BeNeLux OWASP Day 2012 - Revision history

LievenDesmet: /* Agenda */

2013-04-14T20:34:04Z

‎Agenda

LievenDesmet: /* Agenda */

2013-04-14T20:33:11Z

‎Agenda

Favroom: /* Important Update */

2012-11-29T13:25:51Z

‎Important Update

LievenDesmet: /* Location */

2012-11-28T20:07:29Z

‎Location

LievenDesmet: /* Agenda */

2012-11-28T20:02:21Z

‎Agenda

Bart De Win at 21:57, 27 November 2012

2012-11-27T21:57:25Z

Bart De Win at 21:57, 27 November 2012

2012-11-27T21:57:00Z

Bart De Win at 21:55, 27 November 2012

2012-11-27T21:55:24Z

Bart De Win at 21:54, 27 November 2012

2012-11-27T21:54:28Z

Knoblochmartin: /* Advanced O2, by Dinis Cruz (Security Innovation) */

2012-11-27T21:13:41Z

‎Advanced O2, by Dinis Cruz (Security Innovation)

@@ Line 267: / Line 267: @@
 | 10h30 - 11h10 || [[#JohnWilander|John Wilander]] || ''' Secure Web Integration Patterns in the Era of HTML5'''<br>''Abstract:'' Quite a few organizations are finding themselves in a legacy situation with their web applications. Over ten years have passed since the era of dynamic HTML and with the rise of HTML5 and mobile platforms there is now need to gradually move these legacy beasts into a new architecture. Additionally, more and more third party services are offered such as maps, tracking, social media tie-ins, video etc. What are the possible and suitable design patterns for bringing new web, old web, and third party web together? Can we isolate them from each other to secure the new apps from legacy and third party security vulnerabilities? We will dig into the postMessage api, the iframe sandbox directive, CORS, and the same-origin policy while comparing it to the previous generation of integration with jsonp and other hacks.
 |-
-| 11h10 - 11h50 || [[#LievenDesmet|Lieven Desmet]] || '''Sandboxing Javascript''' ([https://www.owasp.org/index.php/File:Sandboxing-Javascript.pdf PDF])<br>''Abstract:'' The inclusion of third-party scripts in web pages is a common practice. A recent study has shown that more than half of the Alexa top 10 000 sites include scripts from more than 5 different origins. However, such script inclusions carry risks, as the included scripts operate with the privileges of the including website.<br>
+| 11h10 - 11h50 || [[#LievenDesmet|Lieven Desmet]] || '''Sandboxing Javascript''' ([https://www.owasp.org/images/1/10/Sandboxing-Javascript.pdf PDF])<br>''Abstract:'' The inclusion of third-party scripts in web pages is a common practice. A recent study has shown that more than half of the Alexa top 10 000 sites include scripts from more than 5 different origins. However, such script inclusions carry risks, as the included scripts operate with the privileges of the including website.<br>
 In this talk, we propose JSand, a server-driven but client-side JavaScript sandboxing framework. JSand requires no browser modifications: the sandboxing framework is implemented in JavaScript and is delivered to the browser by the websites that use it. Enforcement is done entirely at the client side: JSand enforces a server-specified policy on included scripts without requiring server-side filtering or rewriting of scripts.<br>
 Most importantly, JSand is complete: access to all resources is mediated by the sandbox.<br>

@@ Line 267: / Line 267: @@
 | 10h30 - 11h10 || [[#JohnWilander|John Wilander]] || ''' Secure Web Integration Patterns in the Era of HTML5'''<br>''Abstract:'' Quite a few organizations are finding themselves in a legacy situation with their web applications. Over ten years have passed since the era of dynamic HTML and with the rise of HTML5 and mobile platforms there is now need to gradually move these legacy beasts into a new architecture. Additionally, more and more third party services are offered such as maps, tracking, social media tie-ins, video etc. What are the possible and suitable design patterns for bringing new web, old web, and third party web together? Can we isolate them from each other to secure the new apps from legacy and third party security vulnerabilities? We will dig into the postMessage api, the iframe sandbox directive, CORS, and the same-origin policy while comparing it to the previous generation of integration with jsonp and other hacks.
 |-
-| 11h10 - 11h50 || [[#LievenDesmet|Lieven Desmet]] || '''Sandboxing Javascript'''<br>''Abstract:'' The inclusion of third-party scripts in web pages is a common practice. A recent study has shown that more than half of the Alexa top 10 000 sites include scripts from more than 5 different origins. However, such script inclusions carry risks, as the included scripts operate with the privileges of the including website.<br>
+| 11h10 - 11h50 || [[#LievenDesmet|Lieven Desmet]] || '''Sandboxing Javascript''' ([https://www.owasp.org/index.php/File:Sandboxing-Javascript.pdf PDF])<br>''Abstract:'' The inclusion of third-party scripts in web pages is a common practice. A recent study has shown that more than half of the Alexa top 10 000 sites include scripts from more than 5 different origins. However, such script inclusions carry risks, as the included scripts operate with the privileges of the including website.<br>
 In this talk, we propose JSand, a server-driven but client-side JavaScript sandboxing framework. JSand requires no browser modifications: the sandboxing framework is implemented in JavaScript and is delivered to the browser by the websites that use it. Enforcement is done entirely at the client side: JSand enforces a server-specified policy on included scripts without requiring server-side filtering or rewriting of scripts.<br>
 Most importantly, JSand is complete: access to all resources is mediated by the sandbox.<br>

