This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
AppSec Brasil 2009
Para a versão em português, veja em AppSec Brasil 2009 (pt-br)
International Conference on Application Security
TI-Controle and the Computing Centre of the Deputy Chamber present the First International Conference on Application Security that will happen in Brasilia, Capital of Brazil with the support of OWASP Brazilian Chapter. The Conference consists of two days of training sessions, followed by a two-day conference on a single track. 
Conference Dates
The conference will happen from October 27th, 2009 to October 30th, 2009. The first two days will be tutorial days (see below). Plenary sessions will be held on October 29th and 30th.
Conference's Slides and Videos
The Presentations' slides and videos are available under the Presentation Abstracts tab.
The Training Sessions' slides are available under the Training Sessions tab
Sponsorship
This conference is promoted by TI-Controle Community and organized by Computing Centre of Brazilian Deputy Chamber.
The conference is supported by OWASP Brazilian Chapter, as content provider (talks selection, trainings and schedule grid).
The conference is supported by the University of Brasilia (UnB) 
The conference is sponsored by Conviso IT Security 
and LeadComm 
Keynotes
CTO, Cigital
Title: The Building Security In Maturity Model (BSIMM)
Bio: Gary McGraw is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C. area. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Java Security, Building Secure Software, Exploiting Software, Software Security, and Exploiting Online Games; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 100 peer-reviewed scientific publications, authors a monthly security column for informIT, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean's Advisory Council for the School of Informatics. Gary served on the IEEE Computer Society Board of Governors, produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine (syndicated by informIT), and produces the Reality Check Security Podcast for CSO Online.
Jason Li and Jerry Hoff
Title: Agile and Secure: Can We Do Both?
Bio: Jason Li is a Senior Application Security Engineer at Aspect Security. Jason has led security architecture reviews, application security code reviews, penetration tests and provided web application security training services for a variety of commercial, financial, and government customers. He is also actively involved in the Open Web Application Security Project (OWASP), serving on the OWASP Global Projects Committee and as a co-author of the OWASP AntiSamy Project (Java version). Jason earned his Post-Master's degree in Computer Science with a concentration in Information Assurance from Johns Hopkins University. He earned his Master's degree in Computer Science from Cornell University, where he also earned his Bachelor's degree, double majoring in Computer Science and Operations Research.
Jerry Hoff is a Senior Application Security Engineer at Aspect Security. Jerry has led and performed numerous application security code reviews for clients across multiple industries. Jerry also provides training services for clients, and has over 10 years teaching and development experience. Jerry is also involved in the Open Web Application Security Project (OWASP) and was the lead developer of AntiSamy.net project. He has a master's degree in Computer Science from Washington University in St. Louis.
Dinis Cruz
OWASP Board
Title: To be defined
Bio: Coming Soon.
Kuai Hinojosa
OWASP
Title: Deploying Secure Web Applications with OWASP Resources
Bio: Kuai Hinojosa has been developing and securing web applications for about 12 years. He previously worked in the banking industry as a database security administrator for the 5th largest bank in the U.S. where he worked in a small team developing applications that protected company's assets. He now works for New York University as a Web Applications Specialist where he continues to use web application development and application security experience to protect university resources. In his spare time Kuai volunteers his time preaching the application security gospel and leading the Minneapolis OWASP chapter. Kuai is a member of the OWASP (Open Web Application Security Project) Global Education Committee.
