Difference between revisions of "Projects/Reports/2013-20-12"

• Projects and Women in AppSec at AppSec APAC 2014
  • I worked on trying to get more OWASP Projects represented at the AppSec APAC conference taking place in Tokyo, Japan in 2014.
  • Our projects have been under represented in the region, and this is why I felt this was an important initiative to take on this week.
  • I spoke to Rio and Laura about it, and I drafted up an announcement to try and get more project leaders to apply to the CFP.
  • I hope the selection team chooses at least 3 project talks for the event.
  • Additionally, I spoke to the planning team about having Women in AppSec at the conference.
  • I put together some additional information for them, and sent it over to the team.
  • I hope they agree to have the program run at the conference.

• Apple Developer Program
  • I spent some time researching how to best make this happen for our leaders.
  • I contacted Apple, and I am glad to say that they were very helpful.
  • Making this available is going to cost the foundation $99 a year.
  • Thankfully, I have gotten our project budget approved, and I was able to purchase this membership for us.
  • I had to apply for a D-U-N-S number for the organization, and I am waiting for approval on that.
  • After I get this information, I can start adding people to the developer program so we can start offering our applications on the Apple Appstore.

• Documentation Development
  • I continue to work on finishing my reports/documents for the year.
  • Below is a list of the documents I am putting together.
  • Post 2013 Summit Report
  • Q4 DHS Guidebook Report
  • 2014 Project Leader Handbook
  • 2014 Projects Plan
  • 2014 Projects Fundraising Plan
  • Project Page content update

• Grants and Fundraising Intern: 1st Proposal
  • Over the past two weeks, Kait has been working on putting together a mock up grant proposal, budget, and project plan.
  • It is the first time Kait has ever put something like this together.
  • I asked her to put together a mock up proposal and project plan for a book development project using our Security Principles Project for the content.
  • The learning curve was high, but I am glad to report that she has successfully completed the proposal.
  • She is now finishing off the mock project plan.
  • We completed this exercise as training for next year when Kait will help us put together a real grant proposal for the Blackstone Foundation.

• ESAPI Hackathon
  • For the past two weeks, Chris, Kevin, and I have been working on the logistics of the ESAPI Hackathon.
  • The aim of the Hackathon is to encourage contributions to the ESAPI Project in several key areas.
  • There will be 1st, 2nd, 3rd, and 4th place prizes awarded to the best 4 contributions.
  • The Hackathon starts today, December 20th 2013 and ends January 20th 2014.
  • For more information, visit the Guidelines page or e-mail Chris, Kevin, or me directly.

• Daily Project based queries and requests
  • This has not changed much since I began the post: questions are very similar in nature.
  • Global AppSec questions.
  • Funding queries.
  • Travel availability.
  • Project based administrative help.
  • Project status information.
  • Several project donation questions.
  • Marketing questions.
  • Grant funding questions.
  • OWASP social media updates.
  • What's happening with projects, questions.

General Awards

• OWASP OWTF Project: Brucon 5x5 Award

1. Amount: €5,000.00 (Approx. $6,670.00)
2. Status: Awarded. Congratulations, Abraham Aranguren and all involved in the project, for your award.

Proposals Awarded

• OWASP Guidebooks Proposal

1. Amount: $25,000 USD
2. Status: Awarded. The first payment has been allocated to our project budgets. The second invoice has now been sent to Georgia Tech and payment has been received.
3. OWASP Development Guide Plan
4. OWASP Testing Guide Plan
5. OWASP Code Review Guide Plan

• Google Grants Proposal

1. Amount: $120,000 USD in Adwords Funds
2. Status: Awarded.
3. Note: There is no link to show the proposal for this grant. There was a form that was submitted to Google, and we did not receive a record of this form.

