Denver November 2006 meeting - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textliourolletor.com

2009-05-27T18:29:19Z

Reverting to last version not containing links to www.textliourolletor.com

Deleted user at 16:12, 22 May 2009

2009-05-22T16:12:05Z

Davidribyrne@yahoo.com: /* Original Meeting Announcement */

2006-11-20T20:51:48Z

‎Original Meeting Announcement

Davidribyrne@yahoo.com at 20:49, 20 November 2006

2006-11-20T20:49:25Z

Davidribyrne@yahoo.com at 20:49, 20 November 2006

2006-11-20T20:49:09Z

Davidribyrne@yahoo.com at 20:46, 20 November 2006

2006-11-20T20:46:05Z

Davidribyrne@yahoo.com at 20:45, 20 November 2006

2006-11-20T20:45:40Z

Davidribyrne@yahoo.com at 20:45, 20 November 2006

2006-11-20T20:45:24Z

Davidribyrne@yahoo.com at 20:45, 20 November 2006

2006-11-20T20:45:03Z

Davidribyrne@yahoo.com at 20:28, 20 November 2006

2006-11-20T20:28:56Z

New page

Minutes from the First Denver OWASP meeting, Wednesday November 15th, 2006
As promised, INS provided a conference room and projector for 12-15 people (THANKS INS!) This was much appreciated by the 35 or so folks who showed up (guess we'll be a little more diligent about RSVPing next time!)
Introductions took place around the room and it looks like about 20% of the folks are non-technical (sales, management, business, governance), 40% are in security operations (pen-testing, security ops consulting), 40% SDLC folks (developers, QA, testers), with one or two Project Managers thrown in for good measure.
David Byrne gave a slideshow on testing for common security flaws ([[Category:OWASP_Top_Ten_Project|OWASP Top Ten]]), followed by a discussion about what we want to accomplish as a chapter and what the topic for the next meeting ought to be. The final decision was captured on Andy Lewis's iBook, which unfortunately turned to slag in the middle of the meeting. The consensus was to do the following:
1. Start at the beginning - with requirements and use-cases.
2. Leverage existing technologies and methodologies such as Active Directory and the security features of .Net.
3. Position our developers for success - figure out how to test effectively and correlate security testing failures with where developers ought to go to check their code.
4. Position our testers/QA for success - figure out how to test effectively without unnecessary delays.
4. Position our business for success - ensure that compliance is also addressed in the 3 areas above.
6. Build the case that ties the above activities to actual business value.
7. Figure out how to market this stuff so that it's not entirely about dollars and cents.
So... on January 17th there will be a talk about integrating security into the SDLC. In the mean time, we'll see if we can kick off a few use-cases via email collaboration.
After the meeting we hoisted a pint or two at some Irish pub around the corner from INS and a good time was had by all.
Many thanks to Scott and Rachael of INS for hosting the first meeting!

== Original Meeting Announcement ==

The next OWASP meeting will be held on January 17th. One presentation will be on integrating security into the SDLC. We are also looking for a second technical presentation. The location will be announced soon.

The first OWASP meeting in Denver will be held at 6:30PM on November 15th. The presentation will be on web application testing methodology. The meeting will be held at INS offices near Belleview Ave & I-25. '''''Mapquest & Google are not accurate.'''''

7900 E. Union Avenue, Suite 930<br/>
Denver, CO 80237<br/>

* Take I-25 to the Belleview exit
* Turn East on Belleview Ave
* Drive 2 blocks to S. Ulster St.
* Turn North (left) on Ulster.
* Drive to the end of the block and turn West (left) into the INS parking lot. It is directly accross the street from McCormick & Schmick's Seafood Restaurant. If you reach Union, you've gone too far.

Call Richard Sekersky at 303-953-3407 if you need more directions.

