View source for BeNeLux OWASP Day 2012

<center>[[Image:owaspbnl12header.jpg]]<br></center>
<br><!-- Header -->


<!-- First tab -->
= Welcome  =

=== Welcome to OWASP BeNeLux 2012  ===

==== Confirmed trainers for Trainingday ====

* Dan Cornell (Denim group) - SDLC with open source tools <br>
* Dinis Cruz (Security Innovation) -  Advanced O2<br>
* Volkert de Buisonjé (Sogeti) - Secure Java Development with ESAPI (Hands-On )<br>
* Martin Knobloch (PervaSec) - Essential Web Appplication Security (OWASP Top 10, Webgoat, WebScarab)<br>

==== Confirmed speakers Conferenceday ====

* Dinis Cruz (Security Innovation) - Making Security Invisible by Becoming the Developer’s Best Friends<br>
* Rüdiger Bachmann (SAP) - Code review large companies<br>
* Lieven Desmet (Distrinet, KU Leuven) - Sandboxing JavaScript<br>
* Asia Slowinska (VU Amsterdam) - Body Armor for Binaries<br>
* Marc Hullegie and Kees Mastwijk (Vest) - Forensics<br>
* Dan Cornell (Denim group) - Streamlining Application Vulnerability Management: Communication Between Development and Security Teams<br>
* John Wilander (OWASP Sweden) - Browser security<br>
* Seba Deleersnyder (OWASP) - Update on OWASP<br>

==== The OWASP BeNeLux Program Committee ====
*Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
*Martin Knobloch / Ferdinand Vroom, OWASP Netherlands
*Jocelyn Aubert / Andre Adelsbach, OWASP Luxembourg
*Steven van der Baan, OWASP CTF Project

=== Tweet! ===
Event tag is [http://twitter.com/#search?q=%23owaspbnl12 #owaspbnl12]

==== Donate to OWASP BeNeLux ====

<paypal>BeNeLux OWASP Day 2012</paypal>

<!-- Second tab -->
= Registration =

==== OWASP BeNeLux training day and conference are free! ==== 

=== Registration is open: ===
 
[http://owaspbenelux2012.eventbrite.com/ http://www.owasp.org/images/7/77/Buttoncreate.png]

<br>
To support the OWASP organisation, consider to become a member, it's only US$50!
<br> 
Check out the [[Membership]] page to find out more. 
<br>


<!-- Third tab -->
= Venue =

=== Venue is the iMinds-DistriNet Research Group @ KU Leuven ===

''Celestijnenlaan, 200A<br>
3001 Heverlee<br>
Belgium<br>''
<br>

<br>'''Parking & roadmap''':

There is a public parking close to the conference venue.

Roadmap and parking: http://distrinet.cs.kuleuven.be/about/route/


<br>'''Hotels nearby''': <br> 
Board house (close to the venue)<br> http://www.boardhouse.be<br>
The lodge (close to the venue)<br> http://www.booking.com/hotel/be/the-lodge-heverlee.en.html<br>
Begijnhof Congres Hotel (1 km from the venue)<br> http://www.bchotel.be/<br>
La Royale (2 km from the venue)<br> http://www.laroyale.be<br> 
Hotel Ibis (2 km from the venue)<br> http://www.accorhotels.com/gb/hotel-1457-ibis-leuven-centrum/index.shtml<br> 
Mercure (2 km from the venue) <br> http://www.mercure.com/gb/hotel-7862-hotel-mercure-leuven-center/index.shtml<br> 
New Damshire (2 km from the venue)<br> http://www.hotelnewdamshire.be<br> 


<!-- Fourth tab -->

= Trainingday =

==== Trainingday, November 29th  ====

==== Location ====
The training room is: (TBD)  (for details, check the {{#switchtablink:Venue|Venue}} tab)

