https://wiki.owasp.org/api.php?action=feedcontributions&user=Schmoilito&feedformat=atomOWASP - User contributions [en]2024-03-28T11:19:28ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=User:Schmoilito&diff=151940User:Schmoilito2013-05-20T19:21:50Z<p>Schmoilito: </p>
<hr />
<div>need updating<br />
<br />
----<br />
<br />
*To see my wiki contributions, [[:Special:Contributions/Schmoilito|click here]]. <br />
<br />
*[mailto:mike.zusman@owasp.org Email address].</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Choosing_and_Using_Security_Questions_Cheat_Sheet&diff=138795Choosing and Using Security Questions Cheat Sheet2012-11-05T17:11:36Z<p>Schmoilito: /* Steps */</p>
<hr />
<div>= Introduction =<br />
<br />
This cheat sheet provides some best practice for developers to follow when choosing and using security questions to implement a &quot;forgot password&quot; web application feature.<br> <br />
<br />
= The Problem =<br />
<br />
There is no industry standard either for providing guidance to users or developers when using or implementing a Forgot Password feature. The result is that developers generally pick a set of dubious questions and implement them insecurely. They do so, not only at the risk to their users, but also--because of potential liability issues--at the risk to their organization. Ideally, passwords would be dead, or at least less important in the sense that they make up only one of several multi-factor authentication mechanisms, but the truth is that we probably are stuck with passwords just like we are stuck with Cobol. So with that in mind, what can we do to make the Forgot Password solution as palatable as possible?<br />
<br />
= Choosing Security Questions and/or Identity Data =<br />
<br />
Most of us can instantly spot a bad &quot;security question&quot; when we see one. You know the ones we mean. Ones like "What is your favorite color?" are obviously bad. But as the [[http://goodsecurityquestions.com/ Good Security Questions]] web site rightly points out,<br />
&quot;there really are NO GOOD security questions; only fair or bad questions&quot;.<br />
<br />
The reason that most organizations allow users to reset their own forgotten passwords is not because of security, but rather to reduce their own costs by reducing their volume of calls to their help desks. It's the classic convenience vs. security trade-off, and in this case, convenience (both to the organization in terms of reduced costs and to the user in terms of simpler, self-service) almost always wins out.<br />
<br />
So given that the business aspect of lower cost generally wins out, what can we do to at least raise the bar a bit?<br />
<br />
Here are some suggestions. Note that we intentionally avoid recommending specific security questions. To do so likely would be counterproductive because many developers would simply use those questions without much thinking and adversaries would immediately start harvesting that data from various social networks.<br />
<br />
== Desired Characteristics ==<br />
<br />
Any security questions or identity information presented to users to reset forgotten passwords should ideally have the following four characteristics:<br />
<br />
# '''Memorable''': If users can't remember their answers to their security questions, you have achieved nothing.<br />
# '''Consistent''': The user's answers should not change over time. For instance, asking "What is the name of your significant other?" may have a different answer 5 years from now.<br />
# '''Nearly universal''': The security questions should apply to a wide an audience of possible.<br />
# '''Safe''': The answers to security questions should not be something that is easily guessed, or research (e.g., something that is matter of public record).<br />
<br />
== Steps ==<br />
<br />
=== Step 1) Decide on Identity Data vs Canned Questions vs. User-Created Questions ===<br />
<br />
Generally, a single HTML form should be used to collect all of the inputs to be used for later password resets. <br />
<br />
If your organization has a business relationship with users, you probably have collected some sort of additional information from your users when they registered with your web site. Such information includes, but is not limited to:<br />
<br />
* email address<br />
* last name<br />
* date of birth<br />
* account number<br />
* customer number<br />
* last 4 of social security number<br />
* zip code for address on file<br />
* street number for address on file<br />
<br />
For enhanced security, you may wish to consider asking the user for their email address first and then send an email that takes them to a private page that requests the other 2 (or more) identity factors. That way the email itself isn’t that useful because they still have to answer a bunch of ‘secret’ questions after they get to the landing page.<br />
<br />
On the other hand, if you host a web site that targets the general public, such as social networking sites, free email sites, news sites, photo sharing sites, etc., then you likely to not have this identity information and will need to use some sort of the ubiquitous "security questions". However, also be sure that you collect some means to send the password reset information to some out-of-band side-channel, such as a (different) email address, an SMS texting number, etc.<br />
<br />
Believe it or not, there is a certain merit to allow your users to select from a set of several "canned" questions. We generally ask users to fill out the security questions as part of completing their initial user profile and often that is the very time that the user is in a hurry; they just wish to register and get about using your site. If we ask users to create their own question(s) instead, they then generally do so under some amount of duress, and thus may be more likely to come up with extremely poor questions.<br />
<br />
However, there is also some strong rationale to requiring users to create their own question(s), or at least one such question. The prevailing legal opinion seems to be if we provide some sort of reasonable guidance to users in creating their own questions and then insist on them doing so, at least some of the potential liabilities are transferred from our organizations to the users. In such cases, if user accounts get hacked because of their weak security questions (e.g., "What is my favorite ice cream flavor?", etc.) then the thought is that they only have themselves to blame and thus our organizations are less likely to get sued.<br />
<br />
Since OWASP recommends in the [[Forgot Password Cheat Sheet]] that multiple security questions should be posed to the user and successfully answered before allowing a password reset, a good practice might be to require the user to select 1 or 2 questions from a set of canned questions as well as to create (a different) one of their own and then require they answer one of their selected canned questions as well as their own question.<br />
<br />
=== Step 2) Review Any Canned Questions with Your Legal Department or Privacy Officer ===<br />
<br />
