EUTour2013


	OWASP EUROPE TOUR 2013 Tour Home Page Tour Scheadule Tour Organizers Resources Mailing List

EU Tour Objective

The OWASP Europe Tour objective is to raise awareness about application security in the European region, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.

Who Should Attend the Europe Tour?

Application Developers
Application Testers and Quality Assurance
Application Project Management and Staff
Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff
Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance
Security Managers and Staff
Executives, Managers, and Staff Responsible for IT Security Governance
IT Professionals Interesting in Improving IT Security
Anyone interested in learning about or promoting Web Application Security

SPECIAL OFFER - BECOME AN OWASP MEMBER

As part of the OWASP Europe Tour, you could become an OWASP Member by ONLY paying 50 U$D. Show your support and become an OWASP member today!

QUESTIONS

If you have any questions about the EU Tour, please send an email to Fabio Cerullo (fcerullo@owasp.org)

Use the #eutour hashtag for your tweets for Europe Tour (What are hashtags?)

@AppSecEU Twitter Feed (follow us on Twitter!) <twitter>34534108</twitter>

	Gold Sponsors

	Sponsors

	Event Supporters

	Educational Supporters



	Community Supporters

CONFERENCE AND TRAINING
OWASP Europe Tour - Cambridge 2013 Monday 13th May (Conference)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE (Monday 13th May)
Fecha	Lugar
Monday 13th May	Venue Location: Anglia Ruskin University (Cambridge) - Lord Ashcroft Building - Room LAB002 Venue Address: East Road, Cambridge, CB1 1PT Venue Map: Anglia Ruskin University - Getting to Cambridge
Price and registration
This event is FREE Registration Link to the Europe Tour: OWASP Cambridge Chapter Registration

Conference Details
Time	Title	Speaker	Description
11:00 (0 mins)	Registration
11:45 (0 mins)	Introduction & Welcome	Adrian Winckles - OWASP Cambridge Chapter Leader & Senior Lecturer	Introduction to OWASP & Anglia Ruskin University Schedule for the Day
12:00 (45 mins)	Real Costs of Cybercrime	Ross Anderson (Cambridge University)	Following a systematic study of the costs of cybercrime, in response to a request from the UK Ministry of Defence following scepticism that previous studies had hyped the problem, each of the main categories of cybercrime we set out what is and is not known of the direct costs, indirect costs and defence costs { both to the UK and to the world as a whole. We distinguish carefully between traditional crimes that are now `cyber' because they are conducted online (such as tax and welfare fraud); transitional crimes whose modus operandi has changed substantially as a result of the move online (such as credit card fraud); new crimes that owe their existence to the Internet; and what we might call platform crimes such as the provision of botnets which facilitate other crimes rather than being used to extract money from victims directly.
12:45 (45 mins)	Three Legged Cybercrime Investigation and its Implications	DI Stewart Garrick (Metropolitan Police ECrime Unit)	DI Stewart Garrick has over 27 years experience in the Metropolitan Police Service, 22 years as a detective and 10 years as a Detective Inspector. His career has been spent primarily on major crime units engaged on both proactive and reactive investigations, including 5 years investigating murders, 3 years on the Homicide Task Force (a proactive unit targeting those who would commit murder) and 5 years managing covert operations against organised crime. In March 2011 he joined Scotland Yard's Police Central eCrime Unit. He has witnessed the PCeU's growth from 40 officers to over 100 and has managed several high profile investigations. He has recently taken charge of the unit's cadre of police and civilian forensic examiners who are integrated into the unit's dynamic investigative model. He has this year completed an MSc in Countering Organised Crime and Terrorism at UCL, with a dissertation examining the emergence of radicalising settings based on Situational Action Theory.
13:30 (45 mins)	OWASP Mobile Top 10	Justin Clarke - London OWASP Chapter Leader	The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications. Through the project, our goal is to classify mobile security risks and provide developmental controls to reduce their impact or likelihood of exploitation. As part of the overall Mobile Project , the Top 10 Mobile Risks include M1: Insecure Data Storage M2: Weak Server Side Controls M3: Insufficient Transport Layer Protection M4: Client Side Injection M5: Poor Authorization and Authentication M6: Improper Session Handling M7: Security Decisions Via Untrusted Inputs M8: Side Channel Data Leakage M9: Broken Cryptography M10: Sensitive Information Disclosure
14:15 (45 mins)	Refreshments & Networking	LAB107
15:00 (45 mins)	Everything We Know is Wrong	Eoin Keary - OWASP Global Committee	The premise behind this talk is to challenge both the technical controls we recommend to developers and also out actual approach to testing. This talk is sure to challenge the status quo of web security today. "Insanity is doing the same thing over and over and expecting different results." - Albert Einstein We continue to rely on a “pentest” to secure our applications. Why do we think it is acceptable to perform a time-limited test of an application to help ensure security when a determined attacker may spend 10-100 times longer attempting to find a suitable vulnerability? Our testing methodologies are non-consistent and rely on the individual and the tools they use. Currently we treat vulnerabilities like XSS and SQLI as different issues but the root causes it the same. – it’s all code injection theory!! Why do we do this and make security bugs over complex? Why are we still happy with “Testing security out” rather than the more superior “building security in”?
15:45 (45 mins)	Tricolour Alphanumercial Spaghetti	Colin Watson - OWASP Project Leader	Do you know your "A, B, Cs" from your "1, 2, 3s"? Is "red" much worse than "orange", and why is "yellow" used instead of "green"? Just what is a "critical" vulnerability? Is "critical" the same as "very high"? How do PCI DSS "level 4 and 5" security scanning vulnerabilities relate to application weaknesses? Does a "tick" mean you passed? Are you using CWE and CVSS? Is a "medium" network vulnerability as dangerous as a "medium" application vulnerability? Can CWSS help? What is FIPS PUB 199? Does risk ranking equate to prioritisation? What is "one" vulnerability? Are you drowning in a mess of unrelated, classifications, terminology and abbreviations? If you are a security verifier and want to know more about ranking your findings more meaningfully, or receive test reports and want to better understand the results, or are just new to ranking weaknesses/vulnerabilities and want an overview, come along to this presentation. It will also explain why the unranked information-only ("grey" or "blue"?) findings might contain some of the best value information.
16:30 (45 mins)	Secure Coding, some simple steps help.	Steven van der Baan - OWASP Cambridge	Secure coding is often perceived as difficult and complex. While it is true that 'good security' should be embedded into the design, there are a couple of steps a developer can take which lead to a more secure application. In this presentation we will go to the basics of secure application development and demonstrate these principles which help you build security into your application.

