OWASP Portland 2019 Training Day - Revision history

Bzhao: Updated Summit Security logo

2019-09-21T01:29:38Z

Updated Summit Security logo

Bzhao: Summit logo change

2019-09-20T20:18:22Z

Summit logo change

DavidQuiz: /* Sponsored by Kraken */

2019-08-17T18:08:03Z

‎Sponsored by Kraken

DavidQuiz: /* OWASP Top 10 / Juice Shop Hack Session */

2019-08-16T22:21:40Z

‎OWASP Top 10 / Juice Shop Hack Session

DavidQuiz: /* Container Security */

2019-08-15T19:39:44Z

‎Container Security

Bzhao at 18:19, 15 August 2019

2019-08-15T18:19:41Z

Bzhao at 17:22, 15 August 2019

2019-08-15T17:22:38Z

DavidQuiz: /* How to Register */

2019-08-15T16:40:07Z

‎How to Register

Bzhao: Minor change to Tim's session

2019-08-13T06:03:38Z

Minor change to Tim's session

Bzhao: Minor sponsorship logo add

2019-08-13T06:01:49Z

Minor sponsorship logo add

@@ Line 139: / Line 139: @@
 [[File:Daylight logo.png|link=https://thedaylightstudio.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:Kraken logo.png|link=https://www.kraken.com/en-us/features/security]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-[[File:Summit 2019.png]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+[[File:Summit Security logo 2019.png]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:ForgeRock logo.png|link=https://www.forgerock.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:WebMD logo.jpg|link=https://www.webmd.com/]]

@@ Line 139: / Line 139: @@
 [[File:Daylight logo.png|link=https://thedaylightstudio.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:Kraken logo.png|link=https://www.kraken.com/en-us/features/security]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-[[File:summit.png|link=http://summitinfosec.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+[[File:Summit 2019.png]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:ForgeRock logo.png|link=https://www.forgerock.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:WebMD logo.jpg|link=https://www.webmd.com/]]

@@ Line 56: / Line 56: @@
 Abstract: This session is meant for those new to OWASP Top Ten. We will go over the OWASP Top Ten - where it came from, what it’s good for, what are the top ten, etc. And illustrate the concepts in the OWASP Top Ten through another OWASP Flagship Project - The OWASP Juice Shop. This will be a hands on class so everyone can follow along in the Juice Shop to explore the concepts. There will be time at the end for everyone to continue on their vulnerability hunting and a friendly Juice Shop CTF.
-Bio: David Quisenberry (@AppSecQuiz) is a backend developer and security champion with Daylight Studio, a local Portland boutique web agency. He serves on the Portland OWASP board as Outreach/Events coordinator and does what he can to up the involvement of established and emerging software developers in security conversations.
+Bio: David Quisenberry (@QuizSec) is a backend developer and security champion with Daylight Studio, a local Portland boutique web agency. He serves on the Portland OWASP board as Outreach/Events coordinator and does what he can to up the involvement of established and emerging software developers in security conversations.
 Prerequisites: Laptop capable of running docker and burpsuite.

@@ Line 56: / Line 56: @@
 Abstract: This session is meant for those new to OWASP Top Ten. We will go over the OWASP Top Ten - where it came from, what it’s good for, what are the top ten, etc. And illustrate the concepts in the OWASP Top Ten through another OWASP Flagship Project - The OWASP Juice Shop. This will be a hands on class so everyone can follow along in the Juice Shop to explore the concepts. There will be time at the end for everyone to continue on their vulnerability hunting and a friendly Juice Shop CTF.
-Bio: David Quisenberry (@dmqpdx16) is a backend developer and security champion with Daylight Studio, a local Portland boutique web agency. He serves on the Portland OWASP board as Outreach/Events coordinator and does what he can to up the involvement of established and emerging software developers in security conversations.
+Bio: David Quisenberry (@AppSecQuiz) is a backend developer and security champion with Daylight Studio, a local Portland boutique web agency. He serves on the Portland OWASP board as Outreach/Events coordinator and does what he can to up the involvement of established and emerging software developers in security conversations.
 Prerequisites: Laptop capable of running docker and burpsuite.

