AppSec Brasil 2010 - Revision history

Sapao at 16:26, 10 December 2010

2010-12-10T16:26:46Z

Sapao: /* Promoted by */

2010-11-16T00:25:44Z

‎Promoted by

Leonardo Francisco Buonsanti de Andrade at 15:35, 12 November 2010

2010-11-12T15:35:43Z

Leonardo Francisco Buonsanti de Andrade at 15:29, 12 November 2010

2010-11-12T15:29:04Z

Leonardo Francisco Buonsanti de Andrade at 19:47, 11 November 2010

2010-11-11T19:47:43Z

Leonardo Francisco Buonsanti de Andrade at 23:18, 8 November 2010

2010-11-08T23:18:11Z

Sapao: /* Conference Program - Day 1 - November 18th 2010 */

2010-11-05T11:33:25Z

‎Conference Program - Day 1 - November 18th 2010

Sapao: /* Conference Program - Day 2 - November 19th 2010 */

2010-10-29T17:20:19Z

‎Conference Program - Day 2 - November 19th 2010

Sapao: /* Conference Program - Day 1 - November 18th 2010 */

2010-10-29T17:19:44Z

‎Conference Program - Day 1 - November 18th 2010

Sapao: /* Chris Hofmann */

2010-10-26T22:56:07Z

‎Chris Hofmann

@@ Line 803: / Line 803: @@
 Powerpoint template: [[Media:OWASP_Presentation_Template_BrazilAppSec2010.ppt]]
 <br> <headertabs />
 [[Category:OWASP_AppSec_Conference]]

@@ Line 85: / Line 85: @@
 [[Image:Appsec Brasil 2010 InstitutoTuring.png]]
 </center>
 ==== Keynotes  ====

@@ Line 50: / Line 50: @@
 | [[Image:Logo PagSeguro-Uma empresa-UOL.jpg|150px|link=http://www.pagseguro.uol.com.br]]
 | width="50" | <br>
-| [[Image:isc2_new_logo.jpg|150px|link=http://www.isc2.org]]
+| [[Image:isc2_new_logo.jpg|250px|link=http://www.isc2.org]]
 |-
 | &nbsp;

@@ Line 50: / Line 50: @@
 | [[Image:Logo PagSeguro-Uma empresa-UOL.jpg|150px|link=http://www.pagseguro.uol.com.br]]
 | width="50" | <br>
-| [[Image:Sponsor-isc2.gif|150px|link=http://www.isc2.org]]
+| [[Image:isc2_new_logo.jpg|150px|link=http://www.isc2.org]]
 |-
 | &nbsp;

@@ Line 49: / Line 49: @@
 | width="50" | <br>
 | [[Image:Logo PagSeguro-Uma empresa-UOL.jpg|150px|link=http://www.pagseguro.uol.com.br]]
 |-
 | &nbsp;

← Older revision		Revision as of 23:18, 8 November 2010
Line 587:		Line 587:
	== Security in Service-oriented architectures ==		== Security in Service-oriented architectures ==

−	'''<span style="color: rgb(255, 0, 0);"> ~~Tutorial in Portuguese~~. </span>'''	+	'''<span style="color: rgb(255, 0, 0);"> Unfortunately this course has been cancelled. </span>'''
−
−	~~'''Date and time: Nov 17 (9AM to 6PM)'''<br> '''Instructors: Douglas Rodrigues, Julio Cesar Estrella e Nuno Manuel dos Santos Antunes'''<br>~~
−
−	~~'''Summary'''~~
−
−	Web services are the cornerstone of Service-Oriented Architectures (SOA). As critical components of business, Web services must provide high security. However, the deployment of secure Web services is a complex task. In fact, several studies show that a large number of Web Services are deployed with security breaches ranging from code vulnerabilities (eg vulnerabilities that allow code injection, including SQL injection and XPath injection) to the incorrect use of standards and security protocols. The aim of this short course is to present the theoretical and practical tools that allow the detection of vulnerabilities and security protocols and mechanisms against attacks.
−
−
−	~~'''Público Alvo'''~~
−
−	The target audience is composed of technical staff and operational systems development organizations with requirements for knowledge of languages and programming methodologies at the intermediate level.
−
−	~~'''Learning Objectives'''~~
−
−	The proposed short course contributes to add new technological trends. The theme is quite interesting in relation to the great challenges of research in computing, since it fits naturally within the technological development of quality, encompassing making systems available, accurate, secure, scalable, persistent and ubiquitous, and notoriously, observing the conference area, which SOA, Web services and security are the subject of growing research in computing, as it is current and of interest to the academic community, as well as professionals who work in the labor market. The interest in SOA has grown in recent years because it is an approach that helps the system to remain flexible and scalable as they grow, and can also help to resolve the gap business / IT. Students and professionals will have the opportunity to understand the basics of vulnerability detection code level and also to detect attacks between protocols and mechanisms. The idea is that participants can use the knowledge gained in this brief short course for the development of distributed applications using Web services secure and obtain knowledge needed to diagnose and prevent attacks on this type of application.
−
−	~~'''Topics'''~~
−
−	~~#SECURITY STANDARDS AND PROTOCOLS FOR WEB SERVICES~~
−	~~#ATTACKS IN WEB SERVICES~~
−	~~## Denial of Service Attacks~~
−	~~## Attacks Brute Force~~
−	~~## Spoofing Attacks~~
−	~~## Flooding Attacks~~
−	~~## Injection Attacks~~
−	~~#EVALUATING SECURITY IN WEB SERVICES~~
−	~~## Case Study on security in Web Services~~
−	~~## "white box" analysis~~
−	~~## "Black-box" testing~~
−	~~## "Gray-box" testing~~
−	~~## Case study on the effectiveness of tools for security assessment~~
−
−	~~'''Instructors'''~~
−
−	Julio Cesar Estrella - Master in Computer Science and Computational Mathematics, in the area of Distributed Systems (Institute of Mathematical Sciences and Computer ICMC / University of São Paulo - USP). During the Masters, worked with simulated queuing network in a project related to the development of negotiation techniques in models of web servers with service differentiation. Ph.D. in Computer Science and Computational Mathematics (Institute of Mathematical Sciences and Computer ICMC / University of São Paulo - USP). The theme of his doctoral thesis was about service-oriented architectures to support QoS and characterization of workloads for Web Services Composition and Service also supports Quality of Service. He is currently a professor at the Federal Technological University of Paraná (UTFPR - Campo Mourão)
−
−	Douglas Rodrigues - Master in Computer Science and Computational Mathematics from Institute of Mathematics and Computer Science, University of São Paulo - ICMC-USP/São Carlos. Bachelor of Computer Science from University Euripides Marília - Univ - Marília / SP. Works on the following subjects: SOA, Web Services, performance evaluation, encryption and security.
−
−	Nuno dos Santos Antunes - attended from 2003 to 2007, the Computer Engineering program, University of Coimbra. Since 2008, carries out scientific research in the group of Software and Systems Engineering (SSE) Center for Informatics and Systems University of Coimbra (CISUC), on topics related to methodologies and tools for developing Web Services without vulnerabilities. Concluded in 2009 a Masters in Computer Engineering from the Department of Computer Engineering, University of Coimbra, with the final rating of Very Good. In 2009 he began his PhD in Sciences and Information Technology. He published five scientific papers in conferences with the process of rigorous peer review, including articles in the most prestigious conferences in the areas of reliability and services.