==== Agenda ==== 
{| class="wikitable"
! Time !! Description !! Room 1 !! Room 2 !! Room 3 !! Room 4
|-
| 08h30 - 9h30
| colspan="5" style="text-align: center;" | ''Registration''
|-
| 09h30 - 11h00 || Training
| rowspan="7" style="width:100px;" | Advanced O2, by Dinis Cruz
| rowspan="7" style="width:100px;" | SDLC with Open Source tools, by Dan Cornell
| rowspan="7" style="width:100px;" | Secure Java Development with ESAPI (hands-on), by Volkert de Buisonjé
| rowspan="7" style="width:100px;" | Essential Web Appplication Security (OWASP Top 10, Webgoat, WebScarab), by Martin Knobloch
|-
| 11h00 - 11h15 ||  ''Coffee Break''
|-
| 11h15 - 12h45 || Training
|-
| 12h45 - 13h30 || ''Lunch''
|-
| 13h30 - 15h00 || Training
|-
| 15h00 - 15h15 || ''Coffee Break''
|-
| 15h15 - 17h00 || Training
|}





<br>

=== Secure Java Development workshop with ESAPI, by Volkert de Buisonjé (Sogeti) ===
''Workshop:''<br>
First, attendees will receive a brief introduction on application awareness. Then they will get acquainted with Webgoat, a "deliberately insecure J2EE web application" designed as a practice tool for secure application development and testing. They will learn how to exploit some vulnerabilities in Webgoat, through for instance Cross-Site Scripting (CSS) and Cross-Site Request Forgery (CSRF) attacks. Finally, the ESAPI library will be introduced and the attendees will learn how to apply ESAPI to fix such vulnerabilities in Webgoat's source code.<br>
<br>
''Prerequisites for this workshop:''<br>
* Reasonable knowledge of and experience with Java development
* A laptop running a recent version of Linux, Mac OS X, or Windows
* The most recent version of VirtualBox (4.x) installed
* At least 2GB of RAM
* At least 2GB of disk space
<br>
''Bio:''<br>
Volkert de Buisonjé is a senior Java developer at Sogeti. He specializes in, and teaches application security courses, both to coworkers and to customers. Knowledge sharing (in both directions) is his passion. Volkert likes making friends and talking a lot. He never shuns a good discussion, and prefers to bring a high amount of interactivity to his classes. :-)<br>
<br>
<br>



<!-- Fifth tab -->

= Conferenceday =

==== Conferenceday, November 30th  ====

==== Location ====
The training room is: (TBD)  (for details, check the {{#switchtablink:Venue|Venue}} tab)

==== Agenda ==== 
''(TBD)''
<br>

{| class="wikitable"
! Time !! Topic !! Speaker
|-
| 08h30 - 9h30 || ''Registration'' || 
|-
| 09h30 - 9h45 || Welcome ([https://www.owasp.org/images/a/ad/OWASP_BeNeLux_Day_2012_-_Organization_welcome.ppt PPT]) || OWASP Benelux Organization
|-
| 09h45 - 10h00 || OWASP update ([https://www.owasp.org/images/d/d7/OWASP-Update-BeNeLux-Day-2012_v1.pptx PPT]) || Sebastien Deleersnyder
|-
| 10h00 - 10h40 ||  ||   
|-
| 10h40 - 11h00 || ''Break''  ||
|-
| 11h00 - 11h40 ||  || 
|-
| 11h40 - 12h20 ||  || 
|-
| 12h20 - 13h00 ||  || 
|-
| 13h00 - 14h00 || ''Lunch'' || 
|-
| 14h00 - 14h40 ||  || 
|-
| 14h40 - 15h20 ||  || 
|-
| 15h20 - 16h00 ||  || 
|-
| 16h00 - 16h20 || ''Break'' || 
|-
| 16h20 - 17h00 ||  || 
|-
| 17h00 - 17h40 ||  || 
|-
| 17h40 - 18h00 || Closing Notes || OWASP Benelux 2012 organization