While most developers would generally first review any potential questions with whatever relevant business unit, it may not occur to them to review the questions with their legal department or chief privacy officer. However, this is advisable because their may be applicable laws or regulatory / compliance issues to which the questions must adhere. For example, in the telecommunications industry, the FCC's Customer Proprietary Network Information (CPNI) regulations prohibit asking customers security questions that involve "personal information", so questions such as "In what city were you born?" are generally not allowed.<br />
<br />
=== Step 3) Insist on a Minimal Length for the Answers ===<br />
<br />
Even if you pose decent security questions, because users generally dislike putting a whole lot of forethought into answering the questions, they often will just answer with something short. Answering with a short expletive is not uncomment, nor is answering with something like "xxx" or "1234". If you tell the user that they ''should'' answer with a phrase or sentence and tell them that there is some minimal length to an acceptable answer (say 10 or 12 characters), you generally will get answers that are somewhat more resistant to guessing.<br />
<br />
=== Step 4) Consider How To Securely Store the Questions and Answers ===<br />
<br />
There are two aspects to this...storing the questions and storing the answers. Obviously, the questions must be presented to the user, so the options there are store them as plaintext or as reversible ciphertext. The answers technically do not need to be ever viewed by any human so they could be stored using a secure cryptographic hash (although in principle, I am aware of some help desks that utilize the both the questions and answers for password reset and they insist on being able to ''read'' the answers rather than having to type them in; YMMV). Either way, we would always recommend at least encrypting the answers rather than storing them as plaintext. This is especially true for answers to the "create your own question" type as users will sometimes pose a question that potentially has a sensitive answer (e.g., "What is my bank account # that I share with my wife?").<br />
<br />
So the main question is whether or not you should store the questions as plaintext or reversible ciphertext. Admittedly, we are a bit biased, but for the "create your own question" types at least, we recommend that such questions be encrypted. This is because if they are encrypted, it makes it much less likely that your company will be sued if you have some bored, rogue DBAs pursuing the DB where the security questions and answers are stored in an attempt to amuse themselves and stumble upon something sensitive or perhaps embarrassing.<br />
<br />
In addition, if you explain to your customers that you are encrypting their questions and hashing their answers, they might feel safer about asking some questions that while potentially embarrassing, might be a bit more secure. (Use your imagination. Do we need to spell it out for you? Really???)<br />
<br />
=== Step 5) Periodically Have Your Users Review their Questions ===<br />
<br />
Many companies often ask their users to update their user profiles to make sure contact information such as email addresses, street address, etc. is still up-to-date. Use that opportunity to have your users review their security questions. (Hopefully, at that time, they will be in a bit less of a rush, and may use the opportunity to select better questions.) If you had chosen to encrypt rather than hash their answers, you can also display their corresponding security answers at that time.<br />
<br />
If you keep statistics on how many times the respective questions has been posed to someone as part of a Forgot Password flow (recommended), it would be advisable to also display that information. (For instance, if against your advice, they created a question such as "What is my favorite hobby?" and see that it had been presented 113 times and they think they might have only reset their password 5 times, it would probably be advisable to change that security question and probably their password as well.)<br />
<br />
=== Step 6) Authenticate Requests to Change Questions ===<br />
<br />
Many web sites properly authenticate change password requests simply by requesting the current password along with the desired new password. If the user cannot provide the correct current password, the request to change the password is ignored. The same authentication control should be in place when changing security questions. The user should be required to provide the correct password along with their new security questions & answers. If the user cannot provide the correct password, then the request to change the security questions should be ignored. This control prevents both Cross-Site Request Forgery attacks, as well as changes made by attackers who have taken control over a users workstation or authenticated application session.<br />
<br />
= Using Security Questions =<br />
<br />
Requiring users to answer security questions is most frequently done under two quite different scenarios:<br />
* As a means for users to reset forgotten passwords. (See [[Forgot Password Cheat Sheet]].)<br />
* As an additional means of corroborating evidence used for authentication.<br />
<br />
If at anytime you intend for your users to answer security questions for both of these scenarios, it is ''strongly'' recommended that you use two different sets of questions / answers.<br />
<br />
It should noted that using a security question / answer in addition to using passwords does '''''not''''' give you multi-factor authentication because both of these fall under the category of "what you know". Hence they are two of the ''same'' factor, which is not multi-factor. Furthermore, it should be noted that while passwords are a very weak form of authentication, answering security questions are generally is a much weaker form. This is because when we have users create passwords, we generally test the candidate password against some password complexity rules (e.g., minimal length &gt; 10 characters; must have at least one alphabetic, one numeric, and one special character; etc.); we usually do no such thing for security answers (except for perhaps some minimal length requirement). Thus good passwords generally will have much more entropy than answers to security questions, often by several orders of magnitude.<br />
<br />
=== Security Questions Used To Reset Forgotten Passwords ===<br />
<br />
The [[Forgot Password Cheat Sheet]] already details pretty much everything that you need to know as a developer when ''collecting'' answers to security questions. However, it provides no guidance about how to assist the user in selecting security questions (if chosen from a list of candidate questions) or writing their own security questions / answers. Indeed, the [[Forgot Password Cheat Sheet]] makes the assumption that one can actually use additional ''identity'' data as the security questions / answers. However, often this is not the case as the user has never (or won't) volunteer it or is it prohibited for compliance reasons with certain regulations (e.g., as in the case of telecommunications companies and [[http://en.wikipedia.org/wiki/Customer_proprietary_network_information CPNI]] data).<br />
<br />
Therefore, at least some development teams will be faced with collecting more generic security questions and answers from their users. If you must do this as a developer, it is good practice to:<br />
