Royal Holloway - Revision history

Nwhysel at 22:59, 10 July 2015

2015-07-10T22:59:38Z

Dennis Groves: update for December

2012-12-03T12:13:34Z

update for December

Dennis Groves: Link to ([https://www.owasp.org/index.php/User:Tgondrom Tobias Gondrom])

2012-10-15T16:19:36Z

Link to ([https://www.owasp.org/index.php/User:Tgondrom Tobias Gondrom])

Dennis Groves: Links to OWASP user biographies for names.

2012-10-15T16:16:24Z

Links to OWASP user biographies for names.

Dennis Groves: General Cleanup

2012-10-15T16:08:31Z

General Cleanup

Dennis Groves: tweeks for headertabs

2012-09-29T23:39:52Z

tweeks for headertabs

Dennis Groves: NOTOC

2012-09-29T23:37:40Z

__NOTOC__

Dennis Groves at 23:37, 29 September 2012

2012-09-29T23:37:01Z

Dennis Groves: /* Thurs 6 Sep 6:30-9pm */

2012-08-20T11:37:29Z

‎Thurs 6 Sep 6:30-9pm

Dennis Groves: /* Next Meeting/Event(s) */

2012-08-20T11:37:19Z

‎Next Meeting/Event(s)

@@ Line 1: / Line 1: @@
 __NOTOC__
 = Welcome =
-{{Chapter Template|chaptername=Royal Holloway University of London|extra=The chapter leaders are [mailto:Dennis.Groves@owasp.org Dennis Groves] and [mailto:Dinis.Cruz@owasp.org Dinis Cruz].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-royalholloway|emailarchives=http://lists.owasp.org/pipermail/owasp-royalholloway}}
+{{Chapter Template|chaptername=Royal Holloway University of London|extra=The chapter leader position is OPEN.|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-royalholloway|emailarchives=http://lists.owasp.org/pipermail/owasp-royalholloway}}
 = Next Event =

@@ Line 6: / Line 6: @@
 = Next Event =
-'''Talks''':
+=== Thurs 6 Dec 6:30-9pm ===
-'''Speakers''':
+OWASP Winter Holiday Social @ Crosslands in the Founder's Building, near reception.
 '''Meeting Location''':
@@ Line 21: / Line 17: @@
 Everyone is welcome to join us at our chapter meetings.
 = Future Events =
-=== Thurs 6 Dec 6:30-9pm ===
 '''Talks''':
@@ Line 30: / Line 28: @@
 = Past Events =
 === Thurs 10 May 6:30-9pm ===

@@ Line 47: / Line 47: @@
 :Abstract: Cryptography is being widely implemented in software to provide security features. The main reason is that, many cryptographic mechanisms are mathematically proven secure, or trusted secure given some mathematical reasoning. However, to take full advantages of these mechanisms, they must be implemented strictly according to the theoretical models, e.g., several cryptographic mechanisms must be used together, in a specific manner to provide a desired security goal. However, without strong cryptographic background, many software developers tend to deviate from these models, thus making their own security software a gold mine for attackers. This talk gives examples to show why such situations exist, where do they spread, and how bad they may turn into.
-*''Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and and Pinning of Certs - Tobias Gondrom ([[http://www.gondrom.org/owasp/presentations/OWASP_defending-MITMA_RHUL.pdf PDF]])
+*''Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and and Pinning of Certs - ([https://www.owasp.org/index.php/User:Tgondrom Tobias Gondrom]) ([[http://www.gondrom.org/owasp/presentations/OWASP_defending-MITMA_RHUL.pdf PDF]])
 :"In the recent months major trusted CAs providing trusted certificates for SSL/TLS in browser scenarios were compromised (e.g. seen in the Diginotar breach) and based on the current trust models (trusting all registered CAs equally for all domains) exposed vital web applications to the risk of man-in-the-middle attacks. Several approaches are currently discussed to mitigate this risk. The most advanced and closest to final adoption being the technologies discussed by the browser vendors at the recent IETF meeting in November in Taipei: HSTS and pinning of certificates. To better protect content providers against the distribution of bogus certificates, an HTTP header extension containing a fingerprint of their certificates linked to a domain address has been defined. This approach, which has been partly tested in Chrome, and already helped identify and protect to some extend Google's web application in the recent Diginotar compromise. Chrome users were able to detect the bogus DigiNotar certificates because Chrome had embedded the hashes of valid Google certificates. Back in July, the hacked DigiNotar certificate authority (CA), which has since gone out of business, was used to issue more than five hundred bogus certificates for companies including Google and various intelligence services."
 '''Speakers''':
-Tobias Gondrom, Viet Pham
+([https://www.owasp.org/index.php/User:Tgondrom Tobias Gondrom]), Viet Pham
 === Thursday, February 2nd 2012 ,18:30-21:00 ===

