />
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process? <br />
<br />
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks. <br />
<br />
'''Who:''' Quincy Jackson <br />
<br />
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' March 26th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP March Happy Hour <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' February 5th, 2009, 5:00pm - 7:00pm <br />
<br />
'''Topic: ''' OWASP Live CD Release Party <br />
<br />
'''Where: ''' Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info <br />
<br />
----<br />
<br />
'''When:''' January 27, 2009, 11:30am - 1:00pm <br />
<br />
<br> '''Topic: ''' Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting. <br />
<br />
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk: <br />
<br />
1. The statelessness of the internet <br />
<br />
2. How the naive attack works <br />
<br />
3. A mitigation strategy against this naive attack <br />
<br />
4. An combined CSRF/XSS attack that defeats this mitigation strategy <br />
<br />
5. And finally suggestions for mitigation of the combined attack <br />
<br />
<br> '''Who:''' Ben L Broussard <br />
<br />
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' October 28, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' Using Proxies to Secure Applications and More <br />
<br />
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' September 30, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Josh Sokol <br />
<br />
'''Josh's Bio:''' Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the [http://www.webadminblog.com Web Admin Blog]. <br />
<br />
'''Topic: ''' OWASP AppSec NYC Conference 2008 <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' August 26th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008. <br />
<br />
'''Topic: ''' OWASP Live CD 2008 - An OWASP Summer of Code Project <br />
<br />
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include: <br />
<br />
#easy for the users to keep the tools updated <br />
#easy for the project lead to keep the tools updated <br />
#easy to produce releases (I'm thinking quarterly releases) <br />
#focused on just web application testing - not general Pen Testing<br />
<br />
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project <br />
<br />
Project Wiki: http://mtesauro.com/livecd/ <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' July 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Whurley and Mando <br />
<br />
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award. <br />
<br />
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself. <br />
<br />
<br> '''Topic: ''' The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect <br />
<br />
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise. <br />
<br />
<br> '''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
'''Cost:''' Always Free <br />
<br />
'''Questions or help with Directions...''' call: Scott Foster 512-637-9824. <br />
<br />
----<br />
<br />
'''When:''' June 24th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency <br />
<br />
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project <br />
<br />
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing. <br />
<br />
<br> '''Topic: ''' Securely Handling Sensitive Configuration Data. <br />
<br />
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' May 27th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Nathan Sportsman and Praveen Kalamegham, Web Services Security <br />
<br />
'''Topic: '''Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' April 29th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Mano Paul <br />
<br />
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President &amp; CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training &amp; Education. <br />
<br />
'''What:''' Security – The Road Less Travelled <br />
<br />
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
'''When:''' March 25th, 2008, 11:30am - 1:00pm <br />
<br />
'''Who:''' Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax <br />
<br />
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. <br />
<br />
'''Topic: '''Static Analysis Techniques for Testing Application Security <br />
<br />
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes. <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:'''February 26th, 2008 - Michael Howard, Author of Writing Secure Code <br />
<br />
'''Topic: '''Microsoft's SDL: A Deep Dive <br />
<br />
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown <br />
<br />
'''Where:''' Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store. <br />
<br />
See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''When:''' December 4th, 2007, 11:30am - 1:00pm <br />
<br />
'''Who:''' Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger) <br />
<br />
'''Topic: Business Logic Flaws''' <br />
<br />
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic. <br />
<br />
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them. <br />
<br />
'''Where:''' National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
<br> '''November 27th, 2007 Austin OWASP chapter meeting''' - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security) <br />
<br />
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike. <br />
<br />
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See [http://tinylink.com/?chLCAmvxKA directions to Whole Foods]. <br />
<br />
----<br />
<br />
'''October 2007 Austin OWASP chapter meeting ''' October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown. <br />
<br />
----<br />
<br />
'''September 2007 Austin OWASP Chapter September 2007 ''' - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code. <br />
<br />
----<br />
<br />
'''August 2007 Austin OWASP chapter meeting''' - '''8/28,''' 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing. <br />
<br />
----<br />
<br />