* briefly describe the importance of selecting a good security question / answer.<br />
* provide some guidance, along with some examples, of what constitutes bad vs. fair security questions.<br />
<br />
You may wish to refer your users to the [[http://goodsecurityquestions.com/ Good Security Questions]] web site for the latter.<br />
<br />
Furthermore, since adversaries will try the "forgot password" reset flow to reset a user's password (especially if they have compromised the side-channel, such as user's email account or their mobile device where they receive SMS text messages), is a good practice to minimize unintended and unauthorized information disclosure of the security questions. This may mean that you require the user to answer one security question before displaying any subsequent questions to be answered. In this manner, it does not allow an adversary an opportunity to research all the questions at once. Note however that this is contrary to the advice given on the [[Forgot Password Cheat Sheet]] and it may also be perceived as not being user-friendly by your sponsoring business unit, so again YMMV.<br />
<br />
Lastly, you should consider whether or not you should treat the security questions that a user will type in as a "password" type or simply as regular "text" input. The former can prevent shoulder-surfing attacks, but also cause more typos, so there is a trade-off. Perhaps the best advice is to give the user a choice; hide the text by treating it as "password" input type by default, but all the user to check a box that would display their security answers as clear text when checked.<br />
<br />
=== Security Questions As An Additional Means Of Authenticating ===<br />
<br />
First, it bears repeating again...if passwords are considered weak authentication, than using security questions are even less so. Furthermore, they are no substitute for true multi-factor authentication, or stronger forms of authentication such as authentication using one-time passwords or involving side-channel communications. In a word, very little is gained by using security questions in this context. But, if you must...keep these things in mind:<br />
<br />
* Display the security question(s) on a separate page only ''after'' your users have successfully authenticated with their usernames / passwords (rather than only after they have entered their username). In this manner, you at least do not allow an adversary to view and research the security questions unless they also know the user's current password.<br />
* If you also user security questions to reset a user's password, then you should use a ''different'' set of security questions for an additional means of authenticating.<br />
* Security questions used for actual authentication purposes should regularly expire much like passwords. Periodically make the user choose new security questions and answers.<br />
* If you use answers to security questions as a ''subsequent'' authentication mechanism (say to enter a more sensitive area of your web site), make sure that you keep the session idle time out very low...say less than 5 minutes or so, or that you also require the user to first re-authenticate with their password and then immediately after answer the security question(s).<br />
<br />
= Related Articles =<br />
[[Forgot Password Cheat Sheet]]<br/><br />
[[http://goodsecurityquestions.com/ Good Security Questions web site]]<br />
<br />
= Authors and Primary Editors =<br />
<br />
Kevin Wall - kevin.w.wall[at]gmail com<br />
<br />
= Other Cheatsheets =<br />
{{Cheatsheet_Navigation}}<br />
<br />
[[Category:Cheatsheets]]</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Projects/OWASP_Mobile_Security_Project_-_Mobile_Platforms&diff=111488Projects/OWASP Mobile Security Project - Mobile Platforms2011-06-02T11:37:37Z<p>Schmoilito: </p>
<hr />
<div>== Mobile Platforms ==<br />
<br />
<br />
<br />
'''Coming soon...'''<br />
<br />
'''Android'''<br />
<br />
'''iOS'''<br />
<br />
'''RIM'''<br />
<br />
'''Windows Phone 7'''<br />
<br />
<br />
To contribute to this section, contact mike.zusman@owasp.org</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Projects/OWASP_Mobile_Security_Project&diff=111487Projects/OWASP Mobile Security Project2011-06-02T11:28:56Z<p>Schmoilito: </p>
<hr />
<div>{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude><br />
| project_name = OWASP Mobile Security Project<br />
| project_home_page = OWASP_Mobile_Security_Project<br />
| project_description = <br />
The rapid growth of mobile computing has made the need for secure mobile development absolutely essential. The OWASP Mobile Security Project will help the community better understand the risks present in mobile applications, and learn to defend against them. This project will be forked into each of the following platforms:<br />
* iOS Project<br />
* Android Project<br />
* webOS Project<br />
* Windows Mobile Project<br />
* Blackberry Project<br />
<br />
| project_license =<br />
<br />
| leader_name1 = Jack Mannino <br />
| leader_email1 = Jack@nvisiumsecurity.com<br />
| leader_username1 = Jack Mannino<br />
<br />
| leader_name2 = Mike Zusman<br />
| leader_email2 = mike.zusman@owasp.org<br />
| leader_username2 = schmoilito<br />
<br />
| leader_name3 = Zach Lanier<br />
| leader_email3 = zach.lanier@n0where.org<br />
| leader_username3 = Zach_Lanier<br />
<br />
| contributor_name2 = Jim Manico<br />
| contributor_email2 = jim.manico@owasp.org<br />
| contributor_username2= jmanico<br />
<br />
| contributor_name1 = David Lindner<br />
| contributor_email1 = david.lindner@aspectsecurity.com<br />
| contributor_username1 = David Lindner<br />
<br />
| contributor_name3 = Tom Neaves<br />
| contributor_email3 = tom.neaves@verizonbusiness.com<br />
| contributor_username3 = Tom Neaves<br />
<br />
| contributor_name4 = Kuai Hinojosa<br />
| contributor_email4 = Kuai.Hinojosa@owasp.org<br />
| contributor_username4 = Webappsecguy<br />
<br />
| contributor_name5 = Vinay Bansal<br />
| contributor_email5 = vinay.bansal@cisco.com<br />
| contributor_username5 = Vinaykbansal<br />
<br />
| contributor_name6 = Zach Lanier<br />
| contributor_email6 = zach.lanier@intrepidusgroup.com<br />
| contributor_username6 = Zach_Lanier<br />
<br />
| contributor_name7 = Giles Hogben<br />
| contributor_email7 = giles.hogben@enisa.europa.eu<br />
| contributor_username7 = Giles Hogben<br />
<br />
| contributor_name8 = Ludovic Petit<br />
| contributor_email8 = ludovic.petit@owasp.org<br />
| contributor_username8 = Ludovic Petit<br />
<br />
| pamphlet_link = <br />
<br />
| presentation_link =<br />
<br />
| mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp-mobile-security-project<br />
<br />
| project_road_map = http://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project/Roadmap<br />
<br />
| links_url[1-10] = <br />
<br />
| links_name[1-10] = <br />
<br />
| release_1 = <br />
| release_2 = <br />
| release_3 =<br />
| release_4 =<br />
<!--- The line below is for GPC usage only. Please do not edit it ---><br />
| project_about_page = Projects/OWASP Mobile Security Project<br />
<br />
}}</div>Schmoilitohttps://wiki.owasp.org/index.php?title=User:Schmoilito&diff=111486User:Schmoilito2011-06-02T11:24:58Z<p>Schmoilito: </p>
<hr />