• Google Summer of Code

1. Amount: $5,500
2. Status: Awarded

• Projects breakdown:
  • 4 ZAP Projects: $2,000
  • 4 OWTF Projects: $2,000
  • 1 PHP Security Project: $500
  • 1 Hackademics Project: $500
  • 1 Modsecurity Project: $500
  • Note: Big thank you to Fabio Cerullo for coordinating and managing this award.

• OWASP AppSensor Grant Proposal

1. Amount: $15,000 USD
2. Status: Awarded.

• Total Funds Awarded: $172,170 USD for 2013.

Proposals Denied

• European Commission Grant Proposal

1. Amount: €250,000
2. Status: Denied.

• OWASP OpenSAMM Grant Proposal

1. Amount: $112,000 USD
2. Status: Denied

• OWASP ESAPI Grant Proposal

1. Amount: $25,000 USD
2. Status: Denied

• OWASP ModSecurity CRS Proposal

1. Amount: $30,000 USD
2. Status: Denied

• OWASP OWTF Grant Proposal

1. Amount: $55,800 USD
2. Status: Denied

Current Project Funds

• Chapter and Individual Project Funds
• Project Reboot 2012 Information
• Q1 2013: Funds Allocated to Projects
• Q2 2013: Funds Allocated to Projects
• Q3 2013: Funds Allocated to Projects

Message from OWASP ESAPI Project Leaders, Kevin Wall & Chris Schmidt

ESAPI Hackathon / Bug Bash Contest

Our very own OWASP ESAPI Project Leaders, Chris Schmidt and Kevin Wall, are hosting the OWASP ESAPI Hackathon starting on Friday, December 20th 2013 and ending on Monday, January 20th 2014. The aim of the ESAPI Hackathon is to encourage contributors to Implement modular security controls, fix existing bugs, provide reference implementations, and improve user documentation.

Each participant will be evaluated by four judges, and prizes will be awarded to those who provide the most valuable contribution to the project. Here are the list of prizes:

• First place: Apple iPad Mini and an ESAPI T-shirt

• Second place: $30.00 (USD) Amazon Gift Card and an ESAPI T-shirt

• Third place: $20.00 (USD) Amazon Gift Card and an ESAPI T-shirt

• Fourth place: An ESAPI T-shirt

We encourage all those who can participate to contribute to the OWASP ESAPI Project. Please view the contributing guidelines wiki page for more detailed information on participant expectations. If you still require more assistance, please contact either, Kevin Wall ([email protected]) or Chris Schmidt ([email protected]).

Download a pdf version of the guidelines here.

Message from OWASP ZAP Project Leader, Simon Bennetts

I'm delighted to tell you that ZAP came top of the Toolswatch Best Security Tool of 2013: http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/

Also congrats to OWASP Xenotix and OWASP O-Saft who also made the top 10

Thank you to everyone who voted for ZAP and other OWASP projects!

Message from OWASP Media Project Leader, Jonathan Marcil

TLDR; 11k views and 450 subscribers!

As you all know, we did a lot of work at last AppSecUSA in order to get 43 videos online for 32 hours for the talks, and also 6 videos from the Project Summit for 2.5 hours of content. All of that was online live for the summit and 24h after for the first talks, then the rest was published in one week the week just after the conference.

I managed to get the Project Summit recording by myself, but for the talks, it wouldn't have been possible without the support from AppSecUSA who used their resources to help us with that. To make it clear, we had a professional firm that recorded and uploaded the videos into YouTube. The only work I did on my side was to organize them into a playlist and publish them periodically.

AppSecUSA 2013 playlist

https://www.youtube.com/playlist?list=PLpr-xdpM8wG8ODR2zWs06JkMmlRiLyBXU

OWASP Projects Summit 2013 playlist

https://www.youtube.com/playlist?list=PLpr-xdpM8wG80aEXBZV9lk5nkEf3q-jaz

On the fail part, we missed some of the important talks, such as the keynote because it was at the very beginning and also Jeremiah's talk that was a hit, but we achieved 77% publishing within one week. One thing that actually wasn't real good in the short run was that the title didn't contains "OWASP" nor "AppSecUSA". That will probably hurt us in the long run and I might decide to change titles if we don't come out first in search results (as for now we don't https://www.youtube.com/results?search_query=appsecusa).