REGIONAL MEETING
OWASP Europe Tour - Leicester 2013 Wednesday 15th May (Regional Meeting)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

Wednesday 15th May
When	Where
Wednesday 15th May	Venue Location: De Montfort University, Leicester Venue Address: Hugh Aston Building, De Montfort University, Leicester Venue Map: Google Maps
Price and registration
This event is FREE Due to limited space, registration is required for this event: Book your free place now!

EUTour2013

OWASP Europe Tour - Cambridge 2013

OWASP Europe Tour - Leicester 2013

OWASP Europe Tour - London 2013

OWASP Europe Tour - Czech 2013

OWASP Europe Tour - Bucharest 2013

OWASP Europe Tour - Belgium 2013

Bio

OWASP Europe Tour - The Netherlands 2013

OWASP Europe Tour - Denmark 2013

OWASP Europe Tour - Barcelona 2013

OWASP Europe Tour - Finland 2013

Abstract

Bio

OWASP Europe Tour - Lisbon 2013

OWASP Europe Tour - France 2013

OWASP Europe Tour - Geneva (Switzerland) 2013

OWASP Europe Tour - Dublin 2013

OWASP Europe Tour - Rome 2013

Sponsorship

Gold Sponsors

Sponsors

Event Supporters

Educational Supporters

Community Supporters

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

Reference

Tools

Meeting Details
Time	Title	Speaker	Description
18:00 (10 mins)	Arrival and Welcome
18:10 (45 mins)	Me, a camera and a bucket!	Robin Wood (@digininja)
19:00 (45 mins)	Time for a better gun!	Arron "Finux" Finnon (@f1nux):
19:50 (45 mins)	All Your Files Are Belong to Us!	David Lodge

CONFERENCE AND TRAINING
OWASP Europe Tour - London 2013 Monday 3rd June
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

London EUTour2013 Conference Day (Monday 3rd June)
Date	Location
Monday 3rd June	Venue Location: Lion Court Conference Centre Venue Address: 25 Procter Street, Holborn, London, WC1V 6NY Venue Map: Google Maps
Price and registration
This event is FREE and open to all Registration Link to the Europe Tour: REGISTER HERE!

