This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Project Summit 2015/Working Sessions"
From OWASP
(→Current Daily Schedule) |
(→Project Developments: The Good , The Bad and the Ugly) |
||
| (25 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
| − | We are currently looking for more working session ideas for the summit. If you're interested in adding a Working Session for the 2014 Summit, please contact either [mailto:[email protected] Johanna Curiel] | + | We are currently looking for more working session ideas for the summit. If you're interested in adding a Working Session for the 2014 Summit, please contact either [mailto:[email protected] Johanna Curiel] Please review the [[Working Sessions Methodology|Working Session methodology]] for Working Session rules. |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
'''Keep checking back, as we will be adding more working sessions every week.''' | '''Keep checking back, as we will be adding more working sessions every week.''' | ||
| Line 13: | Line 5: | ||
==Current Daily Schedule== | ==Current Daily Schedule== | ||
| − | |||
| − | |||
| − | |||
OWASP PROJECT Summit Agenda 2015 | OWASP PROJECT Summit Agenda 2015 | ||
| + | Location: AMSTERDAM RAI - 19 & 20 May | ||
| + | Rooms E103 & E104 (see attached floor plan): | ||
| + | [[File:RAI_PLAN_2013_LR_AW.pdf]] | ||
==Tuesday 19th May== | ==Tuesday 19th May== | ||
===9:00-9:30 Welcome to Project Summit 2015=== | ===9:00-9:30 Welcome to Project Summit 2015=== | ||
| − | |||
===Project Review Task Force=== | ===Project Review Task Force=== | ||
Project Reviews 2014-2015 Results | Project Reviews 2014-2015 Results | ||
9:30-10:30 | 9:30-10:30 | ||
| − | Actual situation of projects== | + | Location room :E104 |
| + | |||
| + | ===Actual situation of projects=== | ||
| + | 20 min presentation about the results of the last Project review, and release report about the active/ inactive projects per category It is expected than all attending project leaders and some members of the owasp board can assist to this presentation and participate | ||
| + | Location room :E104 | ||
===Security Gaps Workshop=== | ===Security Gaps Workshop=== | ||
(25 min): Security issues that no project has explored so far. Potential source of inspiration for new projects | (25 min): Security issues that no project has explored so far. Potential source of inspiration for new projects | ||
| − | Projects as Operational objectives (Kate Hartmann, Johanna, Paul,Timo, Jim) | + | Location room :E104 |
| + | |||
| + | ===Projects as Operational objectives=== | ||
| + | (Kate Hartmann, Johanna, Paul,Timo, Jim) | ||
Deliverables: Report, Wiki updated and a nice infographic with the results.Plan for projects to be part of the operational objectives | Deliverables: Report, Wiki updated and a nice infographic with the results.Plan for projects to be part of the operational objectives | ||
| + | Location room :E104 | ||
===OWASP Knowledge Based Authentication Performance Metrics Project=== | ===OWASP Knowledge Based Authentication Performance Metrics Project=== | ||
| Line 38: | Line 37: | ||
and project managers (Ann Racuya-Robbins, Noreen Whysel) | and project managers (Ann Racuya-Robbins, Noreen Whysel) | ||
10h30 – 12h30. | 10h30 – 12h30. | ||
| + | Location room :E104 | ||
===Review of the KBA testing tools (such as the KBA plugin).=== | ===Review of the KBA testing tools (such as the KBA plugin).=== | ||
| Line 50: | Line 50: | ||
The new ground of identity, security, privacy and | The new ground of identity, security, privacy and | ||
governance and the role of KBA in each. | governance and the role of KBA in each. | ||
| + | Location room :E104 | ||
===OWASP Codes of Conduct – Document Review=== | ===OWASP Codes of Conduct – Document Review=== | ||
10:30 – 12:00 | 10:30 – 12:00 | ||
The current Codes of Conduct were developed primarily during the last major OWASP Summit in Portugal. | The current Codes of Conduct were developed primarily during the last major OWASP Summit in Portugal. | ||
| − | They cover: | + | They cover: Government Bodies, Educational Institutions, Standards Groups, Trade Organizations, Certifying Bodies, and Development Organizations. |
| − | Government Bodies | + | This 1.5 hour session will review, edit, update and release v1.2 of each document. Participants should be interested in how external entities can be encouraged to support OWASP's mission, read the existing |
| − | Educational Institutions | ||
| − | Standards Groups | ||
| − | Trade Organizations | ||
| − | Certifying Bodies | ||
| − | Development Organizations | ||
| − | This 1.5 hour session will review, edit, update and release v1.2 of each document. Participants should be | ||
| − | interested in how external entities can be encouraged to support OWASP's mission, read the existing | ||
Codes of Conduct in advance, and come with suggestions for changes. | Codes of Conduct in advance, and come with suggestions for changes. | ||
| − | + | • Introduction | |
| − | Joint review and edit (15 mins each document) | + | • Joint review and edit (15 mins each document) |
