2014 BASC Presentations - Revision history

Jeff Williams at 17:25, 17 October 2014

2014-10-17T17:25:21Z

Arshan at 14:18, 16 October 2014

2014-10-16T14:18:10Z

Tom Conner at 16:47, 10 October 2014

2014-10-10T16:47:29Z

Tom Conner at 21:41, 9 October 2014

2014-10-09T21:41:32Z

Tom Conner at 18:16, 8 October 2014

2014-10-08T18:16:38Z

Tom Conner at 03:03, 2 October 2014

2014-10-02T03:03:01Z

Tom Conner at 02:53, 2 October 2014

2014-10-02T02:53:48Z

Tom Conner at 04:20, 30 September 2014

2014-09-30T04:20:19Z

Tom Conner at 03:33, 30 September 2014

2014-09-30T03:33:18Z

Tom Conner: Created page with "{{2014_BASC:Header_Template | Speakers/Panelists}} === Jack Mannino === '''nVisium'''
Jack is the CEO at nVisium and loves solving problems in the field of application..."

2014-09-30T03:32:32Z

Created page with "{{2014_BASC:Header_Template | Speakers/Panelists}} === Jack Mannino === '''nVisium''' Jack is the CEO at nVisium and loves solving problems in the field of application..."

New page

{{2014_BASC:Header_Template | Speakers/Panelists}}

=== Jack Mannino ===
'''nVisium''' 
Jack is the CEO at nVisium and loves solving problems in the field of application security. With experience building, breaking, and securing software, he founded nVisium to invent new and more efficient ways of protecting software. Jack is a huge fan of contributing to open source projects, and leads the OWASP Northern Virginia chapter. In his spare time, he loves to kick around new frameworks and technologies, especially things that run Android and code written in Scala. He’s also an optimistic New York Mets fan, although that optimism slowly fades away every summer.

=== Geller Bedoya ===
'''nVisium''' 
Geller Bedoya is a senior application security at nVisium. Geller graduated from Georgia Tech with a degree in Electrical Engineering. As a undergraduate student Geller tackled a range of security challenges from memory forensics to botnet research. After graduation, he promptly put his security knowledge to work at a financial brokerage where he aided in design and implementation of security throughout the SDLC. He performs security code reviews and application security testing of products. Outside the office, he finds peace of mind by cycling and running.

=== Collin Mulliner ===
'''Northeastern University''' 
Collin Mulliner is a postdoc researcher at SECLAB at Northeastern University. Collin's main interest is in the area of security and privacy of mobile and embedded devices with an emphasis on mobile and smart phones. Since 1997, Collin has developed software and did security work for Palm OS, J2ME, Linux, Symbian OS, Windows Mobile, Android, and the iPhone. In 2006, he published the first remote code execution exploit based on the multimedia messaging service (MMS). Collin's most recent projects are in the area of vulnerability analysis and offensive security.

=== Michael Weissbacher ===
'''Northeastern University''' 

=== Jeff Williams ===
'''Contrast Security''' 
Jeff Williams is the founder and CTO of [http://contrastsecurity.com Contrast Security], bringing the power of instrumentation and real time analytics to secure your application portfolio. Previously, Jeff was a founder and CEO of [http://aspectsecurity.com Aspect Security]. He also served as Global Chairman of the OWASP Foundation where he created many open-source standards, tools, libraries, and guidelines – including the OWASP Top Ten, WebGoat, ESAPI, XSS CheatSheet, ASVS and more. Jeff welcomes hearing from you and may be reached directly at [mailto:jeff.williams@contrastsecurity.com jeff.williams@contrastsecurity.com].

=== Walt Williams ===
'''Lattice Engines''' 
Walt Williams, CISSP®, SSCP®, CEH, CPT has served as an infrastructure and security
architect at firms as diverse as GTE Internetworking, State Street Corp, Teradyne, The
Commerce Group, and EMC. He has since moved to security management, where he now
manages security at Lattice Engines. He is an outspoken proponent of design before build, an
advocate of frameworks and standards, and has spoken at Security B-Sides on risk management
as the cornerstone of a security architecture.

Mr. Williams' articles on security and service oriented architecture have appeared in the
Information Security Management Handbook, and is the author of Security for Service Oriented
Architecture by CRC press, 2014. He sits on the board of directors for the New England ISSA
chapter and is a member of the program committee for Metricon. He has a master’s degree in
Anthropology from Hunter College.

=== George Ehrhorn ===
'''MathWorks''' 
This talk is about how MathWorks uses the OCTAVE Allegro Framework to model application risks and countermeasures.