@@ Line 352: / Line 352: @@
 | bgcolor="#8595c2" align="CENTER" | '''Reception Desk Open'''
 |-
-| width="14%" height="17" align="right" | 09:00 - 09:30
+| width="14%" height="17" align="right" | 09:00 - 09:40
 | bgcolor="#b9c2dc" align="CENTER" | '''Opening Ceremony'''
 |-
-| width="14%" height="49" align="right" | 09:30 - 10:20
+| width="14%" height="49" align="right" | 09:40 - 10:30
 | bgcolor="#eeeeee" align="CENTER" | '''Dinis Cruz'''<br> About OWASP
 |-
-| width="14%" height="17" align="right" | 10:20 - 10:40
+| width="14%" height="17" align="right" | 10:30 - 10:50
 | bgcolor="#d98b66" align="CENTER" | '''Break'''
 |-
-| width="14%" height="49" align="right" | 10:40 - 11:40
+| width="14%" height="49" align="right" | 10:50 - 11:50
 | bgcolor="#b9c2dc" align="CENTER" | '''Robert 'RSnake' Hansen'''<br> The Humble Cookie
 |-
-| width="14%" height="49" align="right" | 11:40 - 12:30
+| width="14%" height="49" align="right" | 11:50 - 12:40
 | bgcolor="#eeeeee" align="CENTER" | '''Amichai Shulman<br>''' Business Logic Attacks – BATs and BLBs
 |-
-| width="14%" height="17" align="right" | 12:30 - 14:30
+| width="14%" height="17" align="right" | 12:40 - 14:30
 | bgcolor="#d98b66" align="CENTER" | '''Lunch Break'''
 |-

@@ Line 402: / Line 402: @@
 |-
 | width="14%" height="32" align="right" | 09:00 - 10:00
-| bgcolor="#b9c2dc" align="CENTER" | '''Jeremiah Grossman'''<br> TBD
+| bgcolor="#b9c2dc" align="CENTER" | '''Jeremiah Grossman'''<br> Facilitating Application Security Maturity
 |-
 | width="14%" height="47" align="right" | 10:00 - 10:50

@@ Line 371: / Line 371: @@
 |-
 | width="14%" height="47" align="right" | 14:30 - 15:20
-| bgcolor="#b9c2dc" align="CENTER" | '''Chris Hofmann'''<br> TBD
+| bgcolor="#b9c2dc" align="CENTER" | '''Chris Hofmann'''<br> Making the Next Generation of Browsers More Secure.
 |-
 | width="14%" height="32" align="right" | 15:20 - 16:10

@@ Line 182: / Line 182: @@
 ==Chris Hofmann==
-'''''Title:'''''  '''TBD'''
+'''''Title:'''''  '''Making the Next Generation of Browsers More Secure.'''
-'''''Abstract:''''' TBD.
+'''''Abstract:''''' Chris will talk about security features going into Firefox 4 and other next generation browsers including CSP, CSS history sniffing fixes, STS, and more.   We will also talk about how you can get involved and provide input in development, testing, and using these features that will shaping the future of the web.
-'''''Bio:''''' TBD.
+'''''Bio:''''' As director of engineering and Special Projects at the Mozilla Foundation and Corporation over the last 7 years, Chris Hofmann has spearheaded the research and development work of thousands of open source contributors around the world.
 ====Speakers====