| − | Publish updated documents to wiki (PDF and Word) | + | • Publish updated documents to wiki (PDF and Word). |
Project website: https://www.owasp.org/index.php/OWASP_Codes_of_Conduct | Project website: https://www.owasp.org/index.php/OWASP_Codes_of_Conduct | ||
| + | Location room :E104 | ||
===OWASP ASVS === | ===OWASP ASVS === | ||
| Line 76: | Line 71: | ||
Live QA of 2.1 | Live QA of 2.1 | ||
Early planning of ASVS v3.0 | Early planning of ASVS v3.0 | ||
| + | Location room :E104 | ||
=== Hackademics=== | === Hackademics=== | ||
| Line 88: | Line 84: | ||
14:00 - 17:30 Hackademics – Greek, French translation | 14:00 - 17:30 Hackademics – Greek, French translation | ||
We are currently implementing an internationalization feature using I18n which should be ready for our v2.0 release. Our goal is to translate the strings present in the platform in French and Greek. (Since it's already in English and French and Greek are the only other languages the core contributors(and most likely participants) speak. There are approximately 300 strings in the platform. Participants to help are gladly welcome. | We are currently implementing an internationalization feature using I18n which should be ready for our v2.0 release. Our goal is to translate the strings present in the platform in French and Greek. (Since it's already in English and French and Greek are the only other languages the core contributors(and most likely participants) speak. There are approximately 300 strings in the platform. Participants to help are gladly welcome. | ||
| + | |||
| + | Location room :E103 | ||
===AppSensor=== | ===AppSensor=== | ||
| Line 94: | Line 92: | ||
• Briefing | • Briefing | ||
• Live editing | • Live editing | ||
| − | • Publication updated PDF | + | • Publication updated PDF. |
The latest version of the guide is at: https://www.owasp.org/index.php/File:Owasp-appensor-guide-v2.doc | The latest version of the guide is at: https://www.owasp.org/index.php/File:Owasp-appensor-guide-v2.doc | ||
| + | |||
| + | Location room :E103 | ||
===Snakes and Ladders=== | ===Snakes and Ladders=== | ||
15:30 – 16:30 Snakes and Ladders – Dutch Translation OWASP Snakes & Ladders | 15:30 – 16:30 Snakes and Ladders – Dutch Translation OWASP Snakes & Ladders | ||
| − | (web applications) has been translated into 5 other languages already, and Portuguese is in progress. But so far not Dutch. This rapid session will ask participants to translate the 900 words or so into Dutch, so that a PDF and Adobe Illustrator version can be created. It will also be possible to help remotely, as it will be set up on Crowdin. • Meet | + | (web applications) has been translated into 5 other languages already, and Portuguese is in progress. But so far not Dutch. This rapid session will ask participants to translate the 900 words or so into Dutch, so that a PDF and Adobe Illustrator version can be created. It will also be possible to help remotely, as it will be set up on Crowdin. |
| + | • Meet | ||
| + | • Translate | ||
| + | • Create Illustrator and PDF output | ||
| + | • Publish. | ||
| + | Project website: https://www.owasp.org/index.php/OWASP_Snakes_and_Ladders | ||
| + | Location room :E104 | ||
===OWASP OWTF === | ===OWASP OWTF === | ||
| Line 110: | Line 116: | ||
Brainstorm about new ideas for GSoC 2015 | Brainstorm about new ideas for GSoC 2015 | ||
We expect to introduce students to OWTF and how GSoC would be a valuable experience for them. | We expect to introduce students to OWTF and how GSoC would be a valuable experience for them. | ||
| + | |||
| + | Location room :E103 | ||
12h00 - 13h00: OWASP OWTF Open Forum | 12h00 - 13h00: OWASP OWTF Open Forum | ||
| Line 121: | Line 129: | ||
What did GSoC give them back? | What did GSoC give them back? | ||
We expect to share our experiences with possible future-GSoC students and help them to better understand what it can offer. | We expect to share our experiences with possible future-GSoC students and help them to better understand what it can offer. | ||
| + | |||
| + | Location room :E103 | ||
14h00 - 17h00: OWASP OWTF Wiki Review | 14h00 - 17h00: OWASP OWTF Wiki Review | ||
| Line 130: | Line 140: | ||
We expect to have an up-to-date wiki by the end of this session or at least a list of known out-of-date information. | We expect to have an up-to-date wiki by the end of this session or at least a list of known out-of-date information. | ||
| + | Location room :E103 | ||
| + | ===OWASP Security Shepherd=== | ||
| + | 10:30 - 12:00 - Challenge Brain Storm | ||
| + | The Security Shepherd project needs fresh challenge idea.Security Shepherd currently sports ~60 challenges covering the topics listed by the OWASP Web and Mobile Top Ten. These challenges start simple and increment in difficulty as bad fixes become closer to being good fixes. However, the scope of bad fix examples that are presented in Security Shepherd are a fraction of what's possible. So drop in and lay out any of the security gaps you can think of in applications, no matter how simple or complex they are. It could be a XSS blacklist filter, session management flaw or even poor data storage on a mobile device. If participants want to get their hands dirty and implement their idea into a challenge, that would be more than welcome across the session. | ||