@@ Line 36: / Line 36: @@
 * [http://www.websecurify.com WebScurify] - Petko Petkov (pdp)
 * Your Digital Exhaust: How your online habits might cause more damage than you realised. - Daniel Cuthbert
-* [http://diniscruz.blogspot.co.uk/2012/04/making-security-invisible-by-becoming.html Making Security Invisible by Becoming the Developer's Best Friends] - Dinis
+* [http://diniscruz.blogspot.co.uk/2012/04/making-security-invisible-by-becoming.html Making Security Invisible by Becoming the Developer's Best Friends] - ([https://www.owasp.org/index.php/User:Dinis_Cruz Dinis Cruz])
 '''Speakers''':
-Daniel Cuthbert, Petko Petkov, Dinis Cruz,
+Daniel Cuthbert, Petko Petkov, ([https://www.owasp.org/index.php/User:Dinis_Cruz Dinis Cruz])
 === Thursday, March 8th 2012, 18:30-21:00 (Royal Holloway) ===
@@ Line 57: / Line 57: @@
 '''Talks''':
-*''Security as Pollution (lessons learned)'' - Dinis Cruz
+*''Security as Pollution (lessons learned)'' - ([https://www.owasp.org/index.php/User:Dinis_Cruz Dinis Cruz])
 *:Based on David Rice's "Upon the Threshold of Opportunity" presentation at the OWASP AppSec USA 2010
-*''Making Security Invisible by Becoming the Developer's Best Friends'' - Dinis Cruz
+*''Making Security Invisible by Becoming the Developer's Best Friends'' - ([https://www.owasp.org/index.php/User:Dinis_Cruz Dinis Cruz])
 *:Based on Dinis' presentation at OWASP AppSec Brazil 2011
-*''How to get a job in AppSec by Hacking and fixing TeamMentor'' - Dinis Cruz and Dennis Groves
+*''How to get a job in AppSec by Hacking and fixing TeamMentor'' - ([https://www.owasp.org/index.php/User:Dinis_Cruz Dinis Cruz]) and ([https://www.owasp.org/index.php/User:Dennis_Groves Dennis Groves])
 *:This is for students and developers who want to get into the application security space and need to have/show real-world experience.
-*''What's Happening on OWASP Today'' - Sarah Baso
+*''What's Happening on OWASP Today'' - ([https://www.owasp.org/index.php/User:Sarah_Baso Sarah Baso])
 *:This is an overview of the multiple activities that are currently happening around the world at OWASP presented by one of OWASP's employees currently focused on logistics, community and empowerment
 '''Speakers''':
-Sarah Baso, Dinis Cruz, Dennis Groves
+([https://www.owasp.org/index.php/User:Sarah_Baso Sarah Baso]), ([https://www.owasp.org/index.php/User:Dinis_Cruz Dinis Cruz]), ([https://www.owasp.org/index.php/User:Dennis_Groves Dennis Groves])
 === Thursday, September 8th 2011 ===

