View source for User:Dinis.cruz

Hello, Welcome to my page where you can find more details about who I am and what I do at OWASP. You can contact me on dinis.cruz at owasp.net or dinis at ddplus.net

== Chief Owasp Evangelist ==

After much internal debate I decided to agree with Jeff's idea for my official OWASP title: Chief OWASP Evangelist.

I don't like the religious connotations of that title, but technology evangelism does have a somewhat different meaning, and looking at the other 'technical evangelists' out there (and in the past) I do feel that I am following the footsteps of giants :).

I would like to offer my services to you (OWASP member or OWASP user) as a point of contact for OWASP related activities. One of my main objectives is to maximize the potential of OWASP and its community, so anything that I can do to help, just let me know.

A couple objectives for me:

* Promote OWASP to OWASP (the reality is that most of us have no idea of what projects there are at OWASP and what they have already created / delivered (see for example the list of current projects https://www.owasp.org/index.php/Category:OWASP_Project))
* Promote collaboration and integration between OWASP projects (there are tons of potential synergies between OWASP projects out there)
* Promote OWASP to the world, and let them know the great stuff that we are doing
* Work with the OWASP chapters, so that what happens locally is exposed to the rest of us (I also would like to see collaboration between chapters, and the re-use of its  materials)
* Review the current OWASP tools and content and work with its creators to make it even better
* Follow the final stages of the "OWASP Autumn of Code"  sponsorships https://www.owasp.org/index.php/OWASP_Autumn_of_Code_2006_-_Selection and start working on the OWASP Spring of Code :)
* Increase OWASP membership numbers

So remember, I am here to help and if I don't respond to your email in a couple days, just keep resending it until you get an answer (my inbox sometimes behaves like a black hole:  "the email goes in and never returns" :) )


== OWASP Chapters ==

I used to be the leader of the OWASP [[London]] chapter (2006/2007), but have passed the leadership to Ivan from ModSecurity. These days I spend my energy in organizing events like the [[OWASP Day]]

== Short CV ==

Dinis Cruz is a Security Consultant based in London (UK) and specialized in: ASP.NET Application Security, Active Directory deployments, Application Security audits and .NET Security Curriculum Development.

Since the 1.1 release of the .Net Framework, Dinis has been one of the strongest proponents of the need to write .Net applications that can be executed in secure Partially Trusted .Net environments, and has done extensive research on: Rooting the CLR, exposing the dangers of Full Trust Asp.Net Code, Type Confusion vulnerabilities in Full Trust (i.e. non verifiable) code, creating .Net Security Protection Layers and using Reflection to dynamically manipulate .Net Client applications.

Dinis is the current [[http://www.owasp.org/index.php/Category:OWASP_.NET_Project Owasp .Net Project]] and [[http://www.owasp.org/index.php/OWASP_Autumn_Of_Code_2006 OWASP Autumn of Code]] project's leader and the main developer of several of OWASP .Net tools ([[http://www.owasp.org/index.php/SAM%27SHE SAM'SHE]], [[http://www.owasp.org/index.php/ANBS ANBS]], [[http://www.owasp.org/index.php/Owasp_SiteGenerator SiteGenerator]], Owasp Report Generator, [[http://www.owasp.org/index.php/ASP.NET_Reflector Asp.Net Reflector]]).

Dinis is a active trainer on .Net security having written and delivered courses for IOActive, Foundstone, Intense School and KPMG . His latest course is the two day training course [[http://www.blackhat.com/html/bh-usa-06/train-bh-us-06-io-net.html Advanced Asp.Net Exploits and Countermeasures], which was delivered at the Black Hat 2006 conference and will be presented on the fortcomming [[http://www.owasp.org/index.php/Category:OWASP_AppSec_Conference OWASP AppSec Conference]] in Seattle.


== Presentations ==

* [http://video.google.com/url?docid=-4836024642453442602&esrc=sr2&ev=v&q=web%2Bg%C3%BCvenli%C4%9Fi&srcurl=http%3A%2F%2Fvideo.google.com%2Fvideoplay%3Fdocid%3D-4836024642453442602&vidurl=%2Fvideoplay%3Fdocid%3D-4836024642453442602%26q%3Dweb%2Bg%25C3%25BCvenli%25C4%259Fi%26total%3D6%26start%3D0%26num%3D10%26so%3D0%26type%3Dsearch%26plindex%3D1&usg=AL29H23PXBm-gR5WWSGCLqDWTg0siKQFXg Presentation in Turkey Chapter on 'Live Demo Of An Web Application Security Review (And Source Code Analysis)']
* [http://video.google.com/url?docid=7782803854278645697&esrc=sr4&ev=v&q=web%2Bg%C3%BCvenli%C4%9Fi&srcurl=http%3A%2F%2Fvideo.google.com%2Fvideoplay%3Fdocid%3D7782803854278645697&vidurl=%2Fvideoplay%3Fdocid%3D7782803854278645697%26q%3Dweb%2Bg%25C3%25BCvenli%25C4%259Fi%26total%3D6%26start%3D0%26num%3D10%26so%3D0%26type%3Dsearch%26plindex%3D3&usg=AL29H23k8WMP3rS7_CGlpdnaVhBQk5UJ_A Presentation in Turkey Chapter on OWASP]

== Interviews & Media quotes ==

* [http://www.darkreading.com/document.asp?doc_id=135797&WT.svl=news1_1 OWASP Preps Framework for Website Security Certification], Dark Reading, 08/Oct/07
* [http://www.ddj.com/security/202300130 Security, .NET, and the OWASP Project] , Dr.Dobb's Portal , 05/Oct/07
* [http://www.sans.edu/resources/securitylab/dinis_cruz.php Security Laboratory: Thought Leaders in Software Security Series], SANS, 11/Jun/07
* [http://myappsecurity.blogspot.com/2007/07/reflection-on-dinis-cruz.html Reflection on Dinis Cruz], Anurag Agarwal Blog, 02/Jul/07

== Videos ==

* [http://www.youtube.com/watch?v=nHHDXMcrYgs The Value of Code Scanning], SANS,  24/Aug/07
* [http://video.google.co.uk/videoplay?docid=941077664562737284 Dinis Cruz @ BlackHat 2006 with FSTV], 30/Aug/06

== Working pages ==

This is more a reference for me (Dinis) but feel free to look around

* [[OWASP .NET Project]]
* [[Members Comments On OWASP membership]]
* [[Dinis Cruz Research - Draft Notes]]