July 2014:Andy Earle: "Static Analysis: Beyond the Basics"

Andy Earle presented "Static Analysis: Beyond the Basics".

Static vulnerability analysis is the practice of testing non-running software for application vulnerabilities. It is often referred to as SAST, white box testing, or automated code review. In this session we will cover some of the hows and whys of static analysis and deep dive some of the common issues users of SAST technologies often encounter. Topics will include data flow analysis and taint propagation, scan noise, and partial code scanning, specifically around OWASP Top 10 issues. The material should provide value to anyone with an interest in application security, not just static analysis practitioners

Andrew Earle is a Security Solutions Architect for HP Enterprise Security Products (ESP). Andy has spent 5 years designing and delivering application security programs, technology, and services for US Federal and commercial customers, specifically around HP's Fortify appsec products. Andy was previously the product manager for a high assurance multi-level secure operating system at BAE Systems, and Presales Engineer for various web development and mobile security firms. Andy has spoken extensively on application security topics, most recently at OWASP's SnowFROC 2013, the RMISC conference, SANS AppSec 2013, and HP Protect. Early experience includes software engineering, mobile application development, and lifeguarding at his neighborhood pool. Andy is a CISSP and CSSLP, and has a B.S. in Systems Engineering from the University of Virginia.