'''July 2007 Austin OWASP chapter meeting''' - '''7/31,''' 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery <br />
<br />
----<br />
<br />
'''June 2007 Austin OWASP chapter meeting''' - 6/26, 11:30am - 1:00pm at National Instruments. [http://www.stokescigar.com James Wickett] from Stokes [http://www.stokescigar.com Cigar] Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities. <br />
<br />
----<br />
<br />
'''May 2007 Austin OWASP chapter meeting''' - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike. <br />
<br />
----<br />
<br />
'''April 2007 Austin OWASP chapter meeting''' - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting) <br />
<br />
----<br />
<br />
'''March 2007 Austin OWASP chapter meeting''' - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. <br />
<br />
----<br />
<br />
[[January 2007 Austin Chapter Meeting]] - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15. <br />
<br />
----<br />
<br />
'''December Meeting''' - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays! <br />
<br />
----<br />
<br />
[[November 2006 Austin Chapter Meeting]] - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14. <br />
<br />
----<br />
<br />
[[October 2006 Austin Chapter Meeting]] - 10/31 - Boo! <br />
<br />
----<br />
<br />
[[September 2006 Austin Chapter Meeting]] - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White <br />
<br />
----<br />
<br />
[[August 2006 Austin Chapter Meeting]] - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See [http://maps.google.com/maps?f=q&hl=en&q=11500+N+Mo-Pac+Expy,+Austin,+TX+78759&ie=UTF8&ll=30.406377,-97.726135&spn=0.017211,0.036778&om=1 directions to National Instruments]. ''Hint:'' It is on your left on Mopac if you were heading up to Fry's from Austin. <br />
<br />
----<br />
<br />
'''Austin OWASP chapter kickoff meeting''' - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist) <br />
<br />
==== Presentation Archives ====<br />
<br />
The following presentations have been given at local chapter meetings: <br />
<br />
*March 2010 - [http://www.owasp.org/images/c/cc/Enterprise_Application_Security_Practices.ppt Enterprise Application Security Practices: Real-world Tips and Techniques]<br />
<br />
*February 2010 - [http://www.owasp.org/images/9/90/Advanced_Persistent_Threats.pdf Advanced Persistent Threat - What Does it Mean for Application Security?]<br />
<br />
*January 2010 - [http://www.owasp.org/images/a/ae/Reducing_Your_Data_Security_Risk_Through_Tokenization.pptx Reducing Your Data Security Risk Through Tokenization]<br />
<br />
*September 2009 - [http://www.owasp.org/images/d/d6/Austin_Chapter_OWASP_ROI-mtesauro.pdf OWASP ROI: Optimize Security Spending using OWASP]<br />
<br />
*August 2009 - [http://www.owasp.org/images/9/97/TM.pptx Threat Modeling]<br />
<br />
*April 2009 - [http://www.owasp.org/images/8/8b/OWASP_-_Architecting_Secure_Web_Systems.pptx Architecting a Secure Web System]<br />
<br />
*October 2008 - [https://www.owasp.org/images/f/ff/Using_Proxies_to_secure_applications_and_more.pptx Using Proxies to Secure Applications and More]<br />
<br />
*August 2007 - [https://www.owasp.org/images/d/db/The_OWASP_Testing_Framework_Presentation.ppt OWASP Testing Framework]<br />
<br />
*July&nbsp;? - [http://www.threatmind.net/papers/franz-basic-j2ee-tools-owasp-austin.pdf A Rough Start of a Toolset for Assessing Java/J2EE Web Apps] - [[MattFranz]] discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.<br />
<br />
*August&nbsp;? - [http://www.owasp.org/index.php/Image:DenimGroup_AJAXSecurityHereWeGoAgain_Content_20060829.pdf AJAX Security: Here we go again] - Dan Cornell from [http://www.denimgroup.com/ Denim Group] discussed security issues in the one the popular Web 2.0 technlogy<br />
<br />
==== Austin OWASP Whitepapers ====<br />
<br />
*Whitepapers go here<br />
<br />
<br> <br />
<br />
==== Austin OWASP Chapter Leaders ====<br />
<br />
[mailto:josh.sokol@ni.com Josh Sokol, President] - (512) 683-5230 <br />
<br />
[mailto:wickett@gmail.com James Wickett, Vice President] - (512) 683-6410 <br />
<br />
[mailto:rich.vazquez@gmail.com Rich Vazquez, Communications Chair] - (512) 989-6808 <br />
<br />
[mailto:sfoster@austinnetworking.com Scott Foster, Membership Chair] - (512) 637-9824 <br />
<br />
==== Sponsorship Opportunities ====<br />
<br />
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact [mailto:josh.sokol@ni.com Josh Sokol], the Austin OWASP Chapter President. <br />
<br />
'''Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship''' <br />
<br />
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. We typically do $100 in appetizers and $200 in drink tickets. By using drink tickets, we ensure that our sponsors are able to interact with every attendee who wants a drink. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $300. <br />
<br />
'''Opportunity #2 - OWASP Meeting Lunch Sponsorship''' <br />
<br />
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $250 we can arrange food and drinks for up to 50 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting. <br />
<br />
'''Opportunity #3 - OWASP Meeting Presenter Sponsorship''' <br />
<br />
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting. <br />
<br />
The Austin OWASP Chapter would like to thank [http://www.whitehatsec.com WhiteHat Security], [http://www.expandingsecurity.com Expanding Security], the [http://www.denimgroup.com Denim Group], [http://www.fortify.com Fortify], and [http://www.bluecoat.com/ Blue Coat Systems] for their sponsorships during the past year. <br />
<br />
==== Local News ====<br />
<br />
''If a link is available, click for more details on directions, speakers, etc. You can also review [http://lists.owasp.org/pipermail/owasp-austin/ Email Archives] to see what folks have been talking about'' <paypal>Austin</paypal> <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
[[Category:Texas]]</div>Wickett