<div>Michael Zusman is an independent consultant, helping clients improve their application security posture, and overcome other technological hurdles through research and design initiatives.<br />
<br />
Prior to going independent, Michael was a Director of Consulting at the Intrepidus Group. At Intrepidus, his focus was on assisting clients in architecting secure mobile solutions and applications for various platforms including iOS, Android, and RIM. Prior to joining Intrepidus Group, Mike has held the positions of Escalation Engineer at Microsoft, Security Program Manager at Automatic Data Processing, and lead architect & developer at a number of smaller firms.<br />
<br />
In addition to his corporate experience, Mike is an independent security researcher, and has responsibly disclosed a number of critical vulnerabilities to commercial software vendors and other clients. He has spoken about mobile application security at a number of top industry events including Black Hat, CanSecWest, OWASP meetings and at local colleges including Polytechnic University.<br />
Mike brings 12 years of security, technology, and business experience to Intrepidus Group. He has attained the CISSP certification, and is a co-leader of the OWASP Mobile Security Project.<br />
<br />
----<br />
<br />
*To see my wiki contributions, [[:Special:Contributions/Schmoilito|click here]]. <br />
<br />
*[mailto:mike.zusman@owasp.org Email address].</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Projects/OWASP_Mobile_Security_Project&diff=110579Projects/OWASP Mobile Security Project2011-05-17T18:54:31Z<p>Schmoilito: </p>
<hr />
<div>{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude><br />
| project_name = OWASP Mobile Security Project<br />
| project_home_page = OWASP_Mobile_Security_Project<br />
| project_description = <br />
The rapid growth of mobile computing has made the need for secure mobile development absolutely essential. The OWASP Mobile Security Project will help the community better understand the risks present in mobile applications, and learn to defend against them. This project will be forked into each of the following platforms:<br />
* iOS Project<br />
* Android Project<br />
* webOS Project<br />
* Windows Mobile Project<br />
* Blackberry Project<br />
<br />
| project_license =<br />
<br />
| leader_name1 = Jack Mannino <br />
| leader_email1 = Jack@nvisiumsecurity.com<br />
| leader_username1 = Jack Mannino<br />
<br />
| leader_name2 = Mike Zusman<br />
| leader_email2 = mike.zusman@intrepidusgroup.com<br />
| leader_username2 = schmoilito<br />
<br />
| contributor_name2 = Jim Manico<br />
| contributor_email2 = jim.manico@owasp.org<br />
| contributor_username2= jmanico<br />
<br />
| contributor_name1 = David Lindner<br />
| contributor_email1 = david.lindner@aspectsecurity.com<br />
| contributor_username1 = David Lindner<br />
<br />
| contributor_name3 = Tom Neaves<br />
| contributor_email3 = tom.neaves@verizonbusiness.com<br />
| contributor_username3 = Tom Neaves<br />
<br />
| contributor_name4 = Kuai Hinojosa<br />
| contributor_email4 = Kuai.Hinojosa@owasp.org<br />
| contributor_username4 = Kuai Hinojosa<br />
<br />
| contributor_name5 = Vinay Bansal<br />
| contributor_email5 = vinay.bansal@cisco.com<br />
| contributor_username5 = Vinay Bansal<br />
<br />
| contributor_name6 = Zach Lanier<br />
| contributor_email6 = zach.lanier@intrepidusgroup.com<br />
| contributor_username6 = Zach_Lanier<br />
<br />
| pamphlet_link = <br />
<br />
| presentation_link =<br />
<br />
| mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp-mobile-security-project<br />
<br />
| project_road_map = http://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project/Roadmap<br />
<br />
| links_url[1-10] = <br />
<br />
| links_name[1-10] = <br />
<br />
| release_1 = <br />
| release_2 = <br />
| release_3 =<br />
| release_4 =<br />
<!--- The line below is for GPC usage only. Please do not edit it ---><br />
| project_about_page = Projects/OWASP Mobile Security Project<br />
<br />
}}</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Projects/OWASP_Mobile_Security_Project&diff=110578Projects/OWASP Mobile Security Project2011-05-17T18:53:47Z<p>Schmoilito: </p>
<hr />
<div>{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude><br />
| project_name = OWASP Mobile Security Project<br />
| project_home_page = OWASP_Mobile_Security_Project<br />
| project_description = <br />
The rapid growth of mobile computing has made the need for secure mobile development absolutely essential. The OWASP Mobile Security Project will help the community better understand the risks present in mobile applications, and learn to defend against them. This project will be forked into each of the following platforms:<br />
* iOS Project<br />
* Android Project<br />
* webOS Project<br />
* Windows Mobile Project<br />
* Blackberry Project<br />
<br />
| project_license =<br />
<br />
| leader_name1 = Jack Mannino <br />
| leader_email1 = Jack@nvisiumsecurity.com<br />
| leader_username1 = Jack Mannino<br />
<br />
| leader_name2 = Mike Zusman<br />
| leader_email2 = mike.zusman@intrepidusgroup.com<br />
| leader_username2 = schmoilito<br />
<br />
| contributor_name2 = Jim Manico<br />
| contributor_email2 = jim.manico@owasp.org<br />
| contributor_username2= jmanico<br />
<br />
| contributor_name1 = David Lindner<br />
| contributor_email1 = david.lindner@aspectsecurity.com<br />
| contributor_username1 = David Lindner<br />
<br />
| contributor_name3 = Tom Neaves<br />
| contributor_email3 = tom.neaves@verizonbusiness.com<br />
| contributor_username3 = Tom Neaves<br />
<br />
| contributor_name4 = Kuai Hinojosa<br />
| contributor_email4 = Kuai.Hinojosa@owasp.org<br />
| contributor_username4 = Kuai Hinojosa<br />
<br />
| contributor_name5 = Vinay Bansal<br />
| contributor_email5 = vinay.bansal@cisco.com<br />
| contributor_username5 = Vinay Bansal<br />
<br />
| contributor_name6 = Zach Lanier<br />
| contributor_email6 = zach.lanier@intrepidusgroup.com<br />
| contributor_username6 = zach_lanier<br />
<br />
| pamphlet_link = <br />
<br />
| presentation_link =<br />
<br />
| mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp-mobile-security-project<br />
<br />
| project_road_map = http://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project/Roadmap<br />
<br />
| links_url[1-10] = <br />
<br />
| links_name[1-10] = <br />
<br />
| release_1 = <br />
| release_2 = <br />
| release_3 =<br />
| release_4 =<br />
<!--- The line below is for GPC usage only. Please do not edit it ---><br />
| project_about_page = Projects/OWASP Mobile Security Project<br />
<br />
}}</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Projects/OWASP_Mobile_Security_Project&diff=110577Projects/OWASP Mobile Security Project2011-05-17T18:53:04Z<p>Schmoilito: </p>
<hr />
<div>{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude><br />
| project_name = OWASP Mobile Security Project<br />
| project_home_page = OWASP_Mobile_Security_Project<br />
| project_description = <br />
The rapid growth of mobile computing has made the need for secure mobile development absolutely essential. The OWASP Mobile Security Project will help the community better understand the risks present in mobile applications, and learn to defend against them. This project will be forked into each of the following platforms:<br />
* iOS Project<br />
* Android Project<br />