@@ Line 4: / Line 4: @@
 {{Chapter Template|chaptername=Royal Holloway University of London|extra=The chapter leaders are [mailto:Dennis.Groves@owasp.org Dennis Groves] and [mailto:Dinis.Cruz@owasp.org Dinis Cruz].|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-royalholloway|emailarchives=http://lists.owasp.org/pipermail/owasp-royalholloway}}
-= Local News =
+= Next Event =
-'''Meeting Location'''
+=== Thurs 8 Nov 6:30-9pm ===
 * DoS Mitigation - Christiaan Ehlers
 * Confessions of A PCI Consultant & IPADS - Ken Ferris
-= Future Events =
+'''Speakers''':
-=== Thurs 11 Oct 6:30-9pm ===
+'''Meeting Location''':
-'''Location''': Royal Holloway University of London, Bourne Lecture Theatre 2, Egham Hill, Egham, TW20 0EX
+Royal Holloway University of London, Bourne Lecture Theatre 2, Egham Hill, Egham, TW20 0EX
-'''Speakers''':
+Directions to Royal Holloway and a Campus Plan are available from the following [http://www.rhul.ac.uk/aboutus/locationmap/home.aspx website] (Bourne LT 2 is in building 31 on the Campus Plan).
-=== Thurs 8 Nov 6:30-9pm ===
+Everyone is welcome to join us at our chapter meetings.
-'''Speakers''':
+= Future Events =
 === Thurs 6 Dec 6:30-9pm ===
 '''Speakers''':
@@ Line 42: / Line 33: @@
 === Thurs 10 May 6:30-9pm ===
-'''Location''': Royal Holloway University of London, Bourne Lecture Theatre 2, Egham Hill, Egham, TW20 0EX
+'''Talks''':
 * [http://www.websecurify.com WebScurify] - Petko Petkov (pdp)
 * Your Digital Exhaust: How your online habits might cause more damage than you realised. - Daniel Cuthbert
 * [http://diniscruz.blogspot.co.uk/2012/04/making-security-invisible-by-becoming.html Making Security Invisible by Becoming the Developer's Best Friends] - Dinis
 '''Speakers''':
-'''Speakers''': Daniel Cuthbert, Petko Petkov, Dinis Cruz,
+Daniel Cuthbert, Petko Petkov, Dinis Cruz,
 === Thursday, March 8th 2012, 18:30-21:00 (Royal Holloway) ===
-==== Location ====
+'''Talks''':
 *''Implementing cryptography: good theory vs. bad practice - Viet Pham ([[https://www.owasp.org/images/c/c5/OwaspTalkMarch.pdf PDF]])
 :Abstract: Cryptography is being widely implemented in software to provide security features. The main reason is that, many cryptographic mechanisms are mathematically proven secure, or trusted secure given some mathematical reasoning. However, to take full advantages of these mechanisms, they must be implemented strictly according to the theoretical models, e.g., several cryptographic mechanisms must be used together, in a specific manner to provide a desired security goal. However, without strong cryptographic background, many software developers tend to deviate from these models, thus making their own security software a gold mine for attackers. This talk gives examples to show why such situations exist, where do they spread, and how bad they may turn into.
@@ Line 66: / Line 50: @@
 :"In the recent months major trusted CAs providing trusted certificates for SSL/TLS in browser scenarios were compromised (e.g. seen in the Diginotar breach) and based on the current trust models (trusting all registered CAs equally for all domains) exposed vital web applications to the risk of man-in-the-middle attacks. Several approaches are currently discussed to mitigate this risk. The most advanced and closest to final adoption being the technologies discussed by the browser vendors at the recent IETF meeting in November in Taipei: HSTS and pinning of certificates. To better protect content providers against the distribution of bogus certificates, an HTTP header extension containing a fingerprint of their certificates linked to a domain address has been defined. This approach, which has been partly tested in Chrome, and already helped identify and protect to some extend Google's web application in the recent Diginotar compromise. Chrome users were able to detect the bogus DigiNotar certificates because Chrome had embedded the hashes of valid Google certificates. Back in July, the hacked DigiNotar certificate authority (CA), which has since gone out of business, was used to issue more than five hundred bogus certificates for companies including Google and various intelligence services."
 Tobias Gondrom, Viet Pham
 === Thursday, February 2nd 2012 ,18:30-21:00 ===
-'''Location''': Royal Holloway University of London, Bourne Lecture Theatre 2, Egham Hill, Egham, TW20 0EX
+'''Talks''':
 *''Security as Pollution (lessons learned)'' - Dinis Cruz
 *:Based on David Rice's "Upon the Threshold of Opportunity" presentation at the OWASP AppSec USA 2010
@@ Line 88: / Line 68: @@
 *''What's Happening on OWASP Today'' - Sarah Baso
 *:This is an overview of the multiple activities that are currently happening around the world at OWASP presented by one of OWASP's employees currently focused on logistics, community and empowerment
 === Thursday, September 8th 2011 ===
-'''Location''': Royal Holloway University of London, Bourne Lecture Theatre 2, Egham Hill, Egham, TW20 0EX
+'''Talk''':
+Doing it for the Lulz: Why Lulzsec has shown us to be an ineffective industry.
-'''Title''': Doing it for the Lulz: Why Lulzsec has shown us to be an
+'''Speaker''':
-ineffective industry.
+Daniel Cuthbert ([http://prezi.com/ylfkkek0vb-r/all-aboard-the-lulz-boat/ deck])
 '''Bio''':  Daniel Cuthbert is one of the Open Web Application Security
@@ Line 104: / Line 86: @@
 the development life cycle is secure and the overall application can
 withstand today’s hackers.
 === Friday, June 3rd 2011 ===
-'''Location''': Royal Holloway University of London, Room BLT2, Egham Hill, Egham, TW20 0EX
+'''Speaker''': Steve Lord
 <headertabs />