Agenda
Conference Program - Day 1 - October 29th 2009
| 08:30 - 09:00 | Reception Desk Open |
| 09:00 - 10:00 | Opening Ceremony |
| 10:00 - 10:30 | Dinis Cruz What is OWASP? |
| 10:30 - 12:30 | Gary McGraw (Cigital) The Building Security In Maturity Model (BSIMM) |
| 12:30 - 14:00 | Lunch Break |
| 14:00 - 14:50 | Dinis Cruz OWASP Project Tour |
| 14:50 - 15:40 | Thomas Schreiber The Logic and Semantic Layer of Web Application Security |
| 15:40 - 16:00 | Break |
| 16:00 - 16:50 | Brian Contos Making a Case for Data Security to Network-Centric Peers and Managers and Leveraging Web Application Firewalls (WAF) and Database Activity Monitoring (DAM) to Augment Secure Coding & Review Practices |
| 16:50 - 17:40 | Matt Tesauro OWASP ROI: Optimize Security Spending using OWASP |
| 17:40 - 18300 | Pravir Chandra Software Assurance Maturity Model (SAMM) |
| 18:30 - 18:35 | End of the First Day Program |
Conference Program - Day 2 - October 30th 2009
| 08:30 - 09:00 | Reception Desk Open |
| 09:00 - 10:30 | Jason Li e Jerry Hoff (Aspect Security) Agile and Secure - Can we do both? |
| 10:30 - 10:50 | Break |
| 10:30 - 11:40 | Cassio Goldschmidt Praticas e ferramentas fundamentais para o desenvolvimento de software seguro (Tools and Practices for Secure Software Development) |
| 11:40 - 12:30 | Luiz Otávio Duarte Abordagem Preventiva para Teste de Segurança em Aplicações Web (Preventive Approach for Web Application Security Testing) |
| 12:30 - 14:00 | Lunch Break |
| 14:00 - 15:10 | Ulisses Castro SQL Injection: Amplifying Data Leakeage |
| 15:10 - 16:00 | Sebastian Cufre Automated SQL Ownage Techniques |
| 16:00 - 16:20 | Break |
| 16:20 - 17:10 | Klaubert Herr da Silveira ModSecurity: Firewall OpenSource para Aplicações Web (WAF) (ModSecurity, Open Source Web Application Firewall) |
| 17:10 - 18:00 | Philippe Sevestre Programação Segura utilizando Análise Estática (Secure Programming with Static Analysis) |
| 18:00 - 18:30 | End of the Conference |
Presentation Abstracts
The Building Security In Maturity Model (BSIMM)
Gary McGraw, Cigital
As a discipline, software security has made great progress over the last decade. There are now at least 34 large scale software security initiatives underway in enterprises including global financial services firms, independent software vendors, defense organizations, and other verticals. In 2008, Brian Chess, Sammy Migues and I interviewed the executives running nine initiatives using the twelve practices of the Software Security Framework as our guide. Those companies among the nine who graciously agreed to be identified include: Adobe, The Depository Trust and Clearing Corporation (DTCC), EMC, Google, Microsoft, QUALCOMM, and Wells Fargo. The resulting data, drawn from real programs at different levels of maturity was used to guide the construction of the Building Security In Maturity Model (BSIMM). This talk will describe the observation-based maturity model, drawing examples from many real software security programs. A maturity model is appropriate because improving software security almost always means changing the way an organization works ---people, process, and automation are all required. While not all organizations need to achieve the same security goals, all successful large scale software security initiatives share common ideas and approaches. Whether you rely on the Cigital Touchpoints, Microsoft's SDL, or OWASP CLASP, there is much to learn from practical experience. Use the BSIMM as a yardstick to determine where you stand and what kind of software security plan will work best for you.
Agile and Secure: Can We Do Both?
Jason Li and Jerry Hoff, Aspect Security
Agile is taking the software development world by storm, but security has been slow to adapt. What can we learn from the Agile movement? Is it possible to achieve security and remain Agile? Jason and Jerry will share Aspect Security's experiences working with Agile teams to gain assurance and save money. They'll compare and contrast traditional waterfall and agile processes and show how we can achieve assurance and security while remaining true to Agile principles.
Deploying Secure Web Applications with OWASP Resources
Kuai Hinojosa, NY University and OWASP
Universities are key to making application security visible and the need to educate software developers about application security as an aspect of proper software development has never been more important. In this presentation I will share how OWASP resources can be used by universities to develop, test and deploy secure web applications. I will discuss challenges that Universities currently face integrating a pplication security best practices, describe how OWASP tools and resources are currently used at New York University to test for most common web application flaws. I will introduce projects such as the OWASP Enterprise Security API which can be used to mitigate most common flaws in web applications and share initiatives the OWASP Global Education Committee is currently working on. If you are interested in securing web applications, and supporting the OWASP Global Education Committee efforts you don't want to miss this!
What is OWASP
Dinis Cruz, OWASP
TBD.
OWASP Project Tour
Dinis Cruz, OWASP
TBD.
The Logic and Semantic Layer of Web Application Security
Thomas Schreiber, SecureNet
Testing Web Application Security mostly focusses on technical weaknesses only. But there is a huge field of potential weaknesses above the server layer and beyond the implementational aspects. Even if a web application is totally free from security bugs in code and system, it may still be vulnerable to dangerous threats. It is the kind how the business logic is mapped onto software, that gives an attacker a starting point for his bad intents. The presentation shows, illustrated with various real examples, how a clever hacker may reveal sensitive data - including credit card data -, enter into user accounts or conduct a denial-of-service on the whole infrastructure - not only the server - by attacking the logical and semantical layers. The presentation also gives hints on how to avoid these pitfalls.
