AppSecEU09Tutorials - Revision history

KateHartmann at 18:10, 29 April 2009

2009-04-29T18:10:26Z

Mtesauro: /* Hands on application security with the OWASP Live CD, by Matt Tesauro, Texas Education Agency */ Updated description

2009-04-07T17:08:49Z

‎Hands on application security with the OWASP Live CD, by Matt Tesauro, Texas Education Agency: Updated description

Dune73: /* Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com) */

2009-03-13T05:31:55Z

‎Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com)

Dune73: /* Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com) */

2009-03-12T21:04:46Z

‎Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com)

Dune73: /* Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com) */

2009-03-12T20:56:44Z

‎Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com)

Dune73: /* Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com) */

2009-03-12T20:56:28Z

‎Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com)

Dune73: /* Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com) */

2009-03-12T20:55:34Z

‎Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com)

Dune73: /* Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com) */

2009-03-12T20:55:13Z

‎Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com)

Dune73: /* Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com) */

2009-03-12T20:46:49Z

‎Introduction to ModSecurity, the Apache Security Module, by Christian Folini, Netnea (christian.folini 'at' netnea.com)

Sdeleersnyder: /* Europe 2009 Tutorials */

2009-03-07T18:39:59Z

‎Europe 2009 Tutorials

@@ Line 1: / Line 1: @@
 =Europe 2009 Tutorials=
-This year we bring you '''eight(!)''' 1- and 2-day tutorials from the best application security experts!
+This year we bring you 1- and 2-day tutorials from the best application security experts!
 The tutorial are in the same venue as the conference.
@@ Line 7: / Line 7: @@
 ==2-day tutorials (May 11-12)==
 ===Web Services Security, ''by Dave Wichers, Aspect Security''===
@@ Line 90: / Line 79: @@
 [http://guest.cvent.com/i.aspx?4W,M3,887f27a2-13e0-47dc-9220-76ed22ab0546 Click HERE to register for this Tutorial]
 ==1-day tutorials (May 12)==

@@ Line 7: / Line 7: @@
 ==2-day tutorials (May 11-12)==
-===Hands on application security with the OWASP Live CD, ''by Matt Tesauro, Texas Education Agency''===
+===Hands on application security with the OWASP Live CD, ''by Matt Tesauro, OWASP Live CD Project Lead''===
-The OWASP Live CD is a project that collects some of the best open source security projects in a single environment. Web developers, testers and security professionals can boot from this Live CD and have access to a full security testing suite. This allows its users to test for various security issues in web applications and web sites. The Live CD also contains documentation and an interactive learning environment to enhance users web application security knowledge. This presentation will cover the current state of the OWASP Live CD as well as the plans for future developments. Time permitting, a live demonstration of the OWASP Live CD will be conducted. The OWASP Live CD is a project of the Open Web Application Security Project (OWASP) and is free for commercial or noncommercial use.
+The "Hands on application security" tutorial will be a combination of lecture followed by hands on experience using the OWASP Live CD.  A customized version of the OWASP Live CD will be provided to attendees with a self-contained training environment including several applications to test with the provided tools.  The overall framework for the class will be the OWASP Testing Guide v3 methodology.  The goal of this class is to provide an overview of both the OWASP Testing Guide and the OWASP Live CD combined with testing of real web applications.  By the end of the second day, attendees will be familiar with how to test web applications using the OWASP Testing Guide v3 methodology and the OWASP Live CD tools.  Additionally, they will have the training environment to take home with them to further hone their skills.
-More information is available at: [[:Category:OWASP Live CD Project]]
+More information about the Live CD is available at [http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project OWASP Live CD] and the guide is at [[:OWASP Testing Guide]].
-Students will need to bring their laptop with them.
+'''Students will need to bring a laptop''' with them with a CD ROM drive and a x86 CPU.  They will have a choice of running the Live CD directly or as a virtualized host.  A relatively recent laptop should be fine as the OWASP Live CD runs fine as a virtual machine (VMware) in as little as 256 MB RAM.  An Intel compatible Pentium II class or later laptop with a CDROM that can be used to boot an operating system would be the minimal requirement.  You can verify that your laptop will work by downloading a release of the OWASP Live CD prior to class.  This is recommended to avoid problems during the class itself.  Also, [http://www.virtualbox.org/ Virtual Box] is a no-cost virtualization product which works with the Live CD and is available for Win/OS-X/Linux.
-'''Matt Tesauro''' has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&M Mays Business School. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications.
 [http://guest.cvent.com/i.aspx?4W,M3,887f27a2-13e0-47dc-9220-76ed22ab0546 Click HERE to register for this Tutorial]