← Older revision		Revision as of 23:37, 29 September 2012
Line 1:		Line 1:
		+	__NOTOC__
		+
	{{Chapter Template\|chaptername=Royal Holloway University of London\|extra=The chapter leaders are [mailto:Dennis.Groves@owasp.org Dennis Groves] and [mailto:Dinis.Cruz@owasp.org Dinis Cruz].\|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-royalholloway\|emailarchives=http://lists.owasp.org/pipermail/owasp-royalholloway}}		{{Chapter Template\|chaptername=Royal Holloway University of London\|extra=The chapter leaders are [mailto:Dennis.Groves@owasp.org Dennis Groves] and [mailto:Dinis.Cruz@owasp.org Dinis Cruz].\|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-royalholloway\|emailarchives=http://lists.owasp.org/pipermail/owasp-royalholloway}}

@@ Line 111: / Line 111: @@
 *:Wordpress is one if the most popular blogging systems in the world but is routinely used to shoehorn complex sites into a blog shaped box, often because of it's flexibility and ease of use. In this talk, Mandalorian's Steve Lord discusses common Wordpress security snafus and how to avoid them.
 [[Category:OWASP Chapter]]
 [[Category:United Kingdom]]

← Older revision		Revision as of 11:37, 20 August 2012
Line 19:		Line 19:

	== Future Events ==		== Future Events ==
−
−	~~=== Thurs 6 Sep 6:30-9pm ===~~
−	~~'''Location''': Royal Holloway University of London, Bourne Lecture Theatre 2, Egham Hill, Egham, TW20 0EX~~
−
−	~~'''Speakers''': Christiaan Ehlers, Ken Ferris~~
−
−	* DoS Mitigation - Christiaan Ehlers
−	* Confessions of A PCI Consultant & IPADS - Ken Ferris

	=== Thurs 11 Oct 6:30-9pm ===		=== Thurs 11 Oct 6:30-9pm ===

← Older revision		Revision as of 11:37, 20 August 2012
Line 9:		Line 9:

	== Next Meeting/Event(s) ==		== Next Meeting/Event(s) ==
		+
		+	=== Thurs 6 Sep 6:30-9pm ===
		+	'''Location''': Royal Holloway University of London, Bourne Lecture Theatre 2, Egham Hill, Egham, TW20 0EX
		+
		+	'''Speakers''': Christiaan Ehlers, Ken Ferris
		+
		+	* DoS Mitigation - Christiaan Ehlers
		+	* Confessions of A PCI Consultant & IPADS - Ken Ferris

	== Future Events ==		== Future Events ==