CONFERENCE AND TRAINING
OWASP Europe Tour - Czech 2013 I have to inform you this meeting was postponed because of serious floods in Prague. New date to be announced. (Conference) '
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE
OWASP Europe Tour - Bucharest 2013 Wednesday 5th June (Conference)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE (Wednesday 5th of June)
Date	Location
Wednesday 5th of June	Venue Location: University "Politehnica" of Bucharest Venue Address: Splaiul Independentei nr. 313, sector 6, Bucuresti, ROMANIA; Rectorship Building, Senate Hall Postal cod: RO-060042 Venue Map: [1]
Price and registration
This event is FREE Registration Link to the Europe Tour: http://owasp-romaniachapter-eorg.eventbrite.com/

CONFERENCE AND TRAINING
OWASP Europe Tour - Belgium 2013 Thursday 6th June (Conference) '
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE
OWASP Europe Tour - The Netherlands 2013 'Thursday, June 20th (Conference)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE (Thursday, June 20th)
Date	Venue	PR material
Thursday, June 20th	Hogeschool van Amstedam Venue Address: Duivendrechtsekade 36-38, 1096 AH Amsterdam Venue Map: Google Maps	Flyer (pdf A4 format) Poster(pdf A3 format)
Price and registration
This event is FREE Registration Link to the Europe Tour: Click here

CONFERENCE AND TRAINING
OWASP Europe Tour - Denmark 2013 Monday 10th of June 2013 from 1700 - 2115
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

Conference Details
Time	Title	Speaker	Description
02:30 pm (30 mins)	Introduction & Welcome	Ionel Chirita, Claudiu Constantinescu	Introduction to OWASP
03:15 pm (45 mins)	Penetration Testing - a way for improving our cyber security	Adrian Furtună	The talk presents a comparison between two internal penetration tests made in consecutive years at the same client. We will see the successful attack scenarios and the techniques used to take control over the network. Furthermore, we will see how and why the security posture of the client improved as a result of the penetration tests.
04:15 pm (45 mins)	Android reverse engineering: understanding third-party applications	Vicente Aguilera	It will present the objectives of the software reverse engineering and the techniques and tools to execute this process in Android applications. It will present, from a security analyst point of view and in a practical manner, the process of analyzing an existing application at Google Play Store.
05:15 pm (45 mins)	The Trouble with Passwords	Mark Goodwin	Many developers still seem unsure of how to deal with passwords and password data. This presentation covers some common mistakes made when storing credentials and introduces some good ways of tackling them.
06:15 pm (45 mins)	Hacking the ViewState in ASP.NET	Ovidiu Diaconescu	The view state is a necessary evil of ASP.NET Web Forms. Without having the proper protection mechanisms in place, it is trivial to exploit. This session will teach you how to take advantage of unsecured web applications and how to tighten-up your own
07:15 pm (45 mins)	Do you "GRANT ALL PRIVILEGES ..." in MySQL/MariaDB/Percona Server?	Gabriel Preda	We discuss (at least) elementary security procedures for MySQL and it's forks. Dive through short information about MySQL forks, replication options and their security implications. Finally some notes on what changes about security when you scale MySQL.

Conference Details
Time	Title	Speaker	Description
17:30 (45 mins)	Welcome & sandwiches
18:15 (15 mins)	OWASP Update	Sebastien Deleersnyder
18:30 (45 mins)	Needles in haystacks, we we are not solving the appsec problem & html hacking the browser, CSP is dead.	Eoin Keary, CTO and founder of BCC Risk Advisory Ltd.	TBD
19:30 (45 mins)	Teaching an Old Dog New Tricks: Securing Development with PMD	Justin Clarke, Director and Co-Founder of Gotham Digital Science	Using static analysis to identify software bugs is not a new paradigm. For years, developers have used static analysis tools to identifying code quality issues. While these tools may not be specifically designed for identifying security bugs. This presentation will discuss how custom security rules can be added to existing code quality tools to identify potential software security bugs. Writing custom software security rules for the popular Java code scanning tool PMD will be the focus of the presentation. Justin Clarke is a Director and Co-Founder of Gotham Digital Science. He is the lead author/technical editor of "SQL Injection Attacks and Defense" (Syngress), co-author of "Network Security Tools" (O'Reilly), contributor to "Network Security Assessment, 2nd Edition" (O'Reilly), as well as a speaker at numerous security conferences and events such as Black Hat, EuSecWest, ISACA, BruCON, OWASP AppSec, OSCON, RSA and SANS. Justin is the Chapter Leader for the OWASP London chapter in the United Kingdom.
20:30 (45 mins)	Vulnerability Prediction in Android Applications	Aram Hovsepyan, Ph. D.	We present an approach to predict which components of a software system contain security vulnerabilities. Prediction models are a key instrument to identify the weak spots that deserve special scrutiny. Our approach is based on text mining the source code of an application. We have explored the potential of the bag-of-words representation and discovered that a dependable prediction model can be built by means of machine learning techniques. In a validation with 10 Android applications we have obtained performance results that often outclass state-of-the-art approaches.