Making a Case for Data Security to Network-Centric Peers and Managers and Leveraging Web Application Firewalls (WAF) and Database Activity Monitoring (DAM) to Augment Secure Coding & Review Practices
Brian Contos, Imperva
Information system security has changed. The days of being focused on network security measures, operating system vulnerabilities, and open ports, while still important, is no longer the main concern for most organizations. Today, the attackers – organized crime, competitors, nation-states, and malicious insiders are going after the assets that process and store data: applications and databases. The criminals are already fighting the fight on this front. In response, organizations are deploying new defenses - adopting application and data security countermeasures that allow them to protect, monitor and respond to nefarious activity.
OWASP ROI: Optimize Security Spending using OWASP
Matt Tesauro
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budgetfriendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a notforprofit entity and provides unbiased, practical, costeffective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, OpenSAMM Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study, the company realized a saving of nearly $400,000 in year one.
Software Assurance Maturity Model (SAMM)
Pravir Chandra, Fortify
The Software Assurance Maturity Model (SAMM) (http://www.opensamm.org) is a flexible and prescriptive framework for building security into a software development organization. Covering more than typical SDLC-based models for security, SAMM enables organizations to self-assess their security assurance program and then use recommended roadmaps to improve in a way that's aligned to the specific risks facing the organization. Beyond that, SAMM enables creation of scorecards for an organization's effectiveness at secure software development throughout the typical governance, development, and deployment business functions. Scorecards also enable management within an organization to demonstrate quantitative improvements through iterations of building a security assurance program. This workshop will introduce the SAMM framework and walk through useful activities such as assessing an assurance program, mapping an existing organization to a recommended roadmap, and iteratively building an assurance program. Time allowing, additional case studies will also be discussed. SAMM is an open a free project and has recently been added under the Open Web Application Security Project (OWASP).
SQL Injection: Amplifying Data Lekeage
Ulisses Castro
Talk about how some SQL Injection techniques works and how they can be more effective when mixin with some available database native functions.
The main idea is how you can amplifying the amount of data that is downloaded per request to the web server.
Automated SQL Ownage Techniques
Sebastian Cufre, Core Security
This talk is about web application security assessment. In particular, in this talk we set to improve the assessment process for SQL injection vulnerabilities by providing the means to discard exogenous "false positive" alarms and confirm exploitable vulnerabilities.
We propose a black-box technique to detect and exploit SQL injection vulnerabilities. The exploitation provides an interface to execute arbitrary SQL code through them. Therefore, we are able to thoroughly assess the impact of the vulnerability (e.g., understand what a hacker can do).
The core of this talk is in examining the difficulties that appear while trying to expose vulnerability and how to do a black-box interaction to automatically construct an exploit.
Praticas e ferramentas fundamentais para o desenvolvimento de software seguro (Tools and Practices for Secure Software Development)
Cassio Goldschmidt, Symantec
Implementing a security program for the whole application life cycle can be a daunting and costly task. So, in the development of this talk, we will demonstrate how it is possible to lessen the risk of this program, using high quality resource freely available on the Internet and studying the practices considered fundamental by SAFECode members (EMC, Juniper, Microsoft, Nokia, SAP, symantec).
Abordagem Preventiva para Teste de Segurança em Aplicações Web (Preventive Approach for Web Application Security Testing)
Luiz Otávio Duarte, Ferrucio de Franco Rosa, Walcir M. Cardoso Jr., CTI/MCT
The objetive of this lecture is to present the approach used by CTI (Renato Archer Information Technology Center, institution under the Brazilian Ministry of Science and Technology) for security testing of web applications. The presentation is organized as follows: First, an introduction will be presented, including important concepts, motivation, statistics and most critical vulnerabilities nowadays.
Later will be shown techniques for software testing and techniques for software security testing. Then we show the approach used by CTI to security testing web application such as inspection of source code, use of regular expressions and vulnerability detection techniques. A pratical demonstration will be presented after the approach overview.
The presentation will be finalized with conclusions and recommendations of best practices for security testing web applications.