| + | 14:00 - 16:00 - Mobile Application Challenges without Hard Coded keys | ||
| + | Implement a mechanism where a user can log into a Security Shepherd server through a Mobile Challenge Application to facilitate user specific keys to be presentated. This mechanism would need to be crafted so it cannot be exploited to return keys for security challenges without completing the level. | ||
| − | + | Project website: https://www.owasp.org/index.php/OWASP_Security_Shepherd | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| + | Location room :E104 | ||
==Wednesday 20th May== | ==Wednesday 20th May== | ||
| Line 403: | Line 170: | ||
Interworking with 3rd party tools | Interworking with 3rd party tools | ||
The opportunity to focus on specific areas of interest to the attendees | The opportunity to focus on specific areas of interest to the attendees | ||
| + | |||
| + | Location: Room E103 | ||
===OWASP Knowledge Based Authentication Performance Metrics=== | ===OWASP Knowledge Based Authentication Performance Metrics=== | ||
| Line 414: | Line 183: | ||
-Should Owasp consider providing labels and certifications? | -Should Owasp consider providing labels and certifications? | ||
-Expected audience : +20 people. | -Expected audience : +20 people. | ||
| − | * Searching for interaction with other project leaders, and the | + | * Searching for interaction with other project leaders, and the board |
| + | |||
| + | Location: Room E104 | ||
| − | ===09:00 – 12:00 Cornucopia – Video === | + | ===09:00 – 12:00 Cornucopia - Ecommerce Website Edition – Video === |
| − | The objective is to create a short "how to play Cornucopia" video during this half-day session. Cornucopia is a card game that helps identify security requirements, but people may not be familiar with how easy it is to get started. Participants for this session are needed to be players, to create a narrative, to video the game being played, and if there is time and anyone has the skill, to edit the video and sound into a release version. It is preferable if participants are already a little familiar with the game and/or threat modelling. If there is time, we will also discuss alternative game strategies like a Jeopardy format. | + | The objective is to create a short "how to play the Cornucopia card game" video during this half-day session. Cornucopia is a card game that helps identify security requirements, but people may not be familiar with how easy it is to get started. Participants for this session are needed to be players, to create a narrative, to video the game being played, and if there is time and anyone has the skill, to edit the video and sound into a release version. It is preferable if participants are already a little familiar with the game and/or threat modelling. If there is time, we will also discuss alternative game strategies like a Jeopardy format. |
• Storyboarding | • Storyboarding | ||
• Game play recording | • Game play recording | ||
• Editing | • Editing | ||
| − | • | + | • Soundtrack |
| − | • Publish video | + | • Publish video. |
| − | Project website: https://www.owasp.org/index.php/OWASP_Cornucopia | + | Project website: https://www.owasp.org/index.php/OWASP_Cornucopia |
| + | |||
| + | Location: Room E104 | ||
===9:30 - 11:30 Hackademics test coverage=== | ===9:30 - 11:30 Hackademics test coverage=== | ||
Improve unit tests coverage. Currently, unit tests cover ~20% of the platform, this session will focus on doubling the test coverage. Deliverables: 40% unit and functional tests coverage. | Improve unit tests coverage. Currently, unit tests cover ~20% of the platform, this session will focus on doubling the test coverage. Deliverables: 40% unit and functional tests coverage. | ||
| + | |||
| + | Location: Room E104 | ||
===13:30 – 17:00 AppSensor (Code) – Dashboard=== | ===13:30 – 17:00 AppSensor (Code) – Dashboard=== | ||
| Line 434: | Line 209: | ||
• User stories | • User stories | ||
• Information design | • Information design | ||
| − | • Code libraries and frameworks | + | • Code libraries and frameworks. |
Code roadmap: https://www.owasp.org/index.php/OWASP_AppSensor_Project#tab=Road_Map_and_Getting_Involved | Code roadmap: https://www.owasp.org/index.php/OWASP_AppSensor_Project#tab=Road_Map_and_Getting_Involved | ||
Microsite http://www.appsensor.org/ | Microsite http://www.appsensor.org/ | ||
| − | ===14:00 - 17: | + | Location: Room E104 |
| + | |||
| + | ===14:00 - 17:00 Hackademics - Student performance metrics visualization=== | ||