Monday 10th of June
Fecha	Lugar
Monday 10th June	Venue Location: Technical University of Denmark, DTU Compute, Institut for Matematik og Computer Science (former DTU Informatik) Venue Address: DTU Compute, Building 324 (between building 322 and 325), entrance from Elektrovej or Matematiktorvet, 2800 Kgs Lyngby, Denmark Venue Map: Google Maps
Price and registration
This event is FREE For planning purposes please register here or send an email to um@fortconsult.net no later than June 10 at 1200.

Conference Details
Time	Title	Speaker	Description
16:30 (45 mins)	Arriving and Networking
17:15 (15 mins)	Welcome and OWASP	Ulf Munkedal	What is OWASP? Why this event? How can you learn more and/or contribute? Thank you to our venue and food sponsor DTU Compute and the EU Tour 2013 sponsors.
17:30 (15 mins)	Information security at DTU Compute	Christian W. Probst, Associate Professor	A brief overview of what is going on at DTU Compute when it comes to information security related projects, e.g. the TREsPASS.
17:45 (45 mins)	OWASP Tools and resources	Fabio Cerullo	Fabio will give an overview of the many tools and resources that OWASP makes available and explain how you can use them. Including the OWASP ESAPI - Enterprise Security API and how you can use it to write lower-risk applications.
18:30 (30 mins)	Dinner break and networking	Sandwiches and soft drinks	Thanks to DTU Compute
19:00 (60 mins)	Android Security and App Testing	Alexandru Gherman	Practical examples of the risks from OWASP Mobile Top 10 with proof-of-concepts and practical reverse engineering and testing of a downloaded app.
20:00 (15 mins)	Coffee break and networking	Coffee, the and possibly a cake :)	Thanks to DTU Compute
20:15 (45 mins)	The Building Security in Maturity Model (BSIMM)	Ellen Moar	How do you know what security activities belong in your software lifecycle? How do you measure what you're doing? Begun in 2009, the BSIMM, is an observation-based scientific model directly describing the collective software security activities of more than sixty software security initiatives. Used as a measuring tool, BSIMM helps an organisation understand and plan their software security initiative. It covers the full framework of software development from requirements, architecture, code and test, to release management, governance, and training. This talk will introduce the measurements, explain what is measured, how it is measured, and how the measurement can be used to create or improve a software security initiative.
21:00 (15 min)	Rounding up	Ulf Munkedal	Conclusions and last questions before splitting up after a great evening :)

CONFERENCE AND TRAINING
OWASP Europe Tour - Barcelona 2013 Friday 14th June (Conference) Thursday 13th June (Training. Info about the training session)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE (Friday 14th June)
Date	Location
Friday 14th June	Universitat Ramon Llull, La Salle - URL Sant Joan de La Salle, 42 E-08022 Barcelona, Spain Auditori - Edifici Sant Josep Google maps
Price and registration
This event is FREE Registration Link to the Europe Tour:

CONFERENCE
OWASP Europe Tour - Finland 2013 Monday 17th June (Conference)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE (Monday 17th June)
When	Where
Monday 17th June	Venue Location: HTC Keilaniemi Venue Address: Keilaranta 15 02150 Espoo Venue Map: map
Price and registration
This event is FREE Registration Link to the Europe Tour - Finland: Regonline

CONFERENCE
OWASP Europe Tour - Lisbon 2013 Friday 21st June (Conference)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE (Friday 21st June)
Date	Location
Friday 21st June	Venue Location: ISCTE-IUL University Institute of Lisbon, Aud. B2.03 Venue Address: Avª das Forças Armadas, 1649-026 Lisboa Venue Map: Google Maps
Pictures	Set 1 Set 2
Price and registration
This event is FREE Registration Link to the Europe Tour (Lisboa): Registration

