OWASP Israel 2011 Presentations - Revision history

Ofer Maor at 19:44, 7 September 2011

2011-09-07T19:44:29Z

Ofer Maor at 13:12, 7 September 2011

2011-09-07T13:12:42Z

Ofer Maor at 15:58, 30 August 2011

2011-08-30T15:58:20Z

Ofer Maor at 14:33, 21 August 2011

2011-08-21T14:33:41Z

Ofer Maor at 08:53, 17 August 2011

2011-08-17T08:53:02Z

Ofer Maor at 08:52, 17 August 2011

2011-08-17T08:52:08Z

Ofer Maor at 07:35, 17 August 2011

2011-08-17T07:35:47Z

Ofer Maor at 05:57, 17 August 2011

2011-08-17T05:57:02Z

Ofer Maor at 22:38, 16 August 2011

2011-08-16T22:38:31Z

Ofer Maor at 21:24, 16 August 2011

2011-08-16T21:24:39Z

@@ Line 250: / Line 250: @@
 <br>
-=== Hey, What’s your App is doing on my (Smart)Phone?  ===
+=== Hey, What’s your App doing on my (Smart)Phone?  ===
 '''''Shay Zalalichin, CTO, Comsec Consulting'''''

← Older revision		Revision as of 13:12, 7 September 2011
Line 61:		Line 61:

	<br>		<br>
		+
		+	Guy Bejerano, CSO of LivePerson (NASDAQ:LPSN), has 18 years of deep domain expertise in operational, application and network security, specializing in building security programs for global companies and cloud services.
		+
		+	Throughout his vast experience, he has led the Information Security branch and operations of the Israeli Air-Force, establishing their penetration testing unit. Guy has spent the last 4 years with LivePerson, leading the security of one of the world's largest cloud platforms and providing security for more than 1 billion web visits across the internet each month.
		+
		+	With expertise in real-time, network and application security, LivePerson is the preferred cloud vendor for many financial services, Telco and Hi-Tech organizations including Hewlett-Packard, IBM, Microsoft, Verizon, and PNC.
		+
		+	<br>

	=== All Your Mobile Applications Are Belong to Us ===		=== All Your Mobile Applications Are Belong to Us ===

@@ Line 204: / Line 204: @@
 <br>
-=== SDL for Agile===
+===Agile + SDL – Concepts and Misconceptions===
 '''''Avi Douglen, Independent Security Architect & Developer'''''
-'''''Nir Bergman, Senior Project Manager, HP Software'''''
+'''''Nir Bregman, Senior Project Manager, HP Software'''''
-Agile methodologies are growing in popularity as a way to make the development cycle more efficient and robust, however as everyone knows (sic) “Being Agile” is the anti-thesis of security…!
+Agile methodologies are growing in popularity as a way to make the development cycle more efficient and robust, by creating a lightweight lifecycle to ensure quick, adaptive development. Meanwhile organizations are using holistic Secure Development Lifecycle (SDL) to ensure that their applications are in fact secure, from the very beginning throughout every phase of development.
-On the other hand, organizations are looking for a holistic Security Development Lifecycle to ensure that their applications are in fact secure. Some solutions and ideas to help merge the apparently conflicting philosophies, and come up with “Agile Security”.
+Trying to merge lightweight Agile development with a heavyweight, Waterfall-like SDL process is doomed to failure – or is it? We will describe common misconceptions with regards both to Agile and SDL, how to overcome them and some tools to build a more secure, Agile lifecycle.
 <br>

@@ Line 207: / Line 207: @@
 '''''Avi Douglen, Independent Security Architect & Developer'''''
 Agile methodologies are growing in popularity as a way to make the development cycle more efficient and robust, however as everyone knows (sic) “Being Agile” is the anti-thesis of security…!
@@ Line 218: / Line 220: @@
 Avi Douglen, CISSP, is an independent security architect and developer, and provides freelance consulting expertise to high-level clients. Avi has over a dozen years experience in designing, developing and testing secure applications, and leading development teams in building secure products. He has worked with many different types of development organizations of all sizes, and implemented a secure development lifecycle in many of them. Currently Avi is busy with research and development about identity and access management.
 <br>

@@ Line 144: / Line 144: @@
 <br>
 <u>Speaker Bio</u>
 Adi Sharabani is in charge of the cross-Rational security strategy to improve the security of all Rational products. As part of his role, Adi is responsible for leading, designing and deploying overall security processes within the development groups of Rational. Previous to his current role, Adi used to head the IBM Rational Application Security Research, responsible for product and industry research activities that pertain to Web application security. Adi joined IBM through the acquisition of Watchfire, a market leader in web application security testing which is the origin of the AppScan product suite. Adi is also recognized as an IBM Master Inventor, in charge of many of the IBM inventions and patents in the field of web application security. Adi participates in various public boards such as OWASP IL, IBM Security Architecture board, and his works have been presented in many known conferences such as OWASP, BlackHat, RSA, Innovate and more. Adi’s presentations and keynotes are constantly being ranked as best presentations of most conferences he presents at. In addition to his roles at IBM, Adi also acts a high-school teacher, where he is proud to educate future generations.

