This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Romania InfoSec Conference 2013"

From OWASP
Jump to: navigation, search
Line 14: Line 14:
 
'''Owasp Romania InfoSec Conference 2013 - October 25th'''
 
'''Owasp Romania InfoSec Conference 2013 - October 25th'''
  
−
OWASP Romania is happy to announce the Call for Papers for OWASP Romania InfoSec Conference 2013 a one day Security and Hacking Conference. It will take place on 25th of October, 2013 - Bucharest, Romania. <br>
+
OWASP Romania team is happy to announce the '''OWASP Romania InfoSec Conference 2013''', a one day '''Security''' and '''Hacking Conference'''. It will take place on 25th of October, 2013 - Bucharest, Romania. <br>
 
The OWASP Romania InfoSec Conference objective is to raise awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.
 
The OWASP Romania InfoSec Conference objective is to raise awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.
  
Line 73: Line 73:
 
| style="width:25%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Introduction & Welcome
 
| style="width:25%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Introduction & Welcome
 
| style="width:25%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Oana Cornea
 
| style="width:25%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Oana Cornea
−
| style="width:40%" valign="middle" height="30" bgcolor="#CCEEEE" align="center" colspan="0" | Introduction to OWASP & Bucharest Event, Schedule for the Day
+
| style="width:40%" valign="middle" height="30" bgcolor="#CCEEEE" align="justify" colspan="0" | Introduction to OWASP & Bucharest Event, Schedule for the Day
 
|-
 
|-
 
| style="width:10%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | 45 mins  
 
| style="width:10%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | 45 mins  
Line 79: Line 79:
 
(aka "The good the bad and the ugly implementations")  
 
(aka "The good the bad and the ugly implementations")  
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Martin Knobloch
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Martin Knobloch
−
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Software development is not THAT new anymore, but it is still a fast changing work environment.<br>
+
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="justify" colspan="0" | Software development is not THAT new anymore, but it is still a fast changing work environment.<br>
 
We do develop more functionality faster, and the applications do even look more pretty!<br>
 
We do develop more functionality faster, and the applications do even look more pretty!<br>
−
..but what about security? Guess what, it is not a developers first priority!<br>
+
But what about security? Guess what, it is not a developers first priority!<br>
−
This presentation is about how to implement secure development strategy without blaming and bashing on developers.
+
This presentation is about how to implement secure development strategy without blaming and bashing on developers. Instead of increasing the workload of the development-team  with more process overhead, (security) quality gates, etc.<br>
−
Instead of increasing the workload of the development-team  with more process overhead, (security) quality gates, etc
 
 
Lets help developer by implementing impalpable mechanism!
 
Lets help developer by implementing impalpable mechanism!
 
|-
 
|-
Line 89: Line 88:
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Practical Defense with mod_security Web Application Firewall
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Practical Defense with mod_security Web Application Firewall
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Marian Ventuneac
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Marian Ventuneac
−
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Marian will introduce the mod_security Web Application Firewall (WAF). This session will be a practical demonstration of mitigating security risks for a sample vulnerable Web application.
+
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="justify" colspan="0" | Marian will introduce the mod_security Web Application Firewall (WAF). This session will be a practical demonstration of mitigating security risks for a sample vulnerable Web application.
 
|-
 
|-
 
| style="width:10%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | 45 mins
 
| style="width:10%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | 45 mins
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Scanning Romania with Nessus (web part)
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Scanning Romania with Nessus (web part)
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Adrian Furtuna
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Adrian Furtuna
−
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | This talk presents the results of a passive vulnerability scan performed against all Romanian IP addresses, targeting all web servers listening on port 80. <br>
+
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="justify" colspan="0" | This talk presents the results of a passive vulnerability scan performed against all Romanian IP addresses, targeting all web servers listening on port 80. <br>
 
The research was performed against multiple network packet captures selected from the output of Carna botnet, which scanned Romania in July 2012.
 
