OWASP EU Summit 2008 Training - Revision history

Leocavallari at 20:21, 1 November 2008

2008-11-01T20:21:58Z

Manopaul: /* WebAppSec for Managers and Executives - The Road Less Travelled */

2008-10-25T22:41:03Z

‎WebAppSec for Managers and Executives - The Road Less Travelled

Manopaul: /* WebAppSec for Managers and Executives - The Road Less Travelled */

2008-10-25T22:37:45Z

‎WebAppSec for Managers and Executives - The Road Less Travelled

Sdeleersnyder at 18:10, 24 October 2008

2008-10-24T18:10:45Z

Puhley: /* Auditing Flash Applications */

2008-10-18T00:04:57Z

‎Auditing Flash Applications

Puhley: /* Flash Player Security */

2008-10-18T00:04:18Z

‎Flash Player Security

Lebbeous: /* How to Win AppSec Hacking Contests and Deploy Better Web Applications - instructors can't attend */

2008-10-17T16:05:06Z

‎How to Win AppSec Hacking Contests and Deploy Better Web Applications - instructors can't attend

Manopaul: /* WebAppSec for Managers and Executives - The Road Less Travelled */

2008-10-17T03:23:03Z

‎WebAppSec for Managers and Executives - The Road Less Travelled

Manopaul at 23:13, 13 October 2008

2008-10-13T23:13:28Z

Manopaul at 23:10, 13 October 2008

2008-10-13T23:10:26Z

← Older revision		Revision as of 20:21, 1 November 2008
Line 571:		Line 571:
	Bring your own laptop		Bring your own laptop

−
−
−	~~== Advanced Web Application Security Testing ==~~
−
−	~~'''Instructor'''~~
−
−	~~Michael Coates, Aspect Security~~
−
−	~~'''Duration'''~~
−
−	~~2 days.~~
−
−	~~'''Summary'''~~
−
−	While all developers need to know the basics of web application security testing, application security specialists will want to know all the advanced techniques for finding and diagnosing security problems in applications. Aspect’s Advanced Web Application Security Testing training is based on a decade of work verifying the security of critical applications. The course is taught by an experienced application security practitioner in an interactive manner.
−
−	~~'''Course Specifics'''~~
−
−	~~Bring your own Windows based laptop~~
−
−	~~== Building Secure Web 2.0 Applications ==~~
−
−	~~'''Instructor'''~~
−
−	~~Arshan Dabirsiaghi, Aspect Security~~
−
−	~~'''Duration'''~~
−
−	~~1 day.~~
−
−	~~'''Summary'''~~
−
−	Web 2.0 applications using technologies like Ajax, Flash, ActiveX, and Java Applets require special attention to secure. this one day training addresses the special issues that arise in this type of application development.
−
−	~~'''Course Specifics'''~~
−
−	~~Bring your own Windows based laptop~~
−
−	~~== Building Secure Web Services ==~~
−
−	~~'''Instructor'''~~
−
−	~~Dave Wichers, Aspect Security~~
−
−	~~'''Duration'''~~
−
−	~~2 days.~~
−
−	~~'''Summary'''~~
−
−	The movement towards Web Services and Service Oriented architecture (SOA) paradigms requires new security paradigms to deal with new risks posed by these architectures. this session takes a pragmatic approach towards identifying Web Services security risks and selecting and applying countermeasures to the application, code, web servers, databases, application, and identify servers and related software. Many enterprises are currently developing new Web Services and/or adding and acquiring Web Services functionality into existing applications -- now is the time to build security into the system.
−
−	~~'''Course Specifics'''~~
−
−	~~Bring your own Windows based laptop~~
−
−	~~== Building Secure Web Applications with OWASP's Enterprise Security API (ESAPI) ==~~
−
−	~~'''Instructor'''~~
−
−	~~Jeff Williams, Aspect Security~~
−
−	~~'''Duration'''~~
−
−	~~1 day.~~
−
−	~~'''Summary'''~~
−
−	This course will teach you about OWASP's new Enterprise Security API (ESAPI), what it is composed of, and how to use it to improve the security and reduce the cost of developing those applications. This class covers each interface within the API, how it is intended to be used, and what the benefits are of using this interface, over other techniques for addressing the same security concerns.
−
−	~~The course also discusses how to bring ESAPI into your organization and how to tailor it for your organization specific needs and application infrastructure.~~
−
−	~~'''Course Specifics'''~~
−
−	~~Bring your own Windows based laptop~~

	== Ajax Security ==		== Ajax Security ==

@@ Line 91: / Line 91: @@
 # Hiring and Staffing
 # Information Security Program Framework
 '''Course Specifics'''