ModSecurity: Firewall OpenSource para Aplicações Web (WAF) (ModSecurity, Open Source Web Application Firewall)
Klaubert Herr da Silveira
With the growing complexity and importance of web applications, short development schedule, new attack techniques and the lack of attention and/or focus of developer with security, regulations and the seek for best practices, is necessary add a new layer of security to web applications, the "web applications firewalls" or WAF's. This talk will show the concepts of WAF, specially of ModSecurity, open source web application firewall, a powerful and complex tool, designed to understand and protect the web applications of many types, Will be presented their functionalities, and how it can help the day-by-day of a web site, for monitoring, protection or even as a troubleshooting tool for web application.
Programação Segura utilizando Análise Estática (Secure Programming with Static Analysis)
Philippe Sevestre, LeadComm
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine-tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution.
We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.
Training Sessions
Risk Management Applied to Web Services
José Eduardo Malta de Sá Brandão, IPEA
This course will be in Portuguese only.
Date: Oct 27
Time: Morning
This training will present the risk management discipline regarding web services. The course focus will show concepts and systematize this discipline, exemplifying with a case study to reinforce the utility and need of using these methodology to understand and develop web services. The course should provide its students the knowledge to develop their own risk management projects. The presentation will show concepts, models and compare the main standards related to security risk management.
Web Security: Techniques for Secure Application Programming
André Ricardo Abed Grégio e Vitor Monte Afonso, CTI/MCT, Paulo Licio de Geus, IC/UNICAMP
This course will be in Portuguese only.
Date: Oct 28
Time: afternoon
This course aims to present the principles and techniques of secure programming, specially web application programming, showing fundamental concepts and detailing the vulnerabilities which could be explored and focusing on the methods to mitigate those faults. We will present some examples of how some OWASP Top Ten vulnerabilities can be corrected in different programming languages, with code vulnerable snippets from code reviews conducted by the training authors. Some tools for detecting attacks and web application vulnerability testing will be presented.
Computational Security in Web Service Development
Júlio Cesar Estrella et al, ICMC/USP
This course will be in Portuguese only.
Date: Oct 28
Time: all day
This training session will present the development of distributed applications using the concept of SOA and considering its computational security. For the development of the client and server applications, we will use the Apache Axis2 engine. The basic components of Axis2 will be presented, as well as the web service invocation types and models, and their main characteristics. Two web service security standards will be seen in the context of the Apache Axis2 engine: WS-Security and SAML. The methodology used for this training session includes theory and practice, touching the fundamental concepts of the Axis2 engine and the construction of real applications with focus on security.
Security Technologies in Web Services
Eduardo Takeo Ueda e Wilson Vicente Ruggiero, Poli/USP
This course will be in Portuguese only.
Data: Oct 28
Time: morning
Due to their integration characteristics and because they use open standards, web services have become an area of great interest to academics and industry. Firstly, we will introduce the basic concepts of a service oriented architecture, so the training can be self sufficient. After, we will present the main security standards and specifications in development and which must be adopted for web services. Lastly, the training ends with an exposition of the current challenges in web service security.
Hands on Web Application Testing using the OWASP Testing Guide.
Matt Tesauro, OWASP
Date: Oct 27 and 28 (2 days)
Time: all day
The training will cover the critical areas of web application testing using the OWASP Testing Guide v3 as the framework for testing an application and the OWASP Live CD for the tools to test with. A custom version of the OWASP Live CD will be created for the training. It will include a self-contained testing environment providing vulnerable applications so that both tools and the applications to test them on are provided.
This course requires a laptop for the hands-on activities. Each student should bring its own laptop.
Venue
The event will be held in Brasília, Brazil's Capital at: Câmara dos Deputados, Anexo II, Praça dos Três Poderes.
You can check the location at Google Maps
Training Sessions
All training sessions will happen in the Deputy Chamber Cororate University (CEFOR), which is located at the following address:
Centro de Formação, Treinamento e Aperfeiçoamente da Câmara dos Deputados, via N3, Projeção L, Setor de Garagens Ministeriais Norte, Complexo Avançado da Câmara dos Deputados, Bloco B.
Check its location on this map.
How to get there
We are trying to provided a transfer from somewhere in the Esplanada dos Ministérios, which is accessible by bus. Any new information on this will be posted in this page.
To go by taxi, show the map to the driver. It is improbable tha any taxi driver will be able to get you to the training sessions location just by reading is address. With the map, arriving to the location is quite easy and fast from any downtown location.