[[Image:INS_Directions.png|INS Directions]]

← Older revision		Revision as of 18:29, 27 May 2009
Line 1:		Line 1:
−	~~http://www.textliourolletor.com~~
	Minutes from the First Denver OWASP meeting, Wednesday November 15th, 2006		Minutes from the First Denver OWASP meeting, Wednesday November 15th, 2006

← Older revision		Revision as of 16:12, 22 May 2009
Line 1:		Line 1:
		+	http://www.textliourolletor.com
	Minutes from the First Denver OWASP meeting, Wednesday November 15th, 2006		Minutes from the First Denver OWASP meeting, Wednesday November 15th, 2006

← Older revision		Revision as of 20:51, 20 November 2006
Line 30:		Line 30:

	== Original Meeting Announcement ==		== Original Meeting Announcement ==
−
−	The next OWASP meeting will be held on January 17th. One presentation will be on integrating security into the SDLC. We are also looking for a second technical presentation. The location will be announced soon.
−

	The first OWASP meeting in Denver will be held at 6:30PM on November 15th. The presentation will be on web application testing methodology. The meeting will be held at INS offices near Belleview Ave & I-25. '''''Mapquest & Google are not accurate.'''''		The first OWASP meeting in Denver will be held at 6:30PM on November 15th. The presentation will be on web application testing methodology. The meeting will be held at INS offices near Belleview Ave & I-25. '''''Mapquest & Google are not accurate.'''''

← Older revision		Revision as of 20:49, 20 November 2006
Line 5:		Line 5:
	Introductions took place around the room and it looks like about 20% of the folks are non-technical (sales, management, business, governance), 40% are in security operations (pen-testing, security ops consulting), 40% SDLC folks (developers, QA, testers), with one or two Project Managers thrown in for good measure.		Introductions took place around the room and it looks like about 20% of the folks are non-technical (sales, management, business, governance), 40% are in security operations (pen-testing, security ops consulting), 40% SDLC folks (developers, QA, testers), with one or two Project Managers thrown in for good measure.

−	David Byrne gave a [[Media:OWASP_Denver_Nov-06_presentation.ppt \| slideshow]]on testing for common security flaws ([[OWASP Top Ten Project\|OWASP Top Ten]]), followed by a discussion about what we want to accomplish as a chapter and what the topic for the next meeting ought to be. The final decision was captured on Andy Lewis's iBook, which unfortunately turned to slag in the middle of the meeting. The consensus was to do the following:	+	David Byrne gave a [[Media:OWASP_Denver_Nov-06_presentation.ppt\|slideshow]] on testing for common security flaws ([[OWASP Top Ten Project\|OWASP Top Ten]]), followed by a discussion about what we want to accomplish as a chapter and what the topic for the next meeting ought to be. The final decision was captured on Andy Lewis's iBook, which unfortunately turned to slag in the middle of the meeting. The consensus was to do the following:

← Older revision		Revision as of 20:49, 20 November 2006
Line 5:		Line 5:
	Introductions took place around the room and it looks like about 20% of the folks are non-technical (sales, management, business, governance), 40% are in security operations (pen-testing, security ops consulting), 40% SDLC folks (developers, QA, testers), with one or two Project Managers thrown in for good measure.		Introductions took place around the room and it looks like about 20% of the folks are non-technical (sales, management, business, governance), 40% are in security operations (pen-testing, security ops consulting), 40% SDLC folks (developers, QA, testers), with one or two Project Managers thrown in for good measure.