Currently, the platform gathers student performance metrics in the form of how long it took them to solve challenges, how many requests, how much time idle e.t.c. However, the only way for a teacher to see the numbers is with database access.(The data is gathered for the advanced scoring functionality but it is also very useful as performance analytics). We plan to use graphing libraries to create interactive graphs to visualize the comprehension of the student performance. It's a simple front-end feature which will improve the usability of the platform. | Currently, the platform gathers student performance metrics in the form of how long it took them to solve challenges, how many requests, how much time idle e.t.c. However, the only way for a teacher to see the numbers is with database access.(The data is gathered for the advanced scoring functionality but it is also very useful as performance analytics). We plan to use graphing libraries to create interactive graphs to visualize the comprehension of the student performance. It's a simple front-end feature which will improve the usability of the platform. | ||
| − | + | Location: Room E104 | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | === | + | ===17:00-18:00 OWASP Automated Threats to Web Applications Project - Website Owner Experiences=== |
| − | + | The OWASP Automated Threats to Web Applications Project is undertaking research and will publish its outputs immediately prior to AppSec EU 2015. This meeting seeks input from training and conference attendees on their own organisations' experiences of automated attacks: | |
| − | + | • What types of automated attacks occur and with what frequency? | |
| − | + | • What were the symptoms? | |
| − | + | • How are they detected? | |
| − | + | • What incident response measures were taken? | |
| − | + | • What steps were undertaken to prevent or mitigate such attacks? | |
| − | + | Participation/contribution can be anonymous or otherwise. The intention is to update the published documents during the session and if possible create additional sector-specific guidance. | |
| − | + | Location: Room E104 | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
===10h00 - 13h00: OWASP OWTF Architecture Audit=== | ===10h00 - 13h00: OWASP OWTF Architecture Audit=== | ||
| Line 711: | Line 239: | ||
Draw a better architecture for OWTF | Draw a better architecture for OWTF | ||
We expect to have a draft of the next architecture better suited for the needs of OWTF by the end of this session. | We expect to have a draft of the next architecture better suited for the needs of OWTF by the end of this session. | ||
| + | |||
| + | Location: Room E104 | ||
===14h00 - 15h00: OWASP OWTF CLI Assessment=== | ===14h00 - 15h00: OWASP OWTF CLI Assessment=== | ||
| Line 719: | Line 249: | ||
Gather the findings and draw a new standard for the CLI | Gather the findings and draw a new standard for the CLI | ||
We expect to have a new standard for the CLI that will be implemented this year in order to enhance and fix its behaviors. This could be part of a GSoC project depending of the output of the session. | We expect to have a new standard for the CLI that will be implemented this year in order to enhance and fix its behaviors. This could be part of a GSoC project depending of the output of the session. | ||
| + | |||
| + | Location: Room E104 | ||
===15h00 - 17h00: OWASP OWTF Hack It For Fun=== | ===15h00 - 17h00: OWASP OWTF Hack It For Fun=== | ||
| Line 728: | Line 260: | ||
We expect to show how easy it is for students to hack into the code base of OWTF. | We expect to show how easy it is for students to hack into the code base of OWTF. | ||
As a reward, the winners of the competition will be offered nice goodies :) | As a reward, the winners of the competition will be offered nice goodies :) | ||
| + | |||
| + | Location: Room E104 | ||
===Project Developments: The Good , The Bad and the Ugly=== | ===Project Developments: The Good , The Bad and the Ugly=== | ||
| − | 17: | + | 17:00 - 17:30 Open Forum with Project leaders |
Forum discussion with project leaders and Board==>(1 hour session) | Forum discussion with project leaders and Board==>(1 hour session) | ||
| − | Why my project is not moving forward? | + | *Why my project is not moving forward? |
| − | What can be done to help improve my project? | + | *What can be done to help improve my project? |
| − | How to improve the actual situation of projects | + | *How to improve the actual situation of projects |
| − | How to improve the review process | + | *How to improve the review process |
| + | |||
Deliverables: | Deliverables: | ||
| − | Collect information and create a report | + | *Collect information and create a report |
| − | Use the session results and see how can we implement them | + | *Use the session results and see how can we implement them |
| − | Inform leaders about the actual process | + | *Inform leaders about the actual process |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | Location: Room E104 | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Latest revision as of 15:45, 15 May 2015
We are currently looking for more working session ideas for the summit. If you're interested in adding a Working Session for the 2014 Summit, please contact either Johanna Curiel Please review the Working Session methodology for Working Session rules.