CONFERENCE
OWASP Europe Tour - France 2013 Monday June 24th (Conference)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE (Monday, June 24th)
Date	Location
Monday, June 24th	Venue Location: EURECOM, Sophia-Antipolis Venue Address: EURECOM Campus SophiaTech, 450 route des Chappes 06410 Biot (France) Venue Map: Google Maps
Price and registration
This event is FREE Registration Link to the Europe Tour:

CONFERENCE
OWASP Europe Tour - Geneva (Switzerland) 2013 Tuesday June 25th (Conference)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCES (Tuesday, June 25th)
Date	Location
Tuesday, June 25th / Mardi 25 juin	Venue Location: DGSI, Geneva Venue Address: Direction Générale des Systèmes d'Information Rue du Grand-Pré, 64 1211 Geneva (Switzerland) Venue Map: Google Maps
Price and registration
This event is FREE / La participation est GRATUITE Registration / Inscription: owaspeutourgeneva.eventbrite.com

Conference Details / Programme
Time/Heure	Title/Titre	Speaker/Intervenant-e	Description
6:15 pm	Warmup - welcome drinks and food / Cocktail de bienvenue
6:55 pm	Welcome talk / Discours d'accueil
7:00 pm	Conference 1	Sebastien Deleersnyder	OpenSAMM - Software Assurance Maturity Model
----	Conference 2	Philippe Oechslin	Limites des tables Rainbow et comment les dépasser en utilisant des méthodes probabilistes optimisées
----	Discussion/Feedback	Antonio Fontes	OWASP Top 10 2013: nouveautés par rapport à la version 2010
21:00 pm	Closure, thank you, bybye! / Fin, merci, au revoir!

CONFERENCE AND TRAINING
OWASP Europe Tour - Dublin 2013 Tuesday 25th June (Training. Info about the training session) Wednesday 26th June (Conference)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

Training (Wednesday 25th June)
When	Where
Tuesday 25th June	Venue Location: TCube Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland Venue Map: Google Maps
DEFENSIVE PROGRAMMING – JAVASCRIPT AND HTML5 HTML5 is the fifth revision of the HTML standard. HTML5, and its integration with JavaScript, introduces new security risks that we need to carefully consider when writing web front-end code. Modern web-based software, including mobile web front-end applications, makes heavy use of innovative JavaScript and HTML5 browser support to deliver advanced user experiences. Front-end developers focus their efforts on creating this experience and are generally not aware of the security implications of the technologies they use. The Defensive Programming – JavaScript/HTML5 course helps web front-end developers understand the risks involved with manipulating the HTML Document Object Model (DOM) and using the advanced features of JavaScript and HTML 5 such as cross-domain requests and local storage. The course reinforces some important security aspects of modern browser architecture and presents the student with defensive programming techniques that can be immediately applied to prevent common vulnerabilities from being introduced. Additionally, the course provides a detailed description of typical JavaScript sources and sinks and explains how they can be used to detect problems in code. For more information about the training please see Further training information
Price and registration
Price: 350€ Non members / 300€ OWASP members. Duration: 8 hours (09:00h - 18:00h) Registration Link to the Europe Tour training: Register Here

CONFERENCE (Wednesday 26th June)
When	Where
Wednesday 26th June	Venue Location: TCube Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland Venue Map: Google Maps
Price and registration
This event is FREE Registration Link to the Europe Tour: Register Here

