Sarah Baso at 02:47, 12 July 2011

2011-07-12T02:47:36Z

Sarah Baso: Created page with "== '''Topic: Gray, the new Black: Gray-Box Web Vulnerability Testing''' == ==='''Speaker: Brian Chess'''=== Brian Chess is a founder of Fortify Software, an HP company, andser..."

2011-07-12T02:40:19Z

Created page with "== '''Topic: Gray, the new Black: Gray-Box Web Vulnerability Testing''' == ==='''Speaker: Brian Chess'''=== Brian Chess is a founder of Fortify Software, an HP company, andser..."

New page

== '''Topic: Gray, the new Black: Gray-Box Web Vulnerability Testing''' ==

==='''Speaker: Brian Chess'''===

Brian Chess is a founder of Fortify Software, an HP company, andserves as Fortify’s Chief Scientist, where his work focuses on practical methods for creating secure systems. His book, Secure Programming with Static Analysis, shows how static source code analysis is an indispensable tool for getting security right.

Brian holds a Ph.D. in computer engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service.

==='''Abstract:'''===

Penetration testers who use only black-box tools are destined to lose to attackers who are willing to spend more time or effort looking for vulnerabilities. Defenders need to make use of one of the few natural advantages at their disposal: ready access to the system they’re trying to protect.

In this talk Brian will discuss gray-box vulnerability testing techniques that expose web application internals so that testers understand what an application is doing and can spot vulnerabilities faster. The tool observes the program while it executes. It reveals attack surface, points out vulnerable program behavior, opens up a code-level view of the application, and allows a tester to understand information flow inside the program.

=== '''Sponsor:''' ===

[[Image:SafenetLogo.jpg|link=http://www.safenet-inc.com/]]
<br>

@@ Line 8: / Line 8: @@
-==='''Abstract:'''===
+==='''Abstract: Gray, the new Black'''===
 Penetration testers who use only black-box tools are destined to lose to attackers who are willing to spend more time or effort looking for vulnerabilities.  Defenders need to make use of one of the few natural advantages at their disposal: ready access to the system they’re trying to protect.
@@ Line 15: / Line 15: @@
-=== '''Sponsor:'''  ===
+<b>[[Media:Gray,_the_new_black.pptx‎|View the slide deck from this presentation.]]</b>
 [[Image:SafenetLogo.jpg|link=http://www.safenet-inc.com/]]
 <br>

Los Angeles/2011 Meetings/June 22 - Revision history

Sarah Baso at 02:47, 12 July 2011

Sarah Baso: Created page with "== '''Topic: Gray, the new Black: Gray-Box Web Vulnerability Testing''' == ==='''Speaker: Brian Chess'''=== Brian Chess is a founder of Fortify Software, an HP company, andser..."