=== Dinesh Shetty ===
'''''' 

=== Jonathan Chittenden ===
'''''' 

=== Sagar Dongre ===
'''''' 

=== Patrick Laverty ===
'''''' 

=== Steve Markey ===
'''''' 

{{2014_BASC:Footer_Template | Speakers}}

@@ Line 136: / Line 136: @@
 {{2014_BASC:Presentaton_Info_Template|Why Your AppSec Experts Are Killing You|Jeff Williams| | | }}
-Software development has been transformed by practices like Continuous Integration and Continuous Delivery, while application security has remained trapped in expert-based waterfall mode. In this talk, Jeff will show you how you can evolve into a “Continuous Application Security” organization that generates assurance automatically across an entire application security portfolio. Jeff will show you how to bootstrap the “sensor-model-dashboard” feedback loop that makes real time, continuous application security possible. He will demonstrate the approach with a new *free* tool called Contrast for Eclipse that brings the power of instrumentation-based application security testing directly into the popular IDE.  Check out [https://www.youtube.com/watch?v=4B-HgsT_J_M “Application Security at DevOps Speed and Portfolio Scale”] for some background.
+Software development has been transformed by practices like Continuous Integration and Continuous Delivery, while application security has remained trapped in expert-based waterfall mode. In this talk, Jeff will show you how you can evolve into a “Continuous Application Security” organization that generates assurance automatically across an entire application security portfolio. Jeff will show you how to bootstrap the “sensor-model-dashboard” feedback loop that makes real time, continuous application security possible. He will demonstrate the approach with a new *free* tool called [http://marketplace.eclipse.org/node/1876552 "Contrast for Eclipse"] that brings the power of instrumentation-based application security testing directly into the popular IDE.  Check out [https://www.youtube.com/watch?v=4B-HgsT_J_M “Application Security at DevOps Speed and Portfolio Scale”] for some background.
 {{2014_BASC:Footer_Template | Presentations}}

@@ Line 136: / Line 136: @@
 {{2014_BASC:Presentaton_Info_Template|Why Your AppSec Experts Are Killing You|Jeff Williams| | | }}
-Software development has been transformed by practices like Continuous Integration and Continuous Integration, while application security has remained trapped in expert-based waterfall mode. In this talk, Jeff will show you how you can evolve into a “Continuous Application Security” organization that generates assurance automatically across an entire application security portfolio. Jeff will show you how to bootstrap the “sensor-model-dashboard” feedback loop that makes real time, continuous application security possible. He will demonstrate the approach with a new *free* tool called Contrast for Eclipse that brings the power of instrumentation-based application security testing directly into the popular IDE.  Check out [https://www.youtube.com/watch?v=4B-HgsT_J_M “Application Security at DevOps Speed and Portfolio Scale”] for some background.
+Software development has been transformed by practices like Continuous Integration and Continuous Delivery, while application security has remained trapped in expert-based waterfall mode. In this talk, Jeff will show you how you can evolve into a “Continuous Application Security” organization that generates assurance automatically across an entire application security portfolio. Jeff will show you how to bootstrap the “sensor-model-dashboard” feedback loop that makes real time, continuous application security possible. He will demonstrate the approach with a new *free* tool called Contrast for Eclipse that brings the power of instrumentation-based application security testing directly into the popular IDE.  Check out [https://www.youtube.com/watch?v=4B-HgsT_J_M “Application Security at DevOps Speed and Portfolio Scale”] for some background.
 {{2014_BASC:Footer_Template | Presentations}}

@@ Line 6: / Line 6: @@
-{{2014_BASC:Presentaton_Info_Template|AppSec: how it fits into Digital Security|Jared DeMott| | | }}
+{{2014_BASC:Presentaton_Info_Template|AppSec: How It Fits into Digital Security|Jared DeMott| | | }}
 Securing code is important. But history has shown us that
 we can never be certain that our code is 100% perfect. This

← Older revision		Revision as of 21:41, 9 October 2014
Line 5:		Line 5:
	We would like to thank our speakers for donating their time and effort to help make this conference successful.		We would like to thank our speakers for donating their time and effort to help make this conference successful.

		+
		+	{{2014_BASC:Presentaton_Info_Template\|AppSec: how it fits into Digital Security\|Jared DeMott\| \| \| }}
		+	Securing code is important. But history has shown us that
		+	we can never be certain that our code is 100% perfect. This
		+	becomes particularly true in rapidly evolving environments.
		+	As an industry we need to take a broader look. What security
		+	features are provided by the hardware, OS, language, compiler,
		+	and even application type? Join us bright and early as Dr.
		+	DeMott kicks off the 2014 Boston Application Security Conference
		+	with a Keynote you won’t forget.