Conference Details - Times are subject to change
Time	Title	Speaker	Description
09:30 (30 mins)	Registration
10:00 (15 mins)	Introduction
10:15 (15 mins)	Interactive Workshop - Ultimate Fighting Championship: Bugs vs Flaws	Paco Hope	Abstract We see a lot of defects in software and they fall broadly into two categories: bugs or flaws. How well we understand the defects and our correct categorisation influences how successful we will be fixing them. If we mistake a flaw for a bug and offer a point solution, we'll be back in the same situation as before, only with more broken code. If we mistake a bug for a flaw, we condemn ourselves to reengineering hunks of our system when a localised patch would do. Spend time with Paco Hope analysing defects from real systems. Create rules that distinguish bugs from flaws and cast your vote. Argue about what to do with them. Climb into the ring with that defect and pin it to the mat! Learning Objectives Identify a small set of rules that will help distinguish flaws from bugs Classify defects clearly into one class or the other Articulate why something belongs in one class or another Articulate the difference between flaws and bugs Pre-Requisites All security and software developers should be prepared for this. Prior experience in mixed martial arts is not necessary. :)
11:15 (15 mins)	Coffee Break
11:30 (60 mins)	Using the browser as a platform for security tools	Mark Goodwin
12:30 (60 mins)	Lunch
13:30 (60 mins)	Lesson learned from the trenches of targeted attack	Robert McArdle	Targeted attacks are now a major worry for organisations. In this talk we will describe real life case studies of some of the largest and more sophisticated targeted attacks, including how we infiltrated and mapped criminal networks, and live demos of some such mapping in action. In this talk we will discuss some of the major ongoing and previous targeted attack campaigns that have been uncovered by Trend Micro in the last year or so, such as Luckycat, Tinba and others. We will discuss in-depth the modus operandi of the criminals in these so called APT attacks, show how we mapped and infiltrated their infrastructure, and demo some of the tools and techniques that we use when carrying out these type of investigations. All of this presentation will focus on real technical details from real cases studies, and this presentation will also include live demos. KEY QUESTIONS 1) What is the reality (not the hype) of a modern targeted attack 2) You will understand the Modus Operandi of a two main types of Cybercriminals 3) You will understand how investigators and security companies investigate these high profile attacks
14:30 (15 mins)	Coffee Break
14:45 (60 mins)	The Building Security In Maturity Model (BSIMM)	Paco Hope	How do you know what security activities belong in your software lifecycle? How do you measure what you're doing? Begun in 2009, the BSIMM, is an observation-based scientific model directly describing the collective software security activities of more than sixty software security initiatives. Used as a measuring tool, BSIMM helps an organisation understand and plan their software security initiative. It covers the full framework of software development from requirements, architecture, code and test, to release management, governance, and training. This talk will introduce the measurements, explain what is measured, how it is measured, and how the measurement can be used to create or improve a software security initiative. Paco Hope is a Principal Consultant at Cigital, helping Fortune 500 companies secure their software for over 10 years in a variety of industries like online gaming, financial services, retail, and embedded systems. He is the author of two books on security, the most recent being the Web Security Testing Cookbook and a frequent conference speaker. As and a member of (ISC)²'s Application Security Advisory Board, he helps create and advise on the direction of the CSSLP certification. His passion is empowering everyone in the software lifecycle—developers, testers, analysts—to make meaningful contributions to the securing of software.
15:45 (60 mins)	Needles in haystacks, why we are not solving the appsec problem & html hacking the	Eoin Keary	We continue to rely on a “pentest” to secure our applications. Why do we think it is acceptable to perform a time-limited test of an application to help ensure security when a determined attacker may spend 10-100 times longer attempting to find a suitable vulnerability? Our testing methodologies are non-consistent and rely on the individual and the tools they use. Currently we treat vulnerabilities like XSS and SQLI as different issues but the root causes it the same. – it’s all code injection theory!! Why do we do this and make security bugs over complex? Why are we still happy with “Testing security out” rather than the more superior “building security in”? We shall also look at mark up attacks which break CSP controls.
16:45 (15 mins)	Close

CONFERENCE AND TRAINING
OWASP Europe Tour - Rome 2013 Thursday 27th June (Conference) Friday 28th June (Training)
DESCRIPTION
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle. This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
OWASP MEMBERSHIP
During the OWASP Europe Tour you could become a member and support our mission. Become an OWASP member by clicking here

CONFERENCE (Thursday 27th June)
When	Where
Thursday 27th June the Conference, Friday 28th June for the Training	Venue Location: Università Degli Studi Roma Tre Venue Address: Via vito Volterra, 62, 00182 Roma, Italy Venue Map: Google Maps
Price and registration
This event is FREE Registration Link to the Europe Tour:\| Conference Europe Tour Training \| Page Registration Link to the Europe Tour:\| Training