@@ Line 132: / Line 132: @@
 <br>
-=== The Bank Job  ===
+=== The Bank Job  II===
 '''''Adi Sharabani, Cross-Rational Security Strategy and Architecture, IBM'''''
 <br>
-−
 = Track B =

@@ Line 10: / Line 10: @@
 The programmable web creates many challenges.  Even if the author of the composite applications detects application security issues within the supply chain, can a remedy and a change occur? Is the author even allowed to try and verify (hack) the provided public services, in order to verify its own obligations, and by that, exposing the provider to other opportunistic hackers?
-Consequently, there are many challenges:   what are the breaches potentials in a supply chain? Can a chain reaction of hacking occur? What “secured enough” supply chain means? At what level (IaaS, PaaS, BSaaS, SaaS) should we test the sub-services? Are we allowed to? What happens if we find an issue? How do we wrap security fences on top of a non-secured sub-services? What are the sub-contracted obligations that may be solved legally or financial wise? If a change occurs, what are the implications to the running connected systems? Should the sub-provider quality levels affect the consumer, or can the consumer impose security requirements on the provider? If there is a remedy plan, how can it be executed and verified, who will pay for the expenses? Who will manage the hardening project?
+Consequently, there are many challenges:   what are the potential breaches in a supply chain? Can a chain reaction of hacking occur? What does “secure enough” supply chain means? At what level (IaaS, PaaS, BSaaS, SaaS) should we test the sub-services? Are we allowed to? What happens if we find an issue? How do we wrap security fences on top of a non-secured sub-services? What are the sub-contracted obligations that may be solved legally or financial wise? If a change occurs, what are the implications to the running connected systems? Should the sub-provider quality levels affect the consumer, or can the consumer impose security requirements on the provider? If there is a remedy plan, how can it be executed and verified, who will pay for the expenses? Who will manage the hardening project?
 In this keynote, we will present the environment and its challenges, highlighting potential solutions, dilemmas or directions, all in order to generate an open Q&A discussion with the forum.

@@ Line 231: / Line 231: @@
 === Hey, What’s your App is doing on my (Smart)Phone?  ===
-'''''Shay Zalalichin, CTO, Comsec'''''
+'''''Shay Zalalichin, CTO, Comsec Consulting'''''
 Smartphones have come a long way since they were only “smart” telephone devices capable of sending text and allowing email and Internet access. Nowadays, smartphones serve a key role in our personal and business life by providing a strong platform for fast information access,  location based experience, unlimited communication channels and a strong applications and games platform to just name a few.

@@ Line 223: / Line 223: @@
 <u>Speaker Bio</u>
-Some men are born with a silver spoon in their mouth; Chilik was born with an RJ45. With nearly a decade of practical hands-on innovative security research and exploitation, Chilik is always into security research development and testing. In his vast security experience Chilik had led major cooperatives with development security efforts throughout product life cycle. Among of his expertise are secure design, development, research and testing of new cutting-edge technologies.
+Chilik is an Information security architect at Appsec-labs. With nearly a decade of practical hands-on innovative security research and exploitation, Chilik is always into security research development and testing. In his vast security experience Chilik had led major cooperatives with development security efforts throughout product life cycle. Among of his expertise are secure design, development, research and testing of new cutting-edge technologies.
 In his latest research Chilik has developed a new approach in attacking binary protocols and has written a proprietary tool to automate the process.

@@ Line 124: / Line 124: @@
 <br>
 Ofer Shezaf is an internationally recognized application security expert. He is currently serving as a lead security researcher and architect at HP Fortify. Ofer is an OWASP (Open Web Application Security Project) leader and the founder of the OWASP Israeli chapter as well as a WASC (Web Application Security Consortium) officer. Some of the open source and industry projects Ofer has led are the ModSecurity core rule set, WASC web hacking incident database and the Web Application Firewall Evaluation criteria project.
@@ Line 130: / Line 131: @@
 <br>
 === The Bank Job  ===