@@ Line 29: / Line 29: @@
 '''Table of Contents'''
-.	Introduction
+# Introduction
+# Changing Landscape
-.	Changing Landscape
+# Drivers of Web Application Security (Exercise)
+## Method to the Madness
-.	Drivers of Web Application Security
+## Attackers Advantage vs. Defenders Dilemma
+# Stakeholders (Exercise)
-.	From the Boardroom to the Builder, Client to the Coder
+## Boardroom Questions
+## Business Aware IT Security (BAITS)
-.	Regulations, Compliance and Security
+# Regulations, Compliance and Security
+## SOX, GLBA, HIPAA ...
-.	Information Security Management Top 10
+## European Data Protection Directive
+## PCI DSS
-.      OWASP Top 10
+# Software Security Concepts
+## Design Principles (Saltzer & Schroeder)
-.	Software Security Concepts
+### Economy of Mechanisms
+### Fail Safe Defaults
-.	Security in the SDLC - Requirements to Release
+### Complete Mediation
+### Open Design
-.	Software Risk Management
+### Separation of Privilege
+### Least Privilege
-.	Data Classification
+### Least Common Mechanisms
+### Psychological Acceptability
-.	Common Web Application Threats and Vulnerabilities
+## Security Mechanisms (CIA+AAA+Mgmt)
+### Confidentiality
-.	Security in an Outsourced World
+### Integrity
+### Availability
-.	Web 2.0 Security
+### Authentication
+### Authorization
-.	Self Service Programs
+### Auditing
+### Management - Session, Exceptions, Configuration
-.	Awareness, Training, Education & Certification
+# Security in the SDLC - Requirements to Release
+## 7 Steps to securing applications
-.     Hiring and Staffing
+## SD4 - Secure by Default, Design, Development, and Deployment
+# Information Security Management Top 10 (real world stories and tips)
-.	Information Security Framework
+## Executive Sponsorship and Commitment
 '''Course Specifics'''

@@ Line 732: / Line 732: @@
 * Web Services Testing
 * Ajax Testing
 '''Course Specifics'''
 Bring your own laptop.

@@ Line 683: / Line 683: @@
 '''Instructor'''
-Peleus Uhley
+Peleus Uhley, Adobe Systems
 '''Duration'''
@@ Line 700: / Line 700: @@
 Please bring your own laptop with your choice of web browser installed if you wish to participate. Participation is optional.
 == Testing Guide Training ==

← Older revision		Revision as of 16:05, 17 October 2008
Line 506:		Line 506:
	Demos (including strategy and implementation) of the most interesting lesson solutions will be shown.		Demos (including strategy and implementation) of the most interesting lesson solutions will be shown.

−	~~== How to Win AppSec Hacking Contests and Deploy Better Web Applications ==~~

−	~~'''Instructors'''~~
−
−	~~Lann Martin and Lebbeous Fogle-Weekley - ''winners of the CTF contest at OWASP AppSec NYC '08''~~
−
−	~~'''Duration'''~~
−
−	~~4 hours~~
−
−	~~'''Summary'''~~
−
−	~~This class will demonstrate how an attacker approaches potentially~~
−	~~vulnerable web applications, taking advantage of both poor server~~
−	~~configuration and poor application implementation to discover and exploit~~
−	~~vulnerabilities of several types.~~
−
−	~~'''Audience'''~~
−
−	~~Web application developers and penetration testers of intermediate~~
−	~~skill.~~
−
−	~~'''Table of Contents'''~~
−
−	~~''This table of contents is a work in progress''~~
−	* The trouble with verbose error messages
−	* The right way and the wrong way to escape input to prevent SQL injection
−	* The right way and the wrong way to encode output to prevent XSS
−	* More bad practices to avoid
−	* More good practices to maintain
−
−	~~'''Course Specifics'''~~
−
−	~~Bring your own laptop to participate in attacks on sample~~
−	~~web applications. Firefox is the preferred browser for exploiting web~~
−	~~applications. Automated scanning tools are out of scope for this class.~~

	== Uncovering WebScarab's Secret Treasures ==		== Uncovering WebScarab's Secret Treasures ==

← Older revision		Revision as of 23:10, 13 October 2008
Line 6:		Line 6:

	Back to [[OWASP EU Summit 2008]]		Back to [[OWASP EU Summit 2008]]
		+
		+	== WebAppSec for Managers and Executives - The Road Less Travelled ==
		+
		+	'''Instructor'''
		+
		+	Mano Paul
		+
		+	'''Duration'''
		+
		+	1 day
		+
		+	'''Summary'''
		+
		+	With the financial turn tables of major corporations resting on web applications that connect businesses, transmit and store sensitive financial and personal transaction, combined with the ubiquitous nature of the web; it is imperative that web applications that are designed, architected and developed are secure.
		+
		+	What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowned poet, Robert Frost ends by with the statement "And that has made all the difference". Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective that would make ALL the difference for you and your company.
		+
		+	'''Audience'''
		+
		+	This session is for Management primarily and any stakeholder that needs to understand how understanding application security concepts can benefit their organizations/companies in designing secure web applications. Whether you are a novice or an expert, you will all leave learning something new to lead your teams and help design the next generation of hack-resilient web applications.
		+
		+	'''Table of Contents'''
		+
		+	1. Introduction
		+
		+	2. Changing Landscape
		+
		+	3. Drivers of Web Application Security
		+
		+	4. From the Boardroom to the Builder, Client to the Coder
		+
		+	5. Regulations, Compliance and Security
		+
		+	6. Information Security Management Top 10
		+
		+	7. OWASP Top 10
		+
		+	8. Software Security Concepts
		+
		+	9. Security in the SDLC - Requirements to Release
		+
		+	10. Software Risk Management
		+
		+	11. Data Classification
		+
		+	12. Common Web Application Threats and Vulnerabilities
		+
		+	13. Security in an Outsourced World
		+
		+	14. Web 2.0 Security
		+
		+	15. Self Service Programs
		+
		+	16. Awareness, Training, Education & Certification
		+
		+	17. Information Security Framework
		+
		+	'''Course Specifics'''
		+
		+	No specific requirement. Come for a fun, interactive session that will cover the basic and advanced elements of web application security for executives and managers - the road less travelled, filled with exercises for the attendees to participate.

	== The Art and Science of Threat Modeling Web Applications ==		== The Art and Science of Threat Modeling Web Applications ==