* webOS Project<br />
* Windows Mobile Project<br />
* Blackberry Project<br />
<br />
| project_license =<br />
<br />
| leader_name1 = Jack Mannino <br />
| leader_email1 = Jack@nvisiumsecurity.com<br />
| leader_username1 = Jack Mannino<br />
<br />
| leader_name2 = Mike Zusman<br />
| leader_email2 = mike.zusman@intrepidusgroup.com<br />
| leader_username2 = schmoilito<br />
<br />
| contributor_name2 = Jim Manico<br />
| contributor_email2 = jim.manico@owasp.org<br />
| contributor_username2= jmanico<br />
<br />
| contributor_name1 = David Lindner<br />
| contributor_email1 = david.lindner@aspectsecurity.com<br />
| contributor_username1 = David Lindner<br />
<br />
| contributor_name3 = Tom Neaves<br />
| contributor_email3 = tom.neaves@verizonbusiness.com<br />
| contributor_username3 = Tom Neaves<br />
<br />
| contributor_name4 = Kuai Hinojosa<br />
| contributor_email4 = Kuai.Hinojosa@owasp.org<br />
| contributor_username4 = Kuai Hinojosa<br />
<br />
| contributor_name5 = Vinay Bansal<br />
| contributor_email5 = vinay.bansal@cisco.com<br />
| contributor_username5 = Vinay Bansal<br />
<br />
| contributor_name5 = Zach Lanier<br />
| contributor_email5 = zach.lanier@intrepidusgroup.com<br />
| contributor_username5 = zach_lanier<br />
<br />
| pamphlet_link = <br />
<br />
| presentation_link =<br />
<br />
| mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp-mobile-security-project<br />
<br />
| project_road_map = http://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project/Roadmap<br />
<br />
| links_url[1-10] = <br />
<br />
| links_name[1-10] = <br />
<br />
| release_1 = <br />
| release_2 = <br />
| release_3 =<br />
| release_4 =<br />
<!--- The line below is for GPC usage only. Please do not edit it ---><br />
| project_about_page = Projects/OWASP Mobile Security Project<br />
<br />
}}</div>Schmoilitohttps://wiki.owasp.org/index.php?title=OWASP_Mobile_Security_Project&diff=107837OWASP Mobile Security Project2011-03-29T11:58:56Z<p>Schmoilito: </p>
<hr />
<div>==== Main ====<br />
{{:Projects/OWASP Mobile Security Project | Project About}}<br />
<br />
==== For Security Testers ====<br />
{{:Projects/OWASP Mobile Security Project - Security Testers | Security Testers}}<br />
<br />
==== Secure Development Guidelines ====<br />
{{:Projects/OWASP Mobile Security Project - Secure Development Guidelines | Secure Development Guidelines}}<br />
<br />
==== Top Ten Mobile Risks ====<br />
{{:Projects/OWASP Mobile Security Project - Top Ten Mobile Risks | Top Ten Mobile Risks}}<br />
<br />
==== Top Ten Mobile Controls ====<br />
{{:Projects/OWASP Mobile Security Project - Top Ten Mobile Controls| Top Ten Mobile Controls}}<br />
<br />
==== Mobile Platforms ====<br />
{{:Projects/OWASP Mobile Security Project - Mobile Platforms | Mobile Platforms}}<br />
<br />
<br />
__NOTOC__ <headertabs /><br />
<br />
[[Category:OWASP_Project|Mobile Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document|OWASP Alpha Quality Document]]</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Projects/OWASP_Mobile_Security_Project_-_Secure_Development_Guidelines&diff=107835Projects/OWASP Mobile Security Project - Secure Development Guidelines2011-03-29T11:55:22Z<p>Schmoilito: Created page with "...place holder text..."</p>
<hr />
<div>...place holder text...</div>Schmoilitohttps://wiki.owasp.org/index.php?title=OWASP_Mobile_Security_Project&diff=106834OWASP Mobile Security Project2011-03-15T12:19:33Z<p>Schmoilito: </p>
<hr />
<div>==== Main ====<br />
{{:Projects/OWASP Mobile Security Project | Project About}}<br />
<br />
==== For Security Testers ====<br />
{{:Projects/OWASP Mobile Security Project - Security Testers | Security Testers}}<br />
<br />
==== Secure Development Guidelines ====<br />
{{:Projects/OWASP Mobile Security Project - Secure Development Guidelines | Secure Development Guidelines}}<br />
<br />
==== Top Ten Mobile Risks ====<br />
{{:Projects/OWASP Mobile Security Project - Top Ten Mobile Risks | Top Ten Mobile Risks}}<br />
<br />
==== Top Ten Mobile Controls ====<br />
{{:Projects/OWASP Mobile Security Project - Top Ten Mobile Controls| Top Ten Mobile Controls}}<br />
<br />
==== iOS ====<br />
{{:Projects/OWASP Mobile Security Project - iOS | iOS}}<br />
<br />
==== Android ====<br />
{{:Projects/OWASP Mobile Security Project - Android | Android}}<br />
<br />
==== WebOS ====<br />
{{:Projects/OWASP Mobile Security Project – WebOS | WebOS}}<br />
<br />
==== Windows Mobile ====<br />
{{:Projects/OWASP Mobile Security Project – Windows Mobile | Windows Mobile}}<br />
<br />
==== Blackberry ====<br />
{{:Projects/OWASP Mobile Security Project – Blackberry | Blackberry }}<br />
<br />
<br />
__NOTOC__ <headertabs /><br />
<br />
[[Category:OWASP_Project|Mobile Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document|OWASP Alpha Quality Document]]</div>Schmoilitohttps://wiki.owasp.org/index.php?title=OWASP_Mobile_Security_Project&diff=104817OWASP Mobile Security Project2011-02-10T12:45:09Z<p>Schmoilito: </p>
<hr />
<div>==== Main ====<br />
{{:Projects/OWASP Mobile Security Project | Project About}}<br />
<br />
==== For Security Testers ====<br />
{{:Projects/OWASP Mobile Security Project - Security Testers | Security Testers}}<br />
<br />
==== Top Ten Mobile Risks ====<br />
{{:Projects/OWASP Mobile Security Project - Top Ten Mobile Risks | Top Ten Mobile Risks}}<br />
<br />
==== Top Ten Mobile Controls ====<br />
{{:Projects/OWASP Mobile Security Project - Top Ten Mobile Controls| Top Ten Mobile Controls}}<br />
<br />
==== iOS ====<br />
{{:Projects/OWASP Mobile Security Project - iOS | iOS}}<br />
<br />
==== Android ====<br />
{{:Projects/OWASP Mobile Security Project - Android | Android}}<br />
<br />
==== WebOS ====<br />
{{:Projects/OWASP Mobile Security Project – WebOS | WebOS}}<br />
<br />
==== Windows Mobile ====<br />
{{:Projects/OWASP Mobile Security Project – Windows Mobile | Windows Mobile}}<br />
<br />
==== Blackberry ====<br />
{{:Projects/OWASP Mobile Security Project – Blackberry | Blackberry }}<br />
<br />
<br />
__NOTOC__ <headertabs /><br />
<br />
[[Category:OWASP_Project|Mobile Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document|OWASP Alpha Quality Document]]</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks&diff=104816Projects/OWASP Mobile Security Project - Top Ten Mobile Risks2011-02-10T12:41:07Z<p>Schmoilito: /* Top 10 mobile risks */</p>
<hr />
<div>== About this list ==<br />
<br />
The below list is the result of a brainstorming session conducted by a small number of security consultants and application testers. For this list to carry weight going forward, it should be derived from the larger community that has had experience reviewing and testing mobile applications for security. A new initiative has been proposed to survey organizations for anonymous vulnerability data, and use this data to build the next version of this list.<br />
<br />
<br />
== Top 10 mobile Risks Draft 0.1 ==<br />
<br />
# Insecure or unnecessary client-side data storage<br />
# Lack of data protection in transit<br />
# Personal data leakage<br />
# Failure to protect resources with strong authentication<br />
# Failure to implement least privilege authorization policy<br />
# Client-side injection<br />
# Client-side DOS<br />
# Malicious third-party code<br />
# Client-side buffer overflow<br />
# Failure to apply server-side controls</div>Schmoilitohttps://wiki.owasp.org/index.php?title=OWASP_Mobile_Security_Project&diff=104583OWASP Mobile Security Project2011-02-09T12:27:48Z<p>Schmoilito: Changing "Project About" to "Main". "Main" page is empty right now.</p>
<hr />