@@ Line 96: / Line 96: @@
 # Navigating security in the container orchestration platforms (docker swarm, kubernetes)"
-Bio: Alex Ivkin (@alerxes) is a Director of Solutions at Eclypsium, a local Portland company, specializing in firmware, hardware and supply chain security. Alex has deep implementation experience in a long list of security domains, including cloud, application security and IAM. He co-authored the ISACA CSX Professional certification and is an alpine climber.
+Bio: Alex Ivkin (@alexivkinx) is a director of solutions at Eclypsium, a local Portland security company. Alex specializes in security solution architecture, advisory and implementation of firmware and application security, container orchestration and IAM. Alex presented at numerous
 Prerequisites:

@@ Line 31: / Line 31: @@
 === Applied Physical Attacks on Embedded Systems, Introductory Version ===
 ''Instructor: Joe FitzPatrick''
@@ Line 130: / Line 132: @@
 === Training Session Sponsors ===
 [[File:Cambia logo.png]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:Security Innovation logo.png|link=https://www.securityinnovation.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

← Older revision		Revision as of 17:22, 15 August 2019
Line 140:		Line 140:
	=== Morning Coffee Sponsors ===		=== Morning Coffee Sponsors ===

		+	[[File:OCI Logo.png\|link=https://cloud.oracle.com/en_US/iaas]]
	[[File:NetSPI 2019 logo.png\|link=https://www.netspi.com/]]		[[File:NetSPI 2019 logo.png\|link=https://www.netspi.com/]]

@@ Line 208: / Line 208: @@
 =How to Register=
-Registration will again be via EventBrite
+Registration will again be via [https://www.eventbrite.com/e/owasp-portland-2019-training-day-tickets-67270573095 EventBrite]
 Thank you to the OWASP Foundation and the many sponsors, trainers, volunteers and trainers that have helped make Training Day a success and allow us to continue!

@@ Line 181: / Line 181: @@
 |-
 | style="padding: 0.5em;" |1:30 PM - 5:00 PM
-| style="padding: 0.5em;" |Advanced Application Security Testing <br>(Timothy Morgan)
+| style="padding: 0.5em;" |Web Applications and Filesystem Security / Deserialization Attacks <br>(Timothy Morgan)
 | style="padding: 0.5em;" |Container Security <br>(Alex Ivkin)
 | style="padding: 0.5em;" |Intro to Chrome Exploitation <br>(Justin Angra)

@@ Line 13: / Line 13: @@
 === AWS API Threat Modeling and Automated Testing ===
 ''Instructor: Kendra Ash''
@@ Line 20: / Line 22: @@
 Takeaways:
-- Learn the basics of threat modeling
+Bio: Kendra Ash (@securelykash) is an information security engineer at Vacasa, actively building a security team and program by leveraging guidance from her network and industry standards. Co presenting is Ryan Nixon (@taiidani) an experienced DevOps engineer who deeply cares about the security of all applications. Constantly looking for ways to keep all server and application configurations in order with proper auditing & pipelines.
-Prerequisites:- no previous knowledge is required- this course is  for all levels and jobs (QA,  DevOps, Security and Software Engineer)
+Prerequisites: no previous knowledge is required, this course is for all levels and jobs (QA, DevOps, Security and Software Engineer)
 === Applied Physical Attacks on Embedded Systems, Introductory Version ===
@@ Line 70: / Line 69: @@
 Abstract: This course starts by exploring the security ramifications of filesystem semantics, security capabilities, and little known-features as they relate to web application development.  Students will practice file upload attacks against a intentionally-vulnerable web application.  Next, the course transitions to deserialization attacks, a recently added OWASP Top 10 item, using multiple practical examples to explain this tricky technical issue. Students will have an opportunity to try deserialization attacks in a realistic scenario.
-Learning Objectives
+Learning Objectives:
 * To better appreciate the ways modern filesystems work on different platforms and what security impacts may result from certain unintuitive behaviors
-<nowiki>*</nowiki> To better appreciate the ways modern filesystems work on different platforms and what security impacts may result from certain unintuitive behaviors
+* Explore the many challenges involved in safely processing file uploads
 * Learn about deserialization attacks and how to identify when an application might be at risk
-VirtualBox doesn't always play well with other pointing devices on Macs
+Prerequisites:
 === Container Security ===
@@ Line 143: / Line 130: @@
 === Training Session Sponsors ===
-[[File:ForgeRock logo.png|link=https://www.forgerock.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+[[File:Cambia logo.png]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:Security Innovation logo.png|link=https://www.securityinnovation.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:Daylight logo.png|link=https://thedaylightstudio.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:Kraken logo.png|link=https://www.kraken.com/en-us/features/security]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:summit.png|link=http://summitinfosec.com/]]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 [[File:WebMD logo.jpg|link=https://www.webmd.com/]]
@@ Line 157: / Line 145: @@
 [[File:Vacasa Logo .png|frameless|375x375px]]
 =Details=