We actually plan to do the same thing for AppSecUSA 2014 and I'll be in touch with the team in order to prepare in advance. They want to have live streaming and be as fast.

One thing that is sure, is that we need more people in OWASP Media project. The good news is, unlike most other OWASP projects, you don't need to be an application security specialist to be really useful, you just need to be motivated to share knowledge with the world. I think that

Now for some stats, covering from Nov 17 2013 to Dec 19 2013.

We are at 11,289 views and 79,874 of estimated watched minutes.

Let me remind you that before that, we where at 245 views for 1,312 minutes, mainly from the OWASP Global Meetings live hangouts.

We are at 438 subscribers and we gained 442 of them with AppSecUSA efforts. We lost 4 hence the numbers.

The average view duration is 7:04 minutes, so 16% of the total times of videos. Since we have mostly one hour long videos, this is normal and in fact is probably a great number.

Notable popular videos are:

OWASP Zed Attack Proxy - Simon Bennetts

2,126 views 17,712 minutes watched 8:19 avg

http://youtu.be/pYFtLA2yTR8

Top Ten Proactive Controls - Jim Manico

845 views 8,293 minutes watched 9:48 avg

http://youtu.be/Cg5dN8Pyn_c

What You Didn't Know About XML External Entities Attacks - Timothy Morgan

790 views 5,857 minutes wathced 7:24 avg

http://youtu.be/eHSNT8vWLfc

From what I saw, Simon's used his network to publish his videos and I helped him by putting it as the trailer for the channel for a while. Same with Jim but with less engagement from his network (less comments). Timothy's was published from an external news website and got some views trough that.

Finally, the following countries were the top viewership:

• United States 37%
• Canada 12%
• India 4.5%
• United Kingdom 4.0%

I must point out that we were watched in 114 countries. That's amazing and shows the power of OWASP worldwide. With that big first step done, we will continue with our roadmap https://www.owasp.org/index.php/OWASP_Media_Project#tab=Roadmap and the next thing on the table is to present a Webinar on how to use Google Hangout and try to setup the next webinars within our YouTube channel. I also want to shake things with the Chapters by incite them to use Hangout and YouTube in order to get more into the Global Chapter Meetings Project. This has great potential but is not really used right now for helping smaller chapters to get contents. And and last, but not least, we are officially on the www.owasp.org homepage and we can control what is shown trough that small playlist: https://www.youtube.com/playlist?list=PLpr-xdpM8wG9g8l21uzfgyx4xAJ9aY7e7

Thanks to all who contributed and helped with OWASP Media Project,

See you next year!

"OWASP 24/7" with Mark Miller is a series of recorded broadcasts, highlighting OWASP projects and people from around the world. With over 43,000 members in 100 countries, the OWASP 24/7 channel is available on demand, at anytime, anywhere on the planet. You are welcome to embed the broadcasts on your page, download them for your personal listening or keep up to date by subscribing to the iTunes channel. Please view the Podcast Project page for a list of current interviews.

View All Available Broadcasts or choose one of our new single episodes below:

• AppSec USA 2013 – Abbas Naderi and the OWASP PHP Security Project
• AppSec USA 2013: Zed Attack Proxy Project with Simon Bennetts

Upcoming interviews

• Kevin Wall (ESAPI)
• Jim Manico (OWASP Podcast Series)
• Larry Conklin (Code Review Project)
• Andrew van der Stock (Pro-Active Controls)
• Andrew van der Stock
• Larry Conklin
• Chetan Karande - Node.jsGoat
• Mark Arnold - OWASP Boston Chapter Lead
• Mike McCabe, Ben Johnson
• Rafael Gil
• Seba Deleersnyder
• Josh Corman
• Ryan Berg