<div>==== Main ====<br />
{{:Projects/OWASP Mobile Security Project | Project About}}<br />
<br />
==== Top Ten Mobile Risks ====<br />
{{:Projects/OWASP Mobile Security Project - Top Ten Mobile Risks | Top Ten Mobile Risks}}<br />
<br />
==== Top Ten Mobile Controls ====<br />
{{:Projects/OWASP Mobile Security Project - Top Ten Mobile Controls| Top Ten Mobile Controls}}<br />
<br />
==== iOS ====<br />
{{:Projects/OWASP Mobile Security Project - iOS | iOS}}<br />
<br />
==== Android ====<br />
{{:Projects/OWASP Mobile Security Project - Android | Android}}<br />
<br />
==== WebOS ====<br />
{{:Projects/OWASP Mobile Security Project – WebOS | WebOS}}<br />
<br />
==== Windows Mobile ====<br />
{{:Projects/OWASP Mobile Security Project – Windows Mobile | Windows Mobile}}<br />
<br />
==== Blackberry ====<br />
{{:Projects/OWASP Mobile Security Project – Blackberry | Blackberry }}<br />
<br />
<br />
__NOTOC__ <headertabs /><br />
<br />
[[Category:OWASP_Project|Mobile Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document|OWASP Alpha Quality Document]]</div>Schmoilitohttps://wiki.owasp.org/index.php?title=User:Schmoilito&diff=103186User:Schmoilito2011-02-02T22:09:18Z<p>Schmoilito: </p>
<hr />
<div>Michael Zusman is a Managing Principal Consultant with the Intrepidus Group. At Intrepidus, his focus is on assisting clients in architecting secure mobile solutions and applications for various platforms including iOS, Android, and RIM. Prior to joining Intrepidus Group, Mike has held the positions of Escalation Engineer at Microsoft, Security Program Manager at Automatic Data Processing, and lead architect & developer at a number of smaller firms.<br />
<br />
In addition to his corporate experience, Mike is an independent security researcher, and has responsibly disclosed a number of critical vulnerabilities to commercial software vendors and other clients. He has spoken about mobile application security at a number of top industry events including Black Hat, CanSecWest, OWASP meetings and at local colleges including Polytechnic University.<br />
Mike brings 12 years of security, technology, and business experience to Intrepidus Group. He has attained the CISSP certification, and is a co-leader of the OWASP Mobile Security Project.<br />
<br />
----<br />
<br />
*To see my wiki contributions, [[:Special:Contributions/Schmoilito|click here]]. <br />
<br />
*[mailto:mike.zusman@intrepidusgroup.com Email address].</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Front_Range_Web_Application_Security_Summit_Planning_Page&diff=27935Front Range Web Application Security Summit Planning Page2008-04-10T12:14:18Z<p>Schmoilito: /* Mike Zusman, Sr Consultant, Intrepidus Group - Abusing SSL VPNs & Open Reverse Proxies */</p>
<hr />
<div>==Front Range Web Application Security Summit Planning==<br />
The purpose of this page is to provide a workspace for Denver/Boulder OWASP members to collaborate and plan the upcoming Front Range Web Application Security Summit.<br />
It is official, and we have the meeting space reservation to prove it!<br />
Date: June 10, 2008<br />
Location: Tivoli Baerresen Conference Rooms (located on the Auraria Campus in Downtown Denver)<br />
900 Auraria Parkway<br />
Denver, CO 80204<br />
<br />
===Call For Papers===<br />
We are seeking presentations for both the Technical and Management tracks at the June 10th conference. A Call For Papers has been issued. The deadline for submissions is March 28th, and speakers who are selected will be notified the week of March 31st. [http://www.owasp.org/images/b/b1/FrontRangeOWASPConferenceCallForPapers2008_final.doc Please download the Call for Papers here]<br />
<br />
===Mission Statement===<br />
The purpose of the Front Range Web Application Security Summit is to provide a one-day workshop/conference during which individuals and organizations interested in Web Application Security can congregate to transfer knowledge, increase awareness of application layer security in the enterprise, and meet other like minded individuals.<br />
<br />
;Guiding Principles<br />
:No vendor soap boxes<br />
:Open, friendly environment<br />
:High quality content, professional delivery<br />
<br />
== FROCo8 Proposed Schedule – June 10th 2008 ==<br />
*PLEASE NOTE - This is just a notional schedule. Speaker times/dates/topics WILL change once we have a full agenda.<br />
{| style="width:80%" border="0" align="center"<br />
! colspan="3" align="center" style="background:#4058A0; color:white" | June 10th, 2008<br />
|-<br />
| style="width:10%; background:#7B8ABD" | || style="width:30%; background:#BC857A" | Tech Track: <br />
| style="width:30%; background:#BCA57A" | Management Track: <br />
|-<br />
| style="width:10%; background:#7B8ABD" | 08:00-09:00 || colspan="2" style="width:80%; background:#C2C2C2" align="center" | '''Registration Opens and Tech Expo'''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 09:30-10:30 || colspan="2" style="width:80%; background:#BB88BB" align="center" | '''Opening Keynote - Not Just Another Security Conference - Ed Bellis, Chief Information Security Officer for Orbitz WorldWide '''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 10:00-10:30 || colspan="2" style="width:80%; background:#BB88BB" align="center" | '''Visionary Speaker - You CAN "bolt-on" security after the fact - here's how '''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 10:30-12:00 || colspan="2" style="width:80%; background:#BB88BB" align="center" | '''Joint Manager/Developer Hands-On session '''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 12:00-13:00 || colspan="2" style="width:80%; background:#C2C2C2" align="center" | '''1 HR BREAK / TECH EXPO / LUNCH BREAK'''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 13:00-14:15 || style="width:30%; background:#BC857A" align="left" | Web Browser (In)-Security - "Past, Present, and Future" ''Robert Hansen''<br />
| style="width:30%; background:#BCA57A" align="left" | Threat Modeling<br />
''MicroSoft ACE Team''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 14:30-15:30 || style="width:30%; background:#BC857A" align="left" | "Abusing SSL VPNs & Open Reverse Proxies" ''Mike Zusman''<br />
| style="width:30%; background:#BCA57A" align="left" | Panel Discussion "Best-practices and lessons learned from integrating security into the SDLC"<br />
''Speaker list to be announced''<br />
|-<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 15:40-16:00 || colspan="3" style="width:80%; background:#C2C2C2" align="center" | '''Closing keynote - speaker and topic tbd; Raffles & Awards'''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 16:00-16:45 || colspan="3" style="width:80%; background:#C2C2C2" align="center" | '''After-conference refreshments (at Tivoli)'''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 17:00+ || colspan="3" style="width:80%; background:#C2C2C2" align="center" | '''(tbd) Reception/after-conference mixer'''<br />
|}<br />
----<br />
===[[FROCo08_Planner_Contacts|Planner Contact Info]]===<br />
'''Project Manager:''' Dariush Rusta<br />