	{{2014_BASC:Presentaton_Info_Template\|Code Assisted PenTest for Mobile Applications\|Dinesh Shetty\| \| \| }}		{{2014_BASC:Presentaton_Info_Template\|Code Assisted PenTest for Mobile Applications\|Dinesh Shetty\| \| \| }}

@@ Line 69: / Line 69: @@
 {{2014_BASC:Presentaton_Info_Template|Open Source Vulnerability Response|EMC Product Security Response Center| | | }}
-Like all software vendors, EMC faces challenges when it comes to managing the response to security vulnerabilities reported on open source embedded components. We will share our experiences by taking OpenSSL Heartbleed as an example and walk through the various challenges we encountered while dealing with it and the processes we built to overcome some of those problems.
+Like all software vendors, EMC faces challenges when it comes to managing the response to security vulnerabilities reported on open source embedded components. We will share our experiences by taking OpenSSL Heartbleed and the Bash Bug ‘ShellShock’ as examples and walk through the various challenges we encountered while dealing with it and the processes we built to overcome some of those problems.
 {{2014_BASC:Presentaton_Info_Template|Securing The Android Apps On Your Wrist and Face|Jack Mannino and Geller Bedoya| | | }}

@@ Line 50: / Line 50: @@
 This presentation will be based upon my recent book: Security for Service Oriented Architectures, CRC press, and 10 years of experience working with application security architecture in various corporations.
-{{2014_BASC:Presentaton_Info_Template|Lean Security for Small or Medium Sized Business|Jonathan Chittenden and Anson Gomes| | | }}
+{{2014_BASC:Presentaton_Info_Template|Lean Security for Small or Medium Sized Business|Anson Gomes and Jeremy Spencer| | | }}
 For a small or medium sized business (SMB) the fallout from a security or privacy incident can be at best a PR nightmare. At their worst it can cause irrecoverable damage and end your business by impacting sales or ad revenue. Your user base may take a hit. You may need to draft a blog post or email your customers describing the incident and asking them to change passwords. A key culprit is budget constraints – as a SMB you are allocating resources to innovating, creating, and improving your product. Security, while important, isn't always the primary objective.

@@ Line 94: / Line 94: @@
 {{2014_BASC:Presentaton_Info_Template|Using the OCTAVE Allegro Framework to Model Application Risks and Countermeasures|George Ehrhorn| | | }}
-This talk is about how MathWorks uses the OCTAVE Allegro Framework to model application risks and countermeasures.
+Effective Risk Assessment is an incredible tool available to the Information Security professional. A defensible risk assessment ensures that you’ll analyze the most risky aspects of your most risky applications. It lets you develop countermeasures that have the biggest impact. In a real world scenario a properly conducted risk assessment can help you work in the most efficient way. This talk is about how MathWorks uses the OCTAVE Allegro Framework to model application risks and develop countermeasures.
 {{2014_BASC:Presentaton_Info_Template|Why is CSP Failing? Trends and Challenges in CSP Adoption|Michael Weissbacher| | | }}