|}

<!-- Sixth tab -->
= Speakers =

=== Sandboxing JavaScript, by Lieven Desmet (Research Manager at KU Leuven) ===
''Abstract:''<br>
The inclusion of third-party scripts in web pages is a common practice. A recent study has shown that more than half of the Alexa top 10 000 sites include scripts from more than 5 different origins. However, such script inclusions carry risks, as the included scripts operate with the privileges of the including website.<br>
In this talk, we propose JSand, a server-driven but client-side JavaScript sandboxing framework. JSand requires no browser modifications: the sandboxing framework is implemented in JavaScript and is delivered to the browser by the websites that use it. Enforcement is done entirely at the client side: JSand enforces a server-specified policy on included scripts without requiring server-side filtering or rewriting of scripts. Most importantly, JSand is complete: access to all resources is mediated by the sandbox.<br>
We describe the design and implementation of JSand, and we show that it is secure, backwards compatible, and that it performs sufficiently well.<br>
<br>
''Bio:''<br>
Lieven Desmet is Research Manager on Software Secure at the iMinds-DistriNet Research Group (KU Leuven, Belgium), where he coaches junior researchers in web application security and participates in dissemination and valorization activities. His interests are in security of middleware and web-enabled technologies. Lieven is actively engaged in OWASP and is board member of the OWASP Chapter Belgium.<br>
<br>
<br>
=== OWASP Top 10 vs Drupal, by Erwin Geirnaert (Zion Security) ===
''Abstract:''<br>
Drupal is the most used and well-known open source content management system in the world. Created by Dries Buytaert years ago it has grown with the support of a big community. Drupal 7 is already released and there is an entire ecosystem for Drupal and Drupal web agencies.<br>
During this presentation we will discuss the findings of an automated static code analysis of Drupal 6 and Drupal 7 and how Drupal protects against the OWASP Top 10 Application Security Risks. We will explain the security weaknesses that remain when you use Drupal and what you can implement to have a secure cloud server running Drupal.<br>
<br>
''Bio:''<br>
Erwin founded ZION SECURITY in 2005 to help companies to protect against the latest threats, attacks against web applications. ZION SECURITY is nowadays a Belgian market leader in the field of security testing, vulnerability management, penetration testing and banking security. Erwin has more than 10 years of experience in web security, graduating with a Master of Science in Software Development from the University of Ghent. Erwin executes different types of projects for a lot of international software companies, financial institutions, telecom and web agencies. Specialist in executing code reviews in different development languages for critical applications, executing continuous penetration tests of their infrastructure and Internet applications. A specialist in J2EE, PHP, .NET, mobile app and web services security. Erwin architects secure e-business projects for web agencies and software companies. He is a recognized application security expert and speaker at international events like Javapolis, OWASP, Eurostar, LSEC,...<br>
<br>

=== Forensics, by Marc Hullegie and Kees Mastwijk (Vest Information Security) === 
''Abstract:''<br>
In today’s investigations, forensics has become an important investigative method in fighting and solving (cyber)crimes and irregularities. During the session you will be briefly taken through the landscape of Forensics Basics; the Fraud Triangle and scenario's; What to look for and the appliance of Digital Forensics. What are the Challenges, the required Skills and Expertise and Solutions to these challenges. Specific focus on the Forensics of Web Applications and what you can do the create a more forensic ready system.<br>
<br>
''Bio:''<br>
Marc Hullegie is founder and CEO of Vest Information Security and is widely experienced in the information security business in all types of areas: Security Architecture and Infrastructure, Security Audits and Testing, Security Management, Awareness and Digital Forensics. He presents lectures at (international) conferences and is looking forward to share experiences at the OWASP Benelux days 2012 with you.<br>
<br> 
''Bio:''<br>
Kees Mastwijk is a security consultant working with Vest, acting as Security Auditor, Awareness Program leader and security Manager. He has a long (and ongoing) experience history in Digital Forensic Research.<br>
<br>
=== Browser Security, by John Wilander (Svenska Handelbanken) ===
''Abstract:''<br>
''Coming soon!''<br>
<br>
''Bio:''<br>
John Wilander is a frontend software developer at Svenska Handelbanken, the second strongest bank in the world according to Bloomberg Markets. He has been researching and working in application security for ten years and is an active leader in OWASP, the Open Web Application Security Project. In 2011 he organized the OWASP Summit Browser Security sessions in Portugal, with participants from the security teams behind Chrome, Firefox, Internet Explorer, Flash, and PayPal. During his years in academia he was elected best computer science teacher twice and nowadays gives 5-10 professional talks per year.<br>
<br>
<br>