<br />
'''Project Leads:''' <br />
<br />
Overall planning and coordination: Kathy Thaxton kthaxton at businesspartnersolutions d0t c0m<br />
<br />
Tech track lead: David Campbell (dcampbell at owasp dot org)<br />
<br />
Management track lead: tbd<br />
<br />
[http://froc.projectpath.com Project Planning Site] (Basecamp login required)<br />
<br />
== Speaker Bios and Presentation Summaries ==<br />
=== Ed Bellis, CISO, Orbitz Worldwide - Opening Keynote ===<br />
Ed is responsible for the protection and security of all information and electronic assets as well as compliance and ethics across the wide array of business units that make up Orbitz Worldwide on a global basis. These assets include Orbitz, CheapTickets, eBookers, Away.com, HotelClub, RatesToGo, AsiaHotels, and Orbitz for Business.<br />
<br />
With over 15 years of experience in information security and technology, Ed has worked with and been involved in protecting information assets at several Fortune 500 companies. Prior to joining Orbitz, Ed served as VP of Corporate Information Security for Bank of America within their Global Corporate and Investment Banking division. His credentials also include several security technology and management roles at organizations such as Ernst & Young, Ford Motor Company, and Young & Rubicam. Ed is a CISSP, CISM, a contributor to the ISM Community, and a member of ISC2, ISACA and the Chicago chapter of the ISSA.<br />
<br />
Ed is a frequent speaker at information security events across North America and Europe. Past talks have included venues such as The MIS Institute, The Association of Information Technology Professionals, Technology Executives Club, and the National Business Travel Association.<br />
<br />
=== Robert Hansen, CEO and Founder of SecTheory - Web Browser (In)-Security - "Past, Present, and Future" ===<br />
Robert Hansen (CISSP) is the CEO and Founder of SecTheory. He has worked for Digital Island, Exodus Communications and Cable & Wireless in varying roles from Sr. Security Architect and eventually product managing many of the managed security services product lines. He also worked at eBay as a Sr. Global Product Manager of Trust and Safety, focusing on anti-phishing, anti-DHTML malware and anti-virus strategies. Later he worked as a director of product management for Realtor.com. Robert sits on the advisory board for the Intrepidus Group, Just Thrive, previously sat on the technical advisory board of ClickForensics and currently contributes to the security strategy of several startup companies.<br />
<br />
Mr. Hansen authors content on Dark Reading and co-authored "XSS Exploits" by Syngress publishing. He sits on the NIST.gov Software Assurance Metrics and Tool Evaluation group focusing on web application security scanners and the Web Application Security Scanners Evaluation Criteria (WASC-WASSEC) group. He also speaks at SourceBoston, Toorcon, APWG, ISSA, OWASP/WASC, Microsoft's Bluehat, Blackhat and Networld+Interop. Mr. Hansen is a member of Infragard, Austin Chamber of Commerce, West Austin Rotary, WASC, IACSP, APWG, he is the Industry Liaison for the Austin ISSA and contributed to the OWASP 2.0 guide.<br />
<br />
'''Summary:''' Browser security is one of the least known but most important aspects to modern security. They are ubiquitous and highly insecure. They are close enough alike that many exploits will work cross browsers, and they are different enough that it makes it difficult for websites to protect themselves. This speech will cover the history of browser security, where it today and where it needs to go in the future.<br />
<br />
=== Mike Zusman, Sr Consultant, Intrepidus Group - Abusing SSL VPNs & Open Reverse Proxies ===<br />
<br />
Mike Zusman is a Senior Consultant for the Intrepidus Group. Prior to joining Intrepidus Group, Mr. Zusman has held the positions of Escalation Engineer at Whale Communications (a Microsoft subsidiary), Security Program Manager at Automatic Data Processing, and lead architect & developer at a number of smaller firms.<br />
<br />
In addition to his corporate experience, Mr. Zusman is an independent security researcher, and has responsibly disclosed a number of critical vulnerabilities to commercial software vendors and other clients.<br />
<br />
Mike has also founded a number of successful entrepreneurial ventures including Global Uplink Solutions Incorporated (hosting division acquired by Flare Technologies in 2005) and Dish Uplink LLC, a leader in satellite TV subscription activations in the US.<br />
<br />
Mike holds the CISSP certification.<br />
<br />
'''Summary:''' Internet-facing SSL VPNs and Open Reverse Proxies can be abused to perform reconnaissance, data extraction, or general mischief INSIDE the Corporate Intranet and on SSL VPN clients. This presentation will discuss programming and infrastructure flaws permitting this abuse as well as countermeasures.<br />
<br />
[https://www.owasp.org/index.php/Denver Back to OWASP Denver]<br />
<br />
[https://www.owasp.org/index.php/Boulder Back to OWASP Boulder]</div>Schmoilitohttps://wiki.owasp.org/index.php?title=Front_Range_Web_Application_Security_Summit_Planning_Page&diff=27934Front Range Web Application Security Summit Planning Page2008-04-10T12:12:14Z<p>Schmoilito: /* FROCo8 Proposed Schedule – June 10th 2008 */</p>
<hr />
<div>==Front Range Web Application Security Summit Planning==<br />
The purpose of this page is to provide a workspace for Denver/Boulder OWASP members to collaborate and plan the upcoming Front Range Web Application Security Summit.<br />
It is official, and we have the meeting space reservation to prove it!<br />
Date: June 10, 2008<br />
Location: Tivoli Baerresen Conference Rooms (located on the Auraria Campus in Downtown Denver)<br />
900 Auraria Parkway<br />
Denver, CO 80204<br />
<br />
===Call For Papers===<br />
We are seeking presentations for both the Technical and Management tracks at the June 10th conference. A Call For Papers has been issued. The deadline for submissions is March 28th, and speakers who are selected will be notified the week of March 31st. [http://www.owasp.org/images/b/b1/FrontRangeOWASPConferenceCallForPapers2008_final.doc Please download the Call for Papers here]<br />
<br />
===Mission Statement===<br />
The purpose of the Front Range Web Application Security Summit is to provide a one-day workshop/conference during which individuals and organizations interested in Web Application Security can congregate to transfer knowledge, increase awareness of application layer security in the enterprise, and meet other like minded individuals.<br />
<br />
;Guiding Principles<br />
:No vendor soap boxes<br />
:Open, friendly environment<br />
:High quality content, professional delivery<br />
<br />
== FROCo8 Proposed Schedule – June 10th 2008 ==<br />
*PLEASE NOTE - This is just a notional schedule. Speaker times/dates/topics WILL change once we have a full agenda.<br />
{| style="width:80%" border="0" align="center"<br />
! colspan="3" align="center" style="background:#4058A0; color:white" | June 10th, 2008<br />
|-<br />
| style="width:10%; background:#7B8ABD" | || style="width:30%; background:#BC857A" | Tech Track: <br />
| style="width:30%; background:#BCA57A" | Management Track: <br />
|-<br />
