This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Summit 2011 Outcomes"
Sarah Baso (talk | contribs) |
Sarah Baso (talk | contribs) m |
||
| Line 4: | Line 4: | ||
| − | ==Press Release== | + | ==Press Release & Media Mentions== |
*[[Summit_2011/Summit_Results_Summary|Global Summit 2011 Press Release & Results Summary]] ([http://www.owasp.org/images/2/27/OWASP_Summit_2011_Results.pdf View PDF Format])([http://www.owasp.org/images/5/54/OWASP_Summit_2011_Results.docx View Word Format]) | *[[Summit_2011/Summit_Results_Summary|Global Summit 2011 Press Release & Results Summary]] ([http://www.owasp.org/images/2/27/OWASP_Summit_2011_Results.pdf View PDF Format])([http://www.owasp.org/images/5/54/OWASP_Summit_2011_Results.docx View Word Format]) | ||
| Line 10: | Line 10: | ||
| + | ==Summit Background== | ||
| − | ===Appendix: Working Session Details and Documentation | + | |
| + | ==2011 Summit Finances & Budget== | ||
| + | *Breakdown of 2011 Summit Budget, Operational and Travel <br/> | ||
| + | Summit 2011 Financials [https://spreadsheets.google.com/ccc?key=0ApZ9zE0hx0LNdFBXS3k3aGdSdTYwQ2dfbmhjaEdUTEE&hl=en Summary of Expenses and Income] and [https://spreadsheets.google.com/a/owasp.org/ccc?key=0ApZ9zE0hx0LNdGJuVDlCU2xaUm9sc2pGMFEydXhYVWc&hl=en#gid=0 Summit Travel and Accommodations Costs] | ||
| + | |||
| + | *Comparison to 2008 Summit Budget | ||
| + | *Projection of costs needed for future Summit | ||
| + | |||
| + | |||
| + | ==2011 Summit Lessons Learned== | ||
| + | |||
| + | |||
| + | ==Appendix: Working Session Details and Documentation== | ||
===Browser Security=== | ===Browser Security=== | ||
| Line 17: | Line 30: | ||
[http://www.owasp.org/images/6/6d/OWASPSummit2011SiteSecurityPolicyBrowserSecurityTrack.pdf Site Security Policy notes (pdf)]<br> | [http://www.owasp.org/images/6/6d/OWASPSummit2011SiteSecurityPolicyBrowserSecurityTrack.pdf Site Security Policy notes (pdf)]<br> | ||
| + | |||
[http://www.owasp.org/images/0/06/OWASPSummit2011DOMSandboxingBrowserSecurityTrack.pdf DOM Sandboxing notes (pdf)]<br> | [http://www.owasp.org/images/0/06/OWASPSummit2011DOMSandboxingBrowserSecurityTrack.pdf DOM Sandboxing notes (pdf)]<br> | ||
| + | |||
[http://www.owasp.org/images/c/cd/OWASPSummit2011HTML5SecurityBrowserSecurityTrack.pdf HTML5 Security notes (pdf)]<br> | [http://www.owasp.org/images/c/cd/OWASPSummit2011HTML5SecurityBrowserSecurityTrack.pdf HTML5 Security notes (pdf)]<br> | ||
| + | |||
[http://www.owasp.org/images/f/f7/OWASPSummit2011EcmaScript5SecurityBrowserSecurityTrack.pdf EcmaScript 5 Security notes (pdf)]<br> | [http://www.owasp.org/images/f/f7/OWASPSummit2011EcmaScript5SecurityBrowserSecurityTrack.pdf EcmaScript 5 Security notes (pdf)]<br> | ||
| + | |||
[http://www.owasp.org/images/f/f7/OWASPSummit2011EnduserWarningsBrowserSecurityTrack.pdf Enduser Warnings notes (pdf)] | [http://www.owasp.org/images/f/f7/OWASPSummit2011EnduserWarningsBrowserSecurityTrack.pdf Enduser Warnings notes (pdf)] | ||
| Line 25: | Line 42: | ||
===XSS Eradication=== | ===XSS Eradication=== | ||
XSS and the Frameworks (Justin Clarke)<br> | XSS and the Frameworks (Justin Clarke)<br> | ||
| + | |||