OWASP EU TOUR 2013
== TRAINING SESSIONS ==
SPAIN - Barcelona
Date	Location
Jueves, 13 de junio de 2013 09:00h - 18:00h	Universitat Ramon Llull, La Salle - URL Sant Joan de La Salle, 42 E-08022 Barcelona, Spain Aula: MFS.03 Google maps
Fabio Cerullo	Taller: Desarrollo Seguro usando OWASP ESAPI Este curso tiene como objetivo proporcionar los conocimientos y recursos necesarios para mejorar la seguridad de las aplicaciones Java utilizando las librerias OWASP Enterprise Security API (ESAPI). Estas librerias se han diseñado para que sea más fácil para los desarrolladores mejorar la seguridad en aplicaciones existentes, como asi tambien utilizarlas como base para el desarrollo de nuevas aplicaciones. Los principios generales aprendidos en el curso se puede aplicar en el contexto de otros lenguajes de programación. Perﬁl del instructor Fabio Cerullo, CEO y fundador de Cycubix, ayuda a clientes de todo el mundo a mejorar la seguridad de aplicaciones desarrolladas internamente o por terceros, mediante la definición de políticas y normas, implementando iniciativas de desarrollo seguro y gestión de riesgos, así como brindando capacitación sobre el tema a desarrolladores, auditores, ejecutivos y profesionales. Como miembro de la Fundación OWASP, Fabio se encarga de coordinar actividades globales de concientizacion sobre seguridad de aplicaciones con empresas privadas, gobiernos e instituciones educativas. Duracion: 8 horas (09:00h - 18:00h) Precio: 250€ No miembros / 200€ Miembros OWASP. Existen tambien descuentos para grupos y miembros de ATI. Regístrese a este taller: HAGA CLIC AQUI!
Date	Location
Jueves, 13 de junio de 2013 14:00h - 18:00h	Universitat Ramon Llull, La Salle - URL Sant Joan de La Salle, 42 E-08022 Barcelona, Spain Aula: MFS.04 Google maps
Simón Roses	Taller: OSINT + Python = Custom Hacking Workshop Taller práctico que combina el arte de OSINT (Open Source Inteligence) mediante el desarrollo de scripts en Python utilizando diversas API y librerías disponibles. A lo largo del taller se realizarán ejercicios prácticos con el objetivo de asimilar los conceptos por parte del alumno. Para entrar en materia se recomienda la lectura del siguiente artículo: http://www.simonroses.com/es/2013/05/osint-python-hacking-a-medida/. Perﬁl del instructor Simón Roses eslicenciado en Informática por Suffolk University (Boston), Postgrado en E-Commerce, Harvard University (Boston) y Executive MBA, Instituto de Empresa (Madrid). En la actualidad es el CEO de VULNEX. Anteriormente formó parte de Microsoft, PriceWaterhouseCoopers y @Stake. Creador y colaborador en varios proyectos de código abierto de seguridad como OWASP Pantera y LibExploit, además de publicar avisos en seguridad de conocidos productos. Ponente habitual en eventos del sector de seguridad incluyendo BlackHat, RSA, OWASP, DeepSec, Source y Technets de seguridad de Microsoft. CISSP, CEH y CSSLP. Duracion: 4 horas (14:00h - 18:00h) Precio: 125€ No miembros / 100€ Miembros OWASP. Existen tambien descuentos para grupos y miembros de ATI. Regístrese a este taller: HAGA CLIC AQUI!.
Date	Location
Jueves, 13 de junio de 2013 09:00h - 13:00h	Universitat Ramon Llull, La Salle - URL Sant Joan de La Salle, 42 E-08022 Barcelona, Spain Aula: MFS.04 Google maps
Matias Katz	Taller: OWASP Top 5 Esta formación incorporará las técnicas de ataque a plataformas Web más importantes en la actualidad, estandarizadas mediante la norma OWASP Top 5. El curso presentará al alumno la forma de realizar estos ataques, y las contramedidas necesarias para mitigar su riesgo en sus desarrollos. La clase contará con contenido teórico y demostraciones prácticas e interactivas de laboratorio. Esta formación está orientada a desarrolladores, administradores de bases de datos, analistas de sistemas, auditores de seguridad, jefes de proyecto, así como cualquier otro interesado en las principales técnicas de ataque y defensa en aplicaciones Web. Perﬁl del instructor Matias Katz is an IT architect and a security specialist. He's CISSP, CEH and MCSE certified, and has 10 years of experience in the field, focusing in the implementation of security audits, in infrastructures and critic applications for big organizations, both private and public. After working at IBM for several years, in 2008 Matias founded Mkit Argentina (link: http://www.mkit.com.ar), a company that specializes in performing security audits, vulnerability analysis and penetration tests to organizations, companies and the public sector. The company also gives training of a high technical level for companies, organizations and end-users. Matias also works as an external consultant for the computer crimes division of the federal police department in Argentina, where he collaborates in open cases through the acquirement of digital evidence and performing active investigations for the potential suspects. He is a professor in 3 universities in Argentina, both in engineering courses and information security post-graduate degree courses. He has presented at some of the most important security conferences, like BlackHat, Ekoparty, H2HC, Campus Party. He has dozens of published papers, and has created many tools used daily by security professionals world-wide, for their security audits. Duracion: 4 horas (09:00h - 13:00h) Precio: 125€ No miembros / 100€ Miembros OWASP. Existen tambien descuentos para grupos y miembros de ATI. Regístrese a este taller: HAGA CLIC AQUI!.