| style="width:10%; background:#7B8ABD" | 08:00-09:00 || colspan="2" style="width:80%; background:#C2C2C2" align="center" | '''Registration Opens and Tech Expo'''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 09:30-10:30 || colspan="2" style="width:80%; background:#BB88BB" align="center" | '''Opening Keynote - Not Just Another Security Conference - Ed Bellis, Chief Information Security Officer for Orbitz WorldWide '''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 10:00-10:30 || colspan="2" style="width:80%; background:#BB88BB" align="center" | '''Visionary Speaker - You CAN "bolt-on" security after the fact - here's how '''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 10:30-12:00 || colspan="2" style="width:80%; background:#BB88BB" align="center" | '''Joint Manager/Developer Hands-On session '''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 12:00-13:00 || colspan="2" style="width:80%; background:#C2C2C2" align="center" | '''1 HR BREAK / TECH EXPO / LUNCH BREAK'''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 13:00-14:15 || style="width:30%; background:#BC857A" align="left" | Web Browser (In)-Security - "Past, Present, and Future" ''Robert Hansen''<br />
| style="width:30%; background:#BCA57A" align="left" | Threat Modeling<br />
''MicroSoft ACE Team''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 14:30-15:30 || style="width:30%; background:#BC857A" align="left" | "Abusing SSL VPNs & Open Reverse Proxies" ''Mike Zusman''<br />
| style="width:30%; background:#BCA57A" align="left" | Panel Discussion "Best-practices and lessons learned from integrating security into the SDLC"<br />
''Speaker list to be announced''<br />
|-<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 15:40-16:00 || colspan="3" style="width:80%; background:#C2C2C2" align="center" | '''Closing keynote - speaker and topic tbd; Raffles & Awards'''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 16:00-16:45 || colspan="3" style="width:80%; background:#C2C2C2" align="center" | '''After-conference refreshments (at Tivoli)'''<br />
|-<br />
| style="width:10%; background:#7B8ABD" | 17:00+ || colspan="3" style="width:80%; background:#C2C2C2" align="center" | '''(tbd) Reception/after-conference mixer'''<br />
|}<br />
----<br />
===[[FROCo08_Planner_Contacts|Planner Contact Info]]===<br />
'''Project Manager:''' Dariush Rusta<br />
<br />
'''Project Leads:''' <br />
<br />
Overall planning and coordination: Kathy Thaxton kthaxton at businesspartnersolutions d0t c0m<br />
<br />
Tech track lead: David Campbell (dcampbell at owasp dot org)<br />
<br />
Management track lead: tbd<br />
<br />
[http://froc.projectpath.com Project Planning Site] (Basecamp login required)<br />
<br />
== Speaker Bios and Presentation Summaries ==<br />
=== Ed Bellis, CISO, Orbitz Worldwide - Opening Keynote ===<br />
Ed is responsible for the protection and security of all information and electronic assets as well as compliance and ethics across the wide array of business units that make up Orbitz Worldwide on a global basis. These assets include Orbitz, CheapTickets, eBookers, Away.com, HotelClub, RatesToGo, AsiaHotels, and Orbitz for Business.<br />
<br />
With over 15 years of experience in information security and technology, Ed has worked with and been involved in protecting information assets at several Fortune 500 companies. Prior to joining Orbitz, Ed served as VP of Corporate Information Security for Bank of America within their Global Corporate and Investment Banking division. His credentials also include several security technology and management roles at organizations such as Ernst & Young, Ford Motor Company, and Young & Rubicam. Ed is a CISSP, CISM, a contributor to the ISM Community, and a member of ISC2, ISACA and the Chicago chapter of the ISSA.<br />
<br />
Ed is a frequent speaker at information security events across North America and Europe. Past talks have included venues such as The MIS Institute, The Association of Information Technology Professionals, Technology Executives Club, and the National Business Travel Association.<br />
<br />
=== Robert Hansen, CEO and Founder of SecTheory - Web Browser (In)-Security - "Past, Present, and Future" ===<br />
Robert Hansen (CISSP) is the CEO and Founder of SecTheory. He has worked for Digital Island, Exodus Communications and Cable & Wireless in varying roles from Sr. Security Architect and eventually product managing many of the managed security services product lines. He also worked at eBay as a Sr. Global Product Manager of Trust and Safety, focusing on anti-phishing, anti-DHTML malware and anti-virus strategies. Later he worked as a director of product management for Realtor.com. Robert sits on the advisory board for the Intrepidus Group, Just Thrive, previously sat on the technical advisory board of ClickForensics and currently contributes to the security strategy of several startup companies.<br />
<br />
Mr. Hansen authors content on Dark Reading and co-authored "XSS Exploits" by Syngress publishing. He sits on the NIST.gov Software Assurance Metrics and Tool Evaluation group focusing on web application security scanners and the Web Application Security Scanners Evaluation Criteria (WASC-WASSEC) group. He also speaks at SourceBoston, Toorcon, APWG, ISSA, OWASP/WASC, Microsoft's Bluehat, Blackhat and Networld+Interop. Mr. Hansen is a member of Infragard, Austin Chamber of Commerce, West Austin Rotary, WASC, IACSP, APWG, he is the Industry Liaison for the Austin ISSA and contributed to the OWASP 2.0 guide.<br />
<br />
'''Summary:''' Browser security is one of the least known but most important aspects to modern security. They are ubiquitous and highly insecure. They are close enough alike that many exploits will work cross browsers, and they are different enough that it makes it difficult for websites to protect themselves. This speech will cover the history of browser security, where it today and where it needs to go in the future.<br />
<br />
=== Mike Zusman, Sr Consultant, Intrepidus Group - Abusing SSL VPNs & Open Reverse Proxies ===<br />
<br />
Mike Zusman is a Senior Consultant for the Intrepidus Group. Prior to joining Intrepidus Group, Mr. Zusman has held the positions of Escalation Engineer at Whale Communications (a Microsoft subsidiary), Security Program Manager at Automatic Data Processing, and lead architect & developer at a number of smaller firms.<br />
<br />
In addition to his corporate experience, Mr. Zusman is an independent security researcher, and has responsibly disclosed a number of critical vulnerabilities to commercial software vendors and other clients.<br />
<br />
Mike has also founded a number of successful entrepreneurial ventures including Global Uplink Solutions Incorporated (hosting division acquired by Flare Technologies in 2005) and Dish Uplink LLC, a leader in satellite TV subscription activations in the US.<br />
<br />
Mike holds the CISSP certification.<br />
<br />
'''Summary:''' Internet-facing SSL VPNs and Open Reverse Proxies can be abused to perform reconnaissance, data extraction, or general mischief INSIDE the Corporate Intranet. This presentation will discuss programming and infrastructure flaws permitting this abuse as well as countermeasures.<br />
<br />
[https://www.owasp.org/index.php/Denver Back to OWASP Denver]<br />
<br />
[https://www.owasp.org/index.php/Boulder Back to OWASP Boulder]</div>Schmoilito