−	David Byrne gave a slideshow on testing for common security flaws ([[~~Category:OWASP_Top_Ten_Project~~\|OWASP Top Ten]]), followed by a discussion about what we want to accomplish as a chapter and what the topic for the next meeting ought to be. The final decision was captured on Andy Lewis's iBook, which unfortunately turned to slag in the middle of the meeting. The consensus was to do the following:	+	David Byrne gave a [[Media:OWASP_Denver_Nov-06_presentation.ppt \| slideshow]]on testing for common security flaws ([[OWASP Top Ten Project\|OWASP Top Ten]]), followed by a discussion about what we want to accomplish as a chapter and what the topic for the next meeting ought to be. The final decision was captured on Andy Lewis's iBook, which unfortunately turned to slag in the middle of the meeting. The consensus was to do the following:

← Older revision		Revision as of 20:46, 20 November 2006
Line 6:		Line 6:

	David Byrne gave a slideshow on testing for common security flaws ([[Category:OWASP_Top_Ten_Project\|OWASP Top Ten]]), followed by a discussion about what we want to accomplish as a chapter and what the topic for the next meeting ought to be. The final decision was captured on Andy Lewis's iBook, which unfortunately turned to slag in the middle of the meeting. The consensus was to do the following:		David Byrne gave a slideshow on testing for common security flaws ([[Category:OWASP_Top_Ten_Project\|OWASP Top Ten]]), followed by a discussion about what we want to accomplish as a chapter and what the topic for the next meeting ought to be. The final decision was captured on Andy Lewis's iBook, which unfortunately turned to slag in the middle of the meeting. The consensus was to do the following:
		+

	1. Start at the beginning - with requirements and use-cases.		1. Start at the beginning - with requirements and use-cases.

← Older revision		Revision as of 20:45, 20 November 2006
Line 20:		Line 20:

	7. Figure out how to market this stuff so that it's not entirely about dollars and cents.		7. Figure out how to market this stuff so that it's not entirely about dollars and cents.
		+

	So... on January 17th there will be a talk about integrating security into the SDLC. In the mean time, we'll see if we can kick off a few use-cases via email collaboration.		So... on January 17th there will be a talk about integrating security into the SDLC. In the mean time, we'll see if we can kick off a few use-cases via email collaboration.

@@ Line 8: / Line 8: @@
 . Start at the beginning - with requirements and use-cases.
 . Leverage existing technologies and methodologies such as Active Directory and the security features of .Net.
 . Position our developers for success - figure out how to test effectively and correlate security testing failures with where developers ought to go to check their code.
 . Position our testers/QA for success - figure out how to test effectively without unnecessary delays.
 . Position our business for success - ensure that compliance is also addressed in the 3 areas above.
 . Build the case that ties the above activities to actual business value.
 . Figure out how to market this stuff so that it's not entirely about dollars and cents.

@@ Line 1: / Line 1: @@
 Minutes from the First Denver OWASP meeting, Wednesday November 15th, 2006
 As promised, INS provided a conference room and projector for 12-15 people (THANKS INS!) This was much appreciated by the 35 or so folks who showed up (guess we'll be a little more diligent about RSVPing next time!)
 Introductions took place around the room and it looks like about 20% of the folks are non-technical (sales, management, business, governance), 40% are in security operations (pen-testing, security ops consulting), 40% SDLC folks (developers, QA, testers), with one or two Project Managers thrown in for good measure.
 David Byrne gave a slideshow on testing for common security flaws ([[Category:OWASP_Top_Ten_Project|OWASP Top Ten]]), followed by a discussion about what we want to accomplish as a chapter and what the topic for the next meeting ought to be. The final decision was captured on Andy Lewis's iBook, which unfortunately turned to slag in the middle of the meeting. The consensus was to do the following:
 . Start at the beginning - with requirements and use-cases.
 . Leverage existing technologies and methodologies such as Active Directory and the security features of .Net.
@@ Line 10: / Line 14: @@
 . Build the case that ties the above activities to actual business value.
 . Figure out how to market this stuff so that it's not entirely about dollars and cents.
 So... on January 17th there will be a talk about integrating security into the SDLC. In the mean time, we'll see if we can kick off a few use-cases via email collaboration.
 After the meeting we hoisted a pint or two at some Irish pub around the corner from INS and a good time was had by all.
 Many thanks to Scott and Rachael of INS for hosting the first meeting!