XSS - Awareness, Resources, and Partnerships (Justin Clarke)<br> | XSS - Awareness, Resources, and Partnerships (Justin Clarke)<br> | ||
| + | |||
WAF Mitigation for XSS (Ryan Barnett)<br> | WAF Mitigation for XSS (Ryan Barnett)<br> | ||
| Line 66: | Line 85: | ||
===Secure Coding Workshop=== | ===Secure Coding Workshop=== | ||
OWASP Secure Coding Practices (Keith Turpin)<br> | OWASP Secure Coding Practices (Keith Turpin)<br> | ||
| + | |||
Protecting Information Stored Client-Side (John Steven)<br> | Protecting Information Stored Client-Side (John Steven)<br> | ||
| + | |||
Providing Access to Persisted Data (Dan Cornell)<br> | Providing Access to Persisted Data (Dan Cornell)<br> | ||
| + | |||
Contextual Ourput Encoding (Chris Schmidt)<br> | Contextual Ourput Encoding (Chris Schmidt)<br> | ||
| + | |||
ESAPI-CORE (Jim Manico)<br> | ESAPI-CORE (Jim Manico)<br> | ||
| + | |||
Applying ESAPI input Validation (Chris Schmidt)<br> | Applying ESAPI input Validation (Chris Schmidt)<br> | ||
| + | |||
Defining AppSensor Detection Points (Michael Coates)<br> | Defining AppSensor Detection Points (Michael Coates)<br> | ||
| + | |||
Secure Development Guidelines for Smartphone Developers (Giles Hogben)<br> | Secure Development Guidelines for Smartphone Developers (Giles Hogben)<br> | ||
| Line 138: | Line 164: | ||
Industry - Banking/Finance (Joe Bernik & Lorna Alamri)<br> | Industry - Banking/Finance (Joe Bernik & Lorna Alamri)<br> | ||
| + | |||
===Miscellaneous=== | ===Miscellaneous=== | ||
| − | |||
Privacy - Personal Data/PII, Legislation and OWASP (Colin Watson) - [https://docs.google.com/document/d/1iemUPPunBlWC7rBCALirPLN662rdYHQPPCerDzKIO6c/edit?hl=en_US&authkey=CLmG9nQ Working Session Notes]<br> | Privacy - Personal Data/PII, Legislation and OWASP (Colin Watson) - [https://docs.google.com/document/d/1iemUPPunBlWC7rBCALirPLN662rdYHQPPCerDzKIO6c/edit?hl=en_US&authkey=CLmG9nQ Working Session Notes]<br> | ||
| Line 152: | Line 178: | ||
| − | ==Summit | + | ==Summit Team & Attendee Bios== |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
===Support Staff Bios=== | ===Support Staff Bios=== | ||
| Line 185: | Line 186: | ||
===Attendee Bios=== | ===Attendee Bios=== | ||
* [[Media: Attendee_Bios_for_Outcomes_-_Participants.pdf|Summit Participant Bios]] | * [[Media: Attendee_Bios_for_Outcomes_-_Participants.pdf|Summit Participant Bios]] | ||
| + | |||
| + | |||
| + | ==Summit-Related Blog Posts== | ||
Revision as of 15:24, 23 June 2011
Global Summit 2011 Outcomes - please note that this is a work in progress. If you have any comments, corrections, or questions please contact Sarah Baso
Table of Contents
Press Release & Media Mentions
Summit Background
2011 Summit Finances & Budget
- Breakdown of 2011 Summit Budget, Operational and Travel
Summit 2011 Financials Summary of Expenses and Income and Summit Travel and Accommodations Costs
- Comparison to 2008 Summit Budget
- Projection of costs needed for future Summit
2011 Summit Lessons Learned
Appendix: Working Session Details and Documentation
Browser Security
Here are the notes from all the four browser security sessions. John Wilander is working on a Browser Security Report building on these sessions.
