OWASP Romania InfoSec Conference 2013 Agenda

Agenda
Time	Title	Speaker	Description
10:30 - 11:00 (30 mins)	Registration
11:00 - 11:15 (15 mins)	Introduction & Welcome	Oana Cornea	Introduction to OWASP & Bucharest Event, Schedule for the Day
11:15 - 12:00 (45 mins)	Secure Development LifeCycle (aka "The good the bad and the ugly implementations") [1]	Martin Knobloch	Software development is not THAT new anymore, but it is still a fast changing work environment. We do develop more functionality faster, and the applications do even look more pretty! But what about security? Guess what, it is not a developers first priority! This presentation is about how to implement secure development strategy without blaming and bashing on developers. Instead of increasing the workload of the development-team with more process overhead, (security) quality gates, etc. Lets help developer by implementing impalpable mechanism!
12:05 - 12:50 (45 mins)	Practical Defense with mod_security Web Application Firewall [2]	Marian Ventuneac	Marian will introduce the mod_security Web Application Firewall (WAF). This session will be a practical demonstration of mitigating security risks for a sample vulnerable Web application.
12:55 - 13:40 (45 mins)	Scanning Romania with Nessus (web part) [3]	Adrian Furtuna	This talk presents the results of a passive vulnerability scan performed against all Romanian IP addresses, targeting all web servers listening on port 80. The research was performed against multiple network packet captures selected from the output of Carna botnet, which scanned Romania in July 2012.
13:40 - 14:30 (50 mins)	Lunch/Coffee Break
14:30 - 15:15 (45 mins)	Reading the minds [4]	Anatolie Prisacaru	In my presentation I will focus the analysis of what data web browsers, extensions and web servers keep in memory. I will start with a quick introduction on how to dump and analyse processes' random access memory maps on a Linux based operating system with basic tools and then run a quick code review to see a couple of weak points, find their Achilles' heel and finally prove why statements like "Your sensitive data is encrypted _locally_ before upload so even LastPass cannot get access to it" can be pretty misleading.
15:20 - 16:05 (45 mins)	Online Fraud and the part it plays in Cybercrime [5]	Alexandru Doroftei	The presentation will be about what is online fraud, what risks do companies face when they support e-commerce and the growing role fraud has in the cybercrime area. I will describe a few of the best practices against fraud, diving a little bit in the fraud industry numbers associated with fraud.
16:10 - 16:55 (45 mins)	Hacking the Wordpress ecosystem [6]	Dan Catalin Vasile	This talk came from the personal need of securing multiple instances of Wordpress. An OWASP Project was initiated to gather the knowledge around this subject in one place. The presentation will address the following subjects: - securing the installation process - server side measures: backup, securing login, antivirus, regular scan, web firewall, monitoring, permissions, etc. - client side measures: personal devices security, password management, communication channels, etc. - hacking the infrastructure - hacking plugins
17:00 - 17:45 (45 mins)	Resolving 3 Common threats in MVC (A4 - Insecure Direct Object References , A3 - Cross-Site Scripting (XSS) , A8 - Cross-Site Request Forgery (CSRF) ) [7]	Andrei Ignat	Any website is confronted with hackers. The security measures are easy to follow - and this presentation shares to you this knowledge.