@@ Line 170: / Line 170: @@
 * Core Rules (1/2 lesson) - Introduction to the official Core Rules (a set of generic blacklist rules)
 * Alerts and Logs (1/2 lesson) - Format of the Logs, Configruation and handling of False Positives
-* HTTP - A closer look - HTTP on the internet and in Apache and what this means for ModSecurity
+* A closer look at HTTP - How it works on the internet and in Apache and what this means for ModSecurity and you
 * Architecture II - Good use of ModSecurity in the Enterprise
 * LAB: Rules II - More complex rules

@@ Line 166: / Line 166: @@
 Tutorial program in 7 lessons
-* LAB: Rules I
+* LAB: Rules I - Writing simple rules
-** Writing simple rules
+* Architecture I - Characteristics of the multi-tier architecture
-* Architecture I
+* Core Rules (1/2 lesson) - Introduction to the official Core Rules (a set of generic blacklist rules)
-* Core Rules (1/2 lesson)
+* Alerts and Logs (1/2 lesson) - Format of the Logs, Configruation and handling of False Positives
-* Alerts and Logs (1/2 lesson)
+* HTTP - A closer look - HTTP on the internet and in Apache and what this means for ModSecurity
-* HTTP - A closer look
+* Architecture II - Good use of ModSecurity in the Enterprise
-* Architecture II
+* LAB: Rules II - More complex rules
-* LAB: Rules II
+* Remo - Demonstration of Remo, a whitelist rule editor for ModSecurity.
 * Remo
 Attendees have to bring their own laptop.

@@ Line 167: / Line 167: @@
 Tutorial program in 7 lessons
 * LAB: Rules I
-## Writing simple rules
+** Writing simple rules
 * Architecture I
 * Core Rules (1/2 lesson)

@@ Line 162: / Line 162: @@
 ===Introduction to ModSecurity, the Apache Security Module, ''by Christian Folini, Netnea (christian.folini 'at' netnea.com)''===
-The training session adresses  technical users with a good understanding of http, but no previous knowledge of ModSecurity. The programm will be a mix of presentations, lab sessions and discussions about the merits of web application firewalls and online security in general.
+The training session adresses technical users with a certain understanding of http, but no previous knowledge of ModSecurity. The programm will be a mix of presentations, lab sessions and discussions about the merits of web application firewalls and online security in general.
-The attendees will recieve the basic knowledge to use ModSecurity at home and the means to configure the module in real world situations. They will thus also get an overview about the documentation and community support offerings.
+The attendees will recieve the basic knowledge to use ModSecurity and the means to configure the module in real world situations. They will also get an overview about the documentation and community support offerings.
 Tutorial program in 7 lessons
 * LAB: Rules I
 * Architecture I
 * Core Rules (1/2 lesson)
@@ Line 177: / Line 179: @@
 '''Christian Folini''', is a Switzerland based consultant at netnea.com. Officially, Christian's background is medieval history with studies at the Universities of Berne, Bielefeld (Germany), Berlin and Fribourg (Switzerland), where he also graduated with computer science as a minor subject. He published on female mysticism and database design for historical research. Despite his unusual background, he is specialised in
-webserver security and the configuration of ModSecurity. Christian continues to work on two of the biggest online banking setups in Switzerland (Switzerland, that's only couple of hundred thousand customers, but these Swiss banks tend to take security quite seriously). He is a contributor to the CIS Apache Benchmark and recently got hooked up on the group attempting to upgrade the Web Application Firewall
+webserver security and the configuration of ModSecurity. Christian continues to work on two of the biggest online banking setups in Switzerland (That's only couple of hundred thousand customers, but these Swiss banks tend to take security quite seriously). He is a contributor to the CIS Apache Benchmark and recently got hooked up on the group attempting to upgrade the Web Application Firewall
 Evaluation Criteria (WAFEC). Christian is also the developer of Remo, a whitelist rule editor for ModSecurity.
 [http://guest.cvent.com/i.aspx?4W,M3,887f27a2-13e0-47dc-9220-76ed22ab0546 Click HERE to register for this Tutorial]

← Older revision		Revision as of 18:39, 7 March 2009
Line 3:		Line 3:

	The tutorial are in the same venue as the conference.		The tutorial are in the same venue as the conference.
		+
		+	Conference tutorial fees are 910 Euros (2 days) and 455 Euros (1 day).

	==2-day tutorials (May 11-12)==		==2-day tutorials (May 11-12)==