Ireland - Dublin
Date	Location
Tuesday, June 25th, 2013 09:00h - 18:00h	TCube 32 - 34 Castle Street, Dublin 2, Ireland Google Maps
Paco Hope	DEFENSIVE PROGRAMMING – JAVASCRIPT AND HTML5 HTML5 is the fifth revision of the HTML standard. HTML5, and its integration with JavaScript, introduces new security risks that we need to carefully consider when writing web front-end code. Modern web-based software, including mobile web front-end applications, makes heavy use of innovative JavaScript and HTML5 browser support to deliver advanced user experiences. Front-end developers focus their efforts on creating this experience and are generally not aware of the security implications of the technologies they use. The Defensive Programming – JavaScript/HTML5 course helps web front-end developers understand the risks involved with manipulating the HTML Document Object Model (DOM) and using the advanced features of JavaScript and HTML 5 such as cross-domain requests and local storage. The course reinforces some important security aspects of modern browser architecture and presents the student with defensive programming techniques that can be immediately applied to prevent common vulnerabilities from being introduced. Additionally, the course provides a detailed description of typical JavaScript sources and sinks and explains how they can be used to detect problems in code. Prerequisites: Students should be familiar with Web programming environments and technologies including JavaScript and HTML. Completion of the Foundations of Software Security, Attack and Defense, or OWASP Top Ten + 2 courses is highly recommended. Instructor Profile Mr. Hope is a Principal Consultant for Cigital with over 12 years experience in the securing of software and systems. He sets the technical direction in Europe and leads consultants delivering static source code analysis, architectural risk assessments, vulnerability assessments, and penetration tests. His experience covers web applications, online gaming (gambling), embedded gaming devices, lotteries, and business-to-business transaction systems. He has assessed systems for small startups with thousands of lines of code, and massive enterprises with thousands of applications and millions of lines of code. He is a frequent conference speaker at such venues as OWASP, RSA (US and Europe), Security B-Sides, and SecAppDev. He speaks on issues like integrating security into the software development lifecycle (SDLC), securing web applications, and secure random number generation. Paco is also involved in the leadership of the London Chapter of (ISC)2. He also serves on (ISC)2's Application Security Advisory Board, helping to advise on the direction of the Certified Secure Software Lifecycle Professional (CSSLP) certification. He has held the CISSP for nearly 10 years and the CSSLP since shortly after its creation. Mr. Hope has co-authored two books on software security: the Web Security Testing Cookbook and Mastering FreeBSD and OpenBSD Security. He has also authored a chapter of Gary McGraw's Building Security In. Duration: 8 hours (09:00h - 18:00h) Price: 350€ Non members / 300€ OWASP members. Registration link: Register here.
ITALY - Rome
Date	Location
Friday 28th June 09:00h - 13:00h	Università Degli Studi Roma Tre
Giorgio Fedon	Title: Mobile Application Security and Security Development Introduction Students will learn mobile hacking techniques and remediation strategies for Android and iPhone operating systems. They will understand platform security models, mobile application secure design, mobile application security errors, mobile application vulnerabilities related to in-house development. Exploiting techniques for operating system components are explained in the extent they may impact on a company SSDLC process for their mobile applications. Instructor Profile Giorgio Fedon is the COO and a cofounder of Minded Security, where he is responsible for running daily operations of the company and managing Professional Services. Prior to founding Minded Security, Giorgio was employed as senior security consultant and penetration tester at Emaze Networks S.p.a., delivered code auditing, Forensic and Log analysis, Malware Analysis and complex Penetration Testing services to some of the most important Companies as Banks and Public Agencies in Italy. He participated as speaker in many national and international events talking mainly about web security and malware obfuscation techniques. He was also employed at IBM System & Technology Group in Dublin (Ireland). Language: English and Italian Duration: 4 horas (09:00h - 13:00h) Price: The prices are: 125 Euro for non members / 100 Euro for members. Registration Link: Register Here.