The research was performed against multiple network packet captures selected from the output of Carna botnet, which scanned Romania in July 2012.
 
|-
 
|-
Line 100: Line 99:
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Reading the minds   
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Reading the minds   
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Anatolie Prisacaru
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Anatolie Prisacaru
−
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | In my presentation I will focus the analysis of how web browsers and extensions keep in memory.<br> I will start with a quick introduction on how to dump and analyse processes' random access memory maps on a Linux based operating system with basic tools and then run a quick code review to see a couple of weak points, find their Achilles' heel and finally prove why statements like "Your sensitive data is encrypted _locally_ before upload so even LastPass cannot get access to it" can be pretty misleading.  
+
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="justify" colspan="0" | In my presentation I will focus the analysis of how web browsers and extensions keep in memory.<br> I will start with a quick introduction on how to dump and analyse processes' random access memory maps on a Linux based operating system with basic tools and then run a quick code review to see a couple of weak points, find their Achilles' heel and finally prove why statements like "Your sensitive data is encrypted _locally_ before upload so even LastPass cannot get access to it" can be pretty misleading.  
 
|-
 
|-
 
| style="width:10%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | 45 mins  
 
| style="width:10%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | 45 mins  
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Resolving 3 Common threats in MVC (A4 - Insecure Direct Object References , A3 - Cross-Site Scripting (XSS) , A8 - Cross-Site Request Forgery (CSRF) )   
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Resolving 3 Common threats in MVC (A4 - Insecure Direct Object References , A3 - Cross-Site Scripting (XSS) , A8 - Cross-Site Request Forgery (CSRF) )   
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Andrei Ignat
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Andrei Ignat
−
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Any website is confronted with hackers. The security measures are easy to follow - and this presentation shares to you this knowledge.
+
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="justify" colspan="0" | Any website is confronted with hackers. The security measures are easy to follow - and this presentation shares to you this knowledge.
 
|-
 
|-
 
| style="width:10%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | 45 mins  
 
| style="width:10%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | 45 mins  
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Hacking the Wordpress ecosystem   
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Hacking the Wordpress ecosystem   
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Dan Catalin Vasile
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Dan Catalin Vasile
−
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | This talk came from the personal need of securing multiple instances of Wordpress. An OWASP Project was initiated to gather the knowledge around this subject in one place.<br>
+
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="justify" colspan="0" | This talk came from the personal need of securing multiple instances of Wordpress. An OWASP Project was initiated to gather the knowledge around this subject in one place.<br>
 
The presentation will address the following subjects:<br>
 
The presentation will address the following subjects:<br>
 
- securing the installation process<br>
 
- securing the installation process<br>
Line 121: Line 120:
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | iOS applications risks and defenses   
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | iOS applications risks and defenses   
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Oana Cornea
 
| style="width:25%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | Oana Cornea
−
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="center" colspan="0" | The presentation will highlight the main iOS applications attack vectors, techniques and tools to perform a pentest and mechanisms that can be implemented to reduce application vulnerabilities. These will be presented in connection with the Owasp top ten mobile risks and will show how to improve the security of mobile applications.
+
| style="width:40%" valign="middle" height="30" bgcolor="#EEEEEE" align="justify" colspan="0" | The presentation will highlight the main iOS applications attack vectors, techniques and tools to perform a pentest and mechanisms that can be implemented to reduce application vulnerabilities. These will be presented in connection with the Owasp top ten mobile risks and will show how to improve the security of mobile applications.
 
|-
 
|-
 
|}
 
|}

Revision as of 16:28, 24 September 2013


Logo-ro.jpg
OWASP Romania

InfoSec Conference

Welcome

Owasp Romania InfoSec Conference 2013 - October 25th

OWASP Romania team is happy to announce the OWASP Romania InfoSec Conference 2013, a one day Security and Hacking Conference. It will take place on 25th of October, 2013 - Bucharest, Romania.
The OWASP Romania InfoSec Conference objective is to raise awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.

Who Should Attend?