Keep checking back, as we will be adding more working sessions every week.
- 1 Current Daily Schedule
- 2 Tuesday 19th May
- 2.1 9:00-9:30 Welcome to Project Summit 2015
- 2.2 Project Review Task Force
- 2.3 Actual situation of projects
- 2.4 Security Gaps Workshop
- 2.5 Projects as Operational objectives
- 2.6 OWASP Knowledge Based Authentication Performance Metrics Project
- 2.7 Review of the KBA testing tools (such as the KBA plugin).
- 2.8 OWASP Codes of Conduct – Document Review
- 2.9 OWASP ASVS
- 2.10 Hackademics
- 2.11 AppSensor
- 2.12 Snakes and Ladders
- 2.13 OWASP OWTF
- 2.14 OWASP Security Shepherd
- 3 Wednesday 20th May
- 3.1 OWASP ZAP
- 3.2 OWASP Knowledge Based Authentication Performance Metrics
- 3.3 09:00 – 12:00 Cornucopia - Ecommerce Website Edition – Video
- 3.4 9:30 - 11:30 Hackademics test coverage
- 3.5 13:30 – 17:00 AppSensor (Code) – Dashboard
- 3.6 14:00 - 17:00 Hackademics - Student performance metrics visualization
- 3.7 17:00-18:00 OWASP Automated Threats to Web Applications Project - Website Owner Experiences
- 3.8 10h00 - 13h00: OWASP OWTF Architecture Audit
- 3.9 14h00 - 15h00: OWASP OWTF CLI Assessment
- 3.10 15h00 - 17h00: OWASP OWTF Hack It For Fun
- 3.11 Project Developments: The Good , The Bad and the Ugly
Current Daily Schedule
OWASP PROJECT Summit Agenda 2015
Location: AMSTERDAM RAI - 19 & 20 May Rooms E103 & E104 (see attached floor plan): File:RAI PLAN 2013 LR AW.pdf
Tuesday 19th May
9:00-9:30 Welcome to Project Summit 2015
Project Review Task Force
Project Reviews 2014-2015 Results 9:30-10:30 Location room :E104
Actual situation of projects
20 min presentation about the results of the last Project review, and release report about the active/ inactive projects per category It is expected than all attending project leaders and some members of the owasp board can assist to this presentation and participate Location room :E104
Security Gaps Workshop
(25 min): Security issues that no project has explored so far. Potential source of inspiration for new projects
Location room :E104
Projects as Operational objectives
(Kate Hartmann, Johanna, Paul,Timo, Jim) Deliverables: Report, Wiki updated and a nice infographic with the results.Plan for projects to be part of the operational objectives Location room :E104
OWASP Knowledge Based Authentication Performance Metrics Project
09h00 – 10h15. Review of the OWASP KBA-PMP project general advances with the project leaders and project managers (Ann Racuya-Robbins, Noreen Whysel) 10h30 – 12h30. Location room :E104
Review of the KBA testing tools (such as the KBA plugin).
