OWASP Bucharest AppSec Conference 2018 Workshops

Workshop
Time	Title	Trainers	Description
Workshop 25th of October 3,5 hours: begins at 09:00	Automating CI Sec - Pipelines using ZAP, Docker and static code analysis	Spyros Gasteratos and Nataliya Dubrovska	Description: In this workshop we will go through customizing ZAP's docker images and some static code analysis scripts to work with Concourse CI so that it automatically tests the deployed web application. Moreover we will write an example ZAP orchestration script to better test specific parts of the example application. Last, we will create Docker containers of two static code analysis scripts so that we can easily integrate them into the CI pipeline. We will go through: Configuring Concourse CI to work with ZAP. Configuring the testing harness to work with ZAP Writing orchestration scripts to better test specific part of the application. Package extra tooling so that we better test the committed codebase At the end of the workshop the attendees will have example configuration files, orchestration scripts, rules and Dockerfiles for all tools used. Intended audience: security engineers, developers, pentesters Skill level: beginner - intermediate Requirements: a laptop with Virtual Box installed Seats available: 20 (first-come, first served) Price: free Register here
Workshop 25th of October 3 hours: begins at 13:30	OAuth and OpenID Connect best practices	Johan Peeters	Description: OAuth and OpenID Connect (OIDC) quickly became dominant in the API economy. Was this because they were shiny new toys or are they really superior to older protocols for obtaining authorization and identity information such as SAML? While SAML was designed for the enterprise, OAuth and OIDC’s creation myth is from a different universe: it gives social media users the possibility to delegate limited access to partially trusted clients. Since, OAuth and OIDC have been employed well beyond the confines of social media. Consequently, a good deal of creativity to adapt a protocol designed for Discretionary Access Control (DAC) in a social media context to enterprise Mandatory Access Control (MAC) requirements has been observed - I cannot help feeling the wheel has been reinvented many times over. In this workshop, we discuss some of the design patterns that have come to the fore and reflect on the road ahead. What standard updates can we expect? Should we be compiling best practices? If so, what do they contain? Here are some candidate topics for an in-depth discussion: a format for OAuth access tokens principle of least privilege: what does this mean for security tokens? how are permissions represented? how are users granted permissions? how are permissions communicated to resource servers? security token Time To Live access token claims Intended audience: developers, security professionals Skill level: intermediate Requirements: for optimal benefit, participants should have a good knowledge of the OAuth and OIDC frameworks Seats available: 20 (first-come, first served) Price: free Register here