  • Application Developers
  • Application Testers and Quality Assurance
  • Application Project Management and Staff
  • Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff
  • Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance
  • Security Managers and Staff
  • Executives, Managers, and Staff Responsible for IT Security Governance
  • IT Professionals Interesting in Improving IT Security
  • Anyone interested in learning about or promoting Web Application Security


Agenda

CONFERENCE (Friday 25th of October)

Date Location
Friday 25th of October Venue Location: University "Politehnica" of Bucharest

Venue Address: Splaiul Independentei nr. 313, sector 6, Bucuresti, ROMANIA;
Postal cod: RO-060042
 Venue Map: [1]

Price and registration
This event is FREE, you need to register on the link provided below, print your ticket and present it at the entrance. 
Limited number of seats! Register now! https://owasp-romaniachapter-infosec.eventbrite.com/
Event details
  • The presentation slides will be in English
  • The presentations will be held in Romanian, except the one of Mr. Martin Knobloch
  • There will be a short Q&A session at the end of each presentation (please hold them until the presentation ends)
  • A mid-day break will be available for speaking with the presenters and with each other


Conference Details
Time Title Speaker Description
15 mins Introduction & Welcome Oana Cornea Introduction to OWASP & Bucharest Event, Schedule for the Day
45 mins Secure Development LifeCycle

(aka "The good the bad and the ugly implementations")

Martin Knobloch Software development is not THAT new anymore, but it is still a fast changing work environment.

We do develop more functionality faster, and the applications do even look more pretty!
But what about security? Guess what, it is not a developers first priority!
This presentation is about how to implement secure development strategy without blaming and bashing on developers. Instead of increasing the workload of the development-team with more process overhead, (security) quality gates, etc.
Lets help developer by implementing impalpable mechanism!

45 mins Practical Defense with mod_security Web Application Firewall Marian Ventuneac Marian will introduce the mod_security Web Application Firewall (WAF). This session will be a practical demonstration of mitigating security risks for a sample vulnerable Web application.
45 mins Scanning Romania with Nessus (web part) Adrian Furtuna This talk presents the results of a passive vulnerability scan performed against all Romanian IP addresses, targeting all web servers listening on port 80.

The research was performed against multiple network packet captures selected from the output of Carna botnet, which scanned Romania in July 2012.

45 mins Reading the minds Anatolie Prisacaru In my presentation I will focus the analysis of how web browsers and extensions keep in memory.
I will start with a quick introduction on how to dump and analyse processes' random access memory maps on a Linux based operating system with basic tools and then run a quick code review to see a couple of weak points, find their Achilles' heel and finally prove why statements like "Your sensitive data is encrypted _locally_ before upload so even LastPass cannot get access to it" can be pretty misleading.
45 mins Resolving 3 Common threats in MVC (A4 - Insecure Direct Object References , A3 - Cross-Site Scripting (XSS) , A8 - Cross-Site Request Forgery (CSRF) ) Andrei Ignat Any website is confronted with hackers. The security measures are easy to follow - and this presentation shares to you this knowledge.
45 mins Hacking the Wordpress ecosystem Dan Catalin Vasile This talk came from the personal need of securing multiple instances of Wordpress. An OWASP Project was initiated to gather the knowledge around this subject in one place.

The presentation will address the following subjects:
- securing the installation process
- server side measures: backup, securing login, antivirus, regular scan, web firewall, monitoring, permissions, etc.
- client side measures: personal devices security, password management, communication channels, etc.
- hacking the infrastructure
- hacking plugins

45 mins iOS applications risks and defenses Oana Cornea The presentation will highlight the main iOS applications attack vectors, techniques and tools to perform a pentest and mechanisms that can be implemented to reduce application vulnerabilities. These will be presented in connection with the Owasp top ten mobile risks and will show how to improve the security of mobile applications.

Sponsors


 

Event Supporters

  
 

Educational Supporters

  
UPBlogo.png

Questions

  • If you have any questions about this event, please send an email to Oana Cornea
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Romania_InfoSec_Conference_2013&oldid=159022"