@@ Line 431: / Line 431: @@
 ==== <B>Important Update</B> ====
 The brewery visit is limit to 60 people. Therefor, the 60 first registered people that indicated interest in the social event have been invited to participate. Any remaining tickets will be offered on Thursday around noon at the registration desk.
 All other people (and the people of the brewery tour after that has finished) are warmly invited to join us in the Downtown Jack, a pub with a number of pool and snooker tables. 5 pool tables have been exclusively reserved for us from 20h00 onwards. You can also have a drink and eat something there if you like.

@@ Line 251: / Line 251: @@
 ==== Location ====
-The training room is: (TBD)  (for details, check the {{#switchtablink:Venue|Venue}} tab)
+The conference takes place in auditorium K.06, the registration and catering in the foyer of building 200A (ground floor)  (for details, check the {{#switchtablink:Venue|Venue}} tab)
 ==== Agenda ====

@@ Line 115: / Line 115: @@
 |-
 | 09h30 - 11h00 || Training
-| rowspan="7" style="width:100px;" | [[#DinisCruz|Advanced O2, by Dinis Cruz]]
+| rowspan="7" style="width:100px;" | [[#DinisCruz|Advanced O2, by Dinis Cruz <br/><br/> Room 04.112]]
-| rowspan="7" style="width:100px;" | [[#DanCornell|SDLC with Open Source tools, by Dan Cornell]]
+| rowspan="7" style="width:100px;" | [[#DanCornell|SDLC with Open Source tools, by Dan Cornell <br/><br/> Room 05.128]]
-| rowspan="7" style="width:100px;" | [[#VolkertDeBuisonje|Secure Java Development with ESAPI (hands-on), by Volkert de Buisonjé]]
+| rowspan="7" style="width:100px;" | [[#VolkertDeBuisonje|Secure Java Development with ESAPI (hands-on), by Volkert de Buisonjé <br/><br/> Room 05.152]]
-| rowspan="7" style="width:100px;" | [[#MartinKnobloch|Essential Web Appplication Security (OWASP Top 10, Webgoat, WebScarab), by Martin Knobloch]]
+| rowspan="7" style="width:100px;" | [[#MartinKnobloch|Essential Web Appplication Security (OWASP Top 10, Webgoat, WebScarab), by Martin Knobloch <br/><br/> Room 05.001]]
 |-
 | 11h00 - 11h30 ||  ''Coffee Break''

@@ Line 436: / Line 436: @@
 The address: Parkstraat 40, 3000 Leuven (see http://www.downtownjack.be/)
-== <B>Brewery Visit Information</B> ==
+==== <B>Brewery Visit Information</B> ====
 The social event will take place at the InBev Brewery in Leuven, where there will be a guided tour and a beer tasting.<br>
 Unfortunately, the tour is limited to 60 people. Since we have more registered people than places, we will soon announce how we will

@@ Line 10: / Line 10: @@
 ==== News ====
 * Advanced O2 training, by Dinis Cruz will start at 10:30 AM!
 <br>
@@ Line 428: / Line 429: @@
 ==== Social Event, November 29th ====
 The social event will take place at the InBev Brewery in Leuven, where there will be a guided tour and a beer tasting.<br>
 Unfortunately, the tour is limited to 60 people. Since we have more registered people than places, we will soon announce how we will
@@ Line 434: / Line 443: @@
 <br>
 '''The entrance fee for the tour is 10 EUR'''. <br>
-This amount will have to be paid to the Benelux organisation upon entry in cash.<br>
+This amount will have to be paid to the Benelux organisation at the registration desk or upon entry in cash (please use correct notes).<br>
 <br>
 Below is the address where the event takes place. You can take your car, bus number 2 or a taxi to reach this.<br> '''The tour starts at 19h30 sharp'''.<br>

@@ Line 159: / Line 159: @@
 === Advanced O2, by Dinis Cruz (Security Innovation) ===
 ''Workshop:''<br>
-''Coming soon!''<br>
+The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.
 <br>
 ''Bio:''<br>