We strongly recommend against getting to the trainings in your own car, as it is very difficult to find unused parking slots in this part of town.
Registration
Registration and Conference Fees
There will be no fees for this conference, only registration is required to participate. The registration form can be found here.
The training session registration form can be found here
Committees
Conference Committee
OWASP Conferences Chair: Dave Wichers - Aspect Security - dave.wichers 'at' owasp.org
2009 AppSec Brasil Program Committee ([email protected]):
- Conference Chair: Lucas C. Ferreira (lucas.ferreira at owasp.org)
- Tutorials Organization: Eduardo V. C. Neves (eduardo.neves at owasp.org)
- Tracks Organization: Wagner Elias (wagner.elias at owasp.org)
Organization Team
- Cassio Goldschmidt (cassio 'at' owasp.org)
- Kuai Hinojosa (kuai.hinojosa 'at' owasp.org)
- Leonardo Cavallari - (leo.cavallari 'at' owasp.org)
- Thiago Lechuga (thiagoalz 'at' gmail.com)
- Dinis Cruz (dinis.cruz 'at' owasp.org)
Links and other information
Event page on LinkedIn: http://events.linkedin.com/OWASP-AppSec-Brasil/pub/65160
FAQ
Q. Who is promoting the conference?
A. This conference is being supported and organized by the TI-Controle Community and the Deputy Chamber, with the contents (presentations, keynotes, training, etc) selected by the OWASP Brazilian Chapter.
Q. What will it cost?
A. Nothing. Thanks to its sponsor, the conference will be free of charge. However we have limited seats, so please register early.
Call For Papers
Q. What is the Open Web Application Security Project (OWASP)?
The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work with your support.
Q. How many speaking slots are there?
Please see the Conference Agenda in its main page.
Q. What are the submission deadlines?
The CFP submission deadline is July 11th, with the final version of the presentation material due September 15th 2009.
Q: Who is allowed to submit presentations?
A: Original authors may submit presentations for consideration. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.
Q: Why aren't Third Parties such as PR Firms allowed to submit presentations?
A: Due to potential copyright and intellectual property liability issues as well as the need for OWASP to have direct contact with potential and selected presenters to expedite selection and deliverable materials, we require that only original authors of presentations submit for the Call for Papers. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.
Q: Are there any restrictions on the content of the presentations?
A: Yes, all presentations must respect the rules defined in the OWASP Speaker Agreement.
Q: How long will I have to wait before I am notified if I have been accepted or denied?
A: Submitters will be notified of the status (acceptance or denial) on August 7th 2009.
Q. Is there an honorarium for presenters?
No. OWASP is committed to making its conferences available to the widest possible audience. In order to do this OWASP keeps the entrance free for the AppSec Brazil 2009 to make the conference accessible. As a result we are unable to provide a monetary honorarium but we welcome our speakers as our guests to the conference where they can network with other security professionals. We will provide lodging and domestic air travel for one presenter for each selected work.
Q: I have been accepted. What are the materials that I have to turn in and what are the deadlines?
A: The following is a list of materials that are required from each accepted presentation. Failure to proceed these materials by the deadlines set forth for the event the presentation was accepted for will result in cancellation of acceptance.
- A confirmed Speaker Agreement (July 15th 2009)
- Presentation in PowerPoint or Keynote format using the OWASP Template (September 15th 2009)
- Detailed Bibliography of resources, co-authors, etc. (September 15th 2009)
- Optional White Paper for inclusion on CD (September 15th 2009)
Q: Do I have to submit a White Paper?
A: No. We would certainly appreciate any White Papers that can be included on the conference web site but they are not required. If you have written an existing white paper to go along with your presentation, please submit it with your CFP submission. Submissions with attached White Papers will receive additional consideration.
Q: What if I have a co-author who is not presenting. How do I cite the person(s)?
A: All co-authors and works that have been used should be cited in a detailed bibliography that will be published on the Conference CD.
Q: I have been accepted and would like to add co-presenters. Can I still do this?
A: No. Co-presenters should have been added at the time that the Presentation was submitted. They may attend the conference and present if they register as any other participant.
Q: My PR company/friends/co-workers/family would like to come see me give my presentation. Will they be allowed in for free?
A: Yes, but they need to register on the conference web site as any other conference participant.
Q. I have more questions
A: Email [email protected] concerning this event.