@@ Line 6: / Line 6: @@
+The presentation focuses on problems of following bad Mobile development practice. During this
+session, you will learn how to perform a Code Assisted PenTest on Mobile applications and uncover
-{{2014_BASC:Presentaton_Info_Template|Securing The Android Apps On Your Wrist and Face|Jack Mannino and Geller Bedoya| | | }}
+some well-known and some other not so well known security issues. It is far easy to gain a practical
+knowledge of security vulnerabilities than it is to read about them. Watch as Dinesh walks you through
-Android Wear and Google Glass introduce new ways of interacting with our apps and receiving timely, contextual information from the world around us. Smartphones and tablets are becoming the central point for sending and receiving data from wearables and sensors. Building apps for a wearable world introduces new risks as well as shifts the responsibilities for implementing security controls to other layers.
+custom created demo applications and source code review tools, to catch security flaws noted in the
+various hand-held devices. Expect to see a lot of demos, tools, hacking and a lot of fun.
 {{2014_BASC:Presentaton_Info_Template|Finding and Exploiting Access Control Vulnerabilities in Graphical User Interfaces|Collin Mulliner| | | }}
@@ Line 43: / Line 40: @@
 these applications.
-{{2014_BASC:Presentaton_Info_Template|Why Your AppSec Experts Are Killing You|Jeff Williams| | | }}
+As defenders, we have to be right 100% of the time where an attacker only needs to be right once. The attack surface of a modern web site is incredibly large and we need to be aware of all of it. Additionally, individual attacks may not always be effective but sometimes using them together can gain the desired effect. In this talk, we’ll take a look at the whole attack surface for a typical web site and the various ways that an attacker will use to compromise a site.
-Software development has been transformed by practices like Continuous Integration and Continuous Integration, while application security has remained trapped in expert-based waterfall mode. In this talk, Jeff will show you how you can evolve into a “Continuous Application Security” organization that generates assurance automatically across an entire application security portfolio. Jeff will show you how to bootstrap the “sensor-model-dashboard” feedback loop that makes real time, continuous application security possible. He will demonstrate the approach with a new *free* tool called Contrast for Eclipse that brings the power of instrumentation-based application security testing directly into the popular IDE.  Check out [https://www.youtube.com/watch?v=4B-HgsT_J_M “Application Security at DevOps Speed and Portfolio Scale”] for some background.
+{{2014_BASC:Presentaton_Info_Template|Using the OCTAVE Allegro Framework to Model Application Risks and Countermeasures|George Ehrhorn| | | }}
-{{2014_BASC:Presentaton_Info_Template|Why is CSP Failing? Trends and
+{{2014_BASC:Presentaton_Info_Template|Why is CSP Failing? Trends and Challenges in CSP Adoption|Michael Weissbacher| | | }}
 Content Security Policy (CSP) has been proposed as a principled and
@@ Line 78: / Line 124: @@
 CSP that could help to ease its adoption by the web community.
-{{2014_BASC:Presentaton_Info_Template|The Intersection of Application Architecture and Security Architecture|Walt Williams| | | }}
+{{2014_BASC:Presentaton_Info_Template|Why Your AppSec Experts Are Killing You|Jeff Williams| | | }}
-This presentation will look at the relationship between security architecture and application architecture, specifically on the impact on application security from recent proposed changes to the Clark-Wilson integrity model.  I'll explore those changes in depth, discuss the implications for application design.  I'll also discuss the implications of these changes to distributed application architectures such as service oriented architectures and other distributed models.
+Software development has been transformed by practices like Continuous Integration and Continuous Integration, while application security has remained trapped in expert-based waterfall mode. In this talk, Jeff will show you how you can evolve into a “Continuous Application Security” organization that generates assurance automatically across an entire application security portfolio. Jeff will show you how to bootstrap the “sensor-model-dashboard” feedback loop that makes real time, continuous application security possible. He will demonstrate the approach with a new *free* tool called Contrast for Eclipse that brings the power of instrumentation-based application security testing directly into the popular IDE.  Check out [https://www.youtube.com/watch?v=4B-HgsT_J_M “Application Security at DevOps Speed and Portfolio Scale”] for some background.
 {{2014_BASC:Footer_Template | Presentations}}

@@ Line 1: / Line 1: @@
-{{2014_BASC:Header_Template | Speakers/Panelists}}
+{{2014_BASC:Header_Template | Presentations}}
-=== Jack Mannino ===
+__FORCETOC__
-'''nVisium'''<br/>
+We would like to thank our speakers for donating their time and effort to help make this conference successful.
+{{2014_BASC:Presentaton_Info_Template|Securing The Android Apps On Your Wrist and Face|Jack Mannino and Geller Bedoya| | | }}
-Mr. Williams' articles on security and service oriented architecture have appeared in the
+Android Wear and Google Glass introduce new ways of interacting with our apps and receiving timely, contextual information from the world around us. Smartphones and tablets are becoming the central point for sending and receiving data from wearables and sensors. Building apps for a wearable world introduces new risks as well as shifts the responsibilities for implementing security controls to other layers.
-=== George Ehrhorn ===
+Many of the same issues we’re familiar with from past Android experiences are still relevant, while some issues are less impactful or not (currently) possible within existing wearables. At the same time, extending the app’s trust boundaries introduces new points of exposure for developers to be aware of in order to proactively defend against attacks. We want to highlight these areas, which developers may not be aware of when adding a wearable component to an existing app.
-=== Jonathan Chittenden ===
+{{2014_BASC:Presentaton_Info_Template|Finding and Exploiting Access Control Vulnerabilities in Graphical User Interfaces|Collin Mulliner| | | }}
-=== Sagar Dongre ===
+Graphical user interfaces (GUIs) contain a number of common visual
-''''''<br/>
+elements or widgets such as labels, text fields, buttons, and lists.
-=== Patrick Laverty ===
+In this session, we introduce GEMs, or instances of GUI element misuse,
-''''''<br/>
+as a novel class of access control vulnerabilities in GUI-based
-{{2014_BASC:Footer_Template | Speakers}}