15h00 – 19h00 .Open discussion of the KBA-PMP project: Why does the industry need a KBA standard? How is KBA used by different service providers around the world? KBA pentest experiences. Is dynamic KBA more secure than static KBA? Legal and technical challenges of dynamic KBA? Legal and technical challenges of remote identity proofing and KBA? The new ground of identity, security, privacy and governance and the role of KBA in each. Location room :E104
OWASP Codes of Conduct – Document Review
10:30 – 12:00 The current Codes of Conduct were developed primarily during the last major OWASP Summit in Portugal. They cover: Government Bodies, Educational Institutions, Standards Groups, Trade Organizations, Certifying Bodies, and Development Organizations. This 1.5 hour session will review, edit, update and release v1.2 of each document. Participants should be interested in how external entities can be encouraged to support OWASP's mission, read the existing Codes of Conduct in advance, and come with suggestions for changes.
• Introduction • Joint review and edit (15 mins each document) • Publish updated documents to wiki (PDF and Word).
Project website: https://www.owasp.org/index.php/OWASP_Codes_of_Conduct Location room :E104
OWASP ASVS
10:20 -11:50 & 14:30-17:30 OWASP ASVS Discuss issues around practitioners consuming ASVS in their consultancies Discuss how to improve adoption by development teams Live resolution of outstanding issues in ASVS Github Live QA of 2.1 Early planning of ASVS v3.0 Location room :E104
Hackademics
9:30 - 11:30 Hackademics – Wiki page rewrite, documentation review The current wiki page was written by the founders of the project back when the project started and it is missing lots of new information, also it has links to very old versions of the project and overall it needs rewriting. The current documentation is covering less than half of the features and it's wrong or not very clear in other parts.
This session will review, edit, update and release documentation for the version 2.0 of the project coming at the beginning of April. Moreover, we'll update the wiki listing contributors, developer guidelines, supporters and synch the documentation in the github wiki with the owasp wiki page. Participants should be familiar with hackademic and come with suggestions on missing guidelines.
14:00 - 17:30 Hackademics – Greek, French translation We are currently implementing an internationalization feature using I18n which should be ready for our v2.0 release. Our goal is to translate the strings present in the platform in French and Greek. (Since it's already in English and French and Greek are the only other languages the core contributors(and most likely participants) speak. There are approximately 300 strings in the platform. Participants to help are gladly welcome.
Location room :E103
AppSensor
13:00 – 15:00 AppSensor (Documentation) – Guide Review The AppSensor Guide v2 was published in May last year, and has had two minor updates, the last one mainly due to the important release of the v2 code implementation. This session is to edit and improve the guide, since many of the chapters have not been fully reviewed. Participants should read a chapter or two in advance of the summit (chapter 5 onwards, but choose randomly/what is of interest) and bring their edits/comments to the session, where the guide will be updated. All participants will be acknowledged in the guide and on the project wiki page.
• Briefing • Live editing • Publication updated PDF.
The latest version of the guide is at: https://www.owasp.org/index.php/File:Owasp-appensor-guide-v2.doc
Location room :E103
Snakes and Ladders
15:30 – 16:30 Snakes and Ladders – Dutch Translation OWASP Snakes & Ladders (web applications) has been translated into 5 other languages already, and Portuguese is in progress. But so far not Dutch. This rapid session will ask participants to translate the 900 words or so into Dutch, so that a PDF and Adobe Illustrator version can be created. It will also be possible to help remotely, as it will be set up on Crowdin.
• Meet • Translate • Create Illustrator and PDF output • Publish.
Project website: https://www.owasp.org/index.php/OWASP_Snakes_and_Ladders
Location room :E104
OWASP OWTF
10h - 12h00: OWASP OWTF Introduction for GSOC Students The OWTF project has seen more than 8 GSoC projects being merged into the master branch over the past couple of years. We want to introduce the students to the program. Quick presentation of OWASP OWTF and some of its GSoC projects What did GSoC offer over the past 3 years? Current ideas for GSoC 2015 Brainstorm about new ideas for GSoC 2015 We expect to introduce students to OWTF and how GSoC would be a valuable experience for them.
Location room :E103
12h00 - 13h00: OWASP OWTF Open Forum Two ex-GSoC students are available to speak about their experience with OWTF and GSoC. How did we hear about GSoC? Why did we choose OWTF? How did they contact the project leader? What is a proposal? How hard was it? How much time did it take? What did GSoC give them back? We expect to share our experiences with possible future-GSoC students and help them to better understand what it can offer.
