Dc: /* The Speaker: Chris Schmidt */

2010-05-22T17:04:52Z

‎The Speaker: Chris Schmidt

Dc: Created page with '==The Presentation: "Solving Real-World Problems with an Enterprise Security API (ESAPI)"== A great deal of work has gone into aggregating statistics and information about secu…'

2010-05-12T21:02:49Z

Created page with '==The Presentation: "Solving Real-World Problems with an Enterprise Security API (ESAPI)"== A great deal of work has gone into aggregating statistics and information about secu…'

New page

==The Presentation: "Solving Real-World Problems with an Enterprise Security API (ESAPI)"==

A great deal of work has gone into aggregating statistics and information about security vulnerabilities in enterprise applications on the internet. A lot of work has also been done in creating software libraries and secure coding guidelines to mitigate vulnerabilities. The OWASP group has created an ESAPI that is meant to act as a service provider of security to enterprise applications. There is a lot of documentation and resources available on what an ESAPI is, but there is not much information on how to actually implement an ESAPI to mitigate a specific set of vulnerabilities in an application. This presentation aims to provide information on how to use ESAPI to solve real-world security problems in a clear and interactive way. Using ESAPI for Java and Javascript I will demonstrate examples of vulnerabilities in simple web applications, describe the problem and solution, then fix the vulnerabilities. I will also discuss the importance of developing the ESAPI to fit the business needs of the application.

The presentation will use OWASP ESAPI configured with the reference implementations for Encoding/Decoding, Encryption, Logging, and Validation. For Authentication and Access Control a custom JAAS Implementation to show how easy it is to implement business specific implementations into the ESAPI framework.

==The Speaker: Chris Schmidt==

[http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2010#tab=Agenda Back to Conference Agenda]

@@ Line 7: / Line 7: @@
 ==The Speaker: Chris Schmidt==
+Chris Schmidt is a Software Engineer for ServiceMagic, in Golden, CO. He is also a core contributer on the OWASP ESAPI4Java Project and project owner of the OWASP ESAPI4JavaScript Project. Chris has 13 years experience in Information Technology as an Systems Engineer, Software Engineer, and Independent Application Security Consultant. He authors the Yet Another Developer's Blog and is in the process of writing his first book on Secure Development Practices centered around the core concepts of the ESAPI.
 [http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2010#tab=Agenda Back to Conference Agenda]

FROC2010 Abstract Schmidt - Revision history

Dc: /* The Speaker: Chris Schmidt */

Dc: Created page with '==The Presentation: "Solving Real-World Problems with an Enterprise Security API (ESAPI)"== A great deal of work has gone into aggregating statistics and information about secu…'