Site Security Policy notes (pdf)
EcmaScript 5 Security notes (pdf)
XSS Eradication
XSS and the Frameworks (Justin Clarke)
XSS - Awareness, Resources, and Partnerships (Justin Clarke)
WAF Mitigation for XSS (Ryan Barnett)
Metrics
Risk Metrics (Chris Wysopal) & Metrics and Labeling (Chris Eng) - Working Session Transcripts
Counting and Scoring Application Security Defects (Chris Eng & Chris Wysopal)
Formal Risk Assessment Methods (Benjamin Tomhave)
Common Structure and Guide for All Guides (Keith Turpin, Matteo Meucci, Vishal Garg)
Mitigation
Virtual Patching Best Practices (Ryan Barnett) - Working Session Notes
Scaling Web Application Security Testing (Arian Evans & Dinis Cruz)
Microsoft’s SDL in 16 Steps (and lessons learned) (Jeremy Dallman)
University, Education, and Training
OWASP Education Project (Martin Knobloch)
OWASP Training (Sandra Paiva) - Working Session Notes
University Outreach - OWASP Academies (Sandra Paiva) - Working Session Notes, OWASP Academy Portal Project
OWASP Top 10 Online Training in Hacking-Lab (Ivan Buetler)
University Outreach - OWASP College Chapter Program (Martin Knobloch) (renamed "OWASP Student Chapters Program")
OWASP Exams (Jason Taylor)
OWASP Certification (Jason Taylor & Jason Li) - Certification Code of Conduct Draft
Secure Coding Workshop
OWASP Secure Coding Practices (Keith Turpin)
Protecting Information Stored Client-Side (John Steven)
Providing Access to Persisted Data (Dan Cornell)
Contextual Ourput Encoding (Chris Schmidt)
ESAPI-CORE (Jim Manico)
Applying ESAPI input Validation (Chris Schmidt)
Defining AppSensor Detection Points (Michael Coates)
Secure Development Guidelines for Smartphone Developers (Giles Hogben)
Individual OWASP Projects
Enterprise Web Defense Roundtable (Michael Coates & Chris Lyon)
Threat Modeling (Anurag Agarwal)
OWASP Common Vulnerability List (Meucci/Keary/Agarwal) - CVL ppt presentation created by Matteo Meucci]
Common Structure and Numbering for All Guides (Keith Turpin/Matteo Meucci/Vishal Garg)
OWASP Testing Guide (Matteo Meucci) - Working Session Notes, Planning the OWASP Testing Guide 4.0 ppt presentation
OWASP Mobile Security Project (Mike Zusman) - Working Session Notes
Development Guide (Vishal Garg)
Application Security Verification Standard (ASVS) Project (Dave Wichers)
OWASP Portuguese Language Project (Lucas Ferriera)
OWASP Hackademic Challenges Project (Kostas & Vasileros Vlachos)
OWASP Java Project (Lucas Ferriera)
OpenSAMM (Pravir Chandra)
The Future of OpenSAMM (Pravir Chandra)
Vulnerability Disclosure Policies (Chris Schmidt)
O2 Platform (Dinis Cruz)
OWASP Governance and Committees
Global Education Committee (Martin Knobloch)
Global Industry Committee - Industry Outreach (Eoin Keary & Colin Watson)
Global Projects Committee (Jason Li & Brad Causey)
Global Membership Committee (Dan Cornell)
Global Chapters Committee (Seba Deleersnyder)
Global Conferences Committee (Mark Bristow)
Government Outreach (Doug Wilson)
OWASP Funding and CEO Discussion (Keith Turpin) Working Session Notes
OWASP Board/Committee Governance (Mark Bristow)
OWASP Points - Tracking OWASP Participation (Mark Bristow)
OWASP Licensing (Abraham Kang) - Working Session Notes, OWASP Licensing PowerPoint, Licensing - Questions for follow up
OWASP Codes of Conduct (Dinis Cruz & Jeff Williams) - Draft Document]
Building the OWASP Brazilian Leaders Group (Lucas Ferriera)
OWASP Asia/Pacific Working Group (Helen Gao)
Industry - Healthcare (Joe Bernik & Lorna Alamri)
Industry - Banking/Finance (Joe Bernik & Lorna Alamri)
Miscellaneous
Privacy - Personal Data/PII, Legislation and OWASP (Colin Watson) - Working Session Notes
Overhauling the OWASP Website (Jason Li)
Should OWASP work directly with PCI-DSS? (Matthew Chalmers)
How can OWASP reach/talk/engage with auditors (Matthew Chalmers)
Developer Outreach (Mark Bristow & Jason Li)
Summit Team & Attendee Bios
Support Staff Bios
Attendee Bios