=== Streamlining Application Vulnerability Management: Communication Between Development and Security Teams, by Dan Cornell (Denim Group) ===
''Abstract:''<br>
Identifying application-level vulnerabilities via scanning, penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams. The process also means that security managers need to get time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities. This presentation will illustrate the communication difficulties between security and development teams, and how this usually results in unactionable reports and fewer vulnerabilities remediated. In addition, the presentation will walk through an example workflow of addressing application vulnerabilities as software defects. This will be based on freely-available tools and show specific examples of how vulnerabilities can be grouped together, false positives can be culled out, and vulnerabilities transitioned to software defects, as well as how security managers can monitor and verify progress.<br>
<br>
''Bio:''<br>
''Dan Cornell has over fifteen years of experience architecting and developing web-based software systems. He leads Denim Group’s security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies.<br>
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and currently serves as the OWASP San Antonio chapter leader, member of the OWASP Global Membership Committee and co-lead of the OWASP Open Review Project. Dan has spoken at such international conferences as RSA, OWASP AppSec USA, and OWASP EU Research in Greece.''<br>
<br>
<br>


<!-- Seventh tab -->

= Social Event =

==== Social Event, November 29th ====

The social event is scheduled for Thursday, 29th of November and will start at around 19:30 

==== Location ====
Leuven (TBD)
<br>

Remark: Costs are around eur. 10,00.
 
<!-- Eighth tab -->
= CTF  =

==== Capture the Flag! ====

* Do you like puzzles? 
* Do you like challenges? 
* Are you a hacker?

Whether you are an experienced hacker or new enthusiast you should come to OWASP BeNeLux 2012 and participate in the Capture the Flag event November 30th 2012.  

The OWASP CTF is especially designed to support challengers of all skill levels. The CTF contains multiple challenges in various fields related to application security. As every challenge gains you one point, you can pick and choose which challenge you want to play.

All you need is a laptop with a wifi card and your favorite (preferably) non-commercial tools. 

So come, show off your skills, learn new tricks and above all have a good time at the CTF event. 


<!-- Ninth tab -->

= Sponsor =

==== Become a sponsor of OWASP BeNeLux ====

==== Donate to OWASP BeNeLux ====

<paypal>BeNeLux OWASP Day 2012</paypal> 


==== Promotion  ====
''Feel free to use the text below to promote our event!''

We invite you to our next OWASP event: the '''BeNeLux OWASP Days 2012!'''

Free your agenda on the 29th and 30th of November, 2012.

The good news: free! No fee!

The bad news: there are only 280 seats available (first register, first serve)!


<!-- Don't remove these two lines! -->
__NOTOC__ 
<headertabs/>


==== Hosted and co-organized by: ====
 
[http://distrinet.cs.kuleuven.be https://www.owasp.org/images/4/4a/Logo_distrinet.png]
[http://www.nessos-project.eu/ https://www.owasp.org/images/5/52/Nessos.png]

==== Made possible by our {{#switchtablink:Sponsor|Sponsors}}====

==== OWASP Member Sponsor: ====
{{MemberLinks|link=http://www.pwc.com/|logo=PWC_log_resized.png}} 

==== OWASP BeNeLux 2012 Sponsors: ====
[http://www.madisongurkha.nl https://www.owasp.org/images/6/6e/Madison-gurkha-logo.jpg]
[http://www.sogeti.nl https://www.owasp.org/images/9/94/Sogeti_logo.png]
[http://www.vest.nl https://www.owasp.org/images/1/1d/Logo_Vest_BIG_170.gif]
<br>
[http://www.approach.be https://www.owasp.org/images/7/76/Approach-sponsor.jpg]
[http://www.zionsecurity.com https://www.owasp.org/images/e/e6/Zionsecurity.jpg]
[http://on2it.net https://www.owasp.org/images/3/3d/On2it-sponsor.png]
<br>
<br>
[http://www.iminds.be https://www.owasp.org/images/thumb/a/a1/Iminds-logo.png/200px-Iminds-logo.png]

[[Category:OWASP_AppSec_Conference]] [[Category:OWASP_BeNeLux_Archives]]