Location room :E103
14h00 - 17h00: OWASP OWTF Wiki Review Because OWTF has grown really fast the past years, some part of the wiki might be out of date even though we worked hard to update it. Proof-read the Wiki Reproduce the steps described in the Wiki Find the out-dated information Remove/Update them We expect to have an up-to-date wiki by the end of this session or at least a list of known out-of-date information.
Location room :E103
OWASP Security Shepherd
10:30 - 12:00 - Challenge Brain Storm The Security Shepherd project needs fresh challenge idea.Security Shepherd currently sports ~60 challenges covering the topics listed by the OWASP Web and Mobile Top Ten. These challenges start simple and increment in difficulty as bad fixes become closer to being good fixes. However, the scope of bad fix examples that are presented in Security Shepherd are a fraction of what's possible. So drop in and lay out any of the security gaps you can think of in applications, no matter how simple or complex they are. It could be a XSS blacklist filter, session management flaw or even poor data storage on a mobile device. If participants want to get their hands dirty and implement their idea into a challenge, that would be more than welcome across the session.
14:00 - 16:00 - Mobile Application Challenges without Hard Coded keys Implement a mechanism where a user can log into a Security Shepherd server through a Mobile Challenge Application to facilitate user specific keys to be presentated. This mechanism would need to be crafted so it cannot be exploited to return keys for security challenges without completing the level.
Project website: https://www.owasp.org/index.php/OWASP_Security_Shepherd
Location room :E104
Wednesday 20th May
OWASP ZAP
Summit https://groups.google.com/d/msg/zaproxy-develop/OlKKKEc2Bxo/TF-f8_aKO94J :
10:00h - 16h30 The ZAP summit is aimed at existing and prospective ZAP developers and is an opportunity to discuss all aspects of ZAP development and future direction. It is not planned to include any training on how to use ZAP.
The exact topics discussed will be agreed between the attendees at the start of the day, but are expected to cover things like: An introduction to ZAP and the attendees A review of ZAPs perceived strengths and weaknesses Discussions around the future direction of ZAP Areas of ZAP that people find difficult to contribute to Components of ZAP that attendees think need significant reworking How to encourage more participation Interworking with 3rd party tools The opportunity to focus on specific areas of interest to the attendees
Location: Room E103
OWASP Knowledge Based Authentication Performance Metrics
09h30 – 12h30. Project Review of the KBA standard contents with the project leaders and managers (Luis Enriquez, Ann Racuya-Robbin, Noreen Whysel). 15h00 – 18h00. Open discussion of the OWASP Security Labeling system project proposal (secure code, privacy, ingredients, and openness labels) -Should security become visible for normal users? -Should Owasp consider providing labels and certifications? -Expected audience : +20 people.
- Searching for interaction with other project leaders, and the board
Location: Room E104
09:00 – 12:00 Cornucopia - Ecommerce Website Edition – Video
The objective is to create a short "how to play the Cornucopia card game" video during this half-day session. Cornucopia is a card game that helps identify security requirements, but people may not be familiar with how easy it is to get started. Participants for this session are needed to be players, to create a narrative, to video the game being played, and if there is time and anyone has the skill, to edit the video and sound into a release version. It is preferable if participants are already a little familiar with the game and/or threat modelling. If there is time, we will also discuss alternative game strategies like a Jeopardy format.
• Storyboarding • Game play recording • Editing • Soundtrack • Publish video.
Project website: https://www.owasp.org/index.php/OWASP_Cornucopia
Location: Room E104
9:30 - 11:30 Hackademics test coverage
Improve unit tests coverage. Currently, unit tests cover ~20% of the platform, this session will focus on doubling the test coverage. Deliverables: 40% unit and functional tests coverage.
Location: Room E104
13:30 – 17:00 AppSensor (Code) – Dashboard
The AppSensor v2.0.0 code implementation final release was undertaken in January. One of the tasks to continue with is the development of a reporting dashboard. This session is to brainstorm ideas and layouts for the dashboard, and identify what tools/libraries can assist in the creation of the dashboard. Bring ideas, energy, URLs, paper and pens! The outputs will be dashboard mockups.
• Introductions and objectives • Information requirements • User stories • Information design • Code libraries and frameworks.
Code roadmap: https://www.owasp.org/index.php/OWASP_AppSensor_Project#tab=Road_Map_and_Getting_Involved Microsite http://www.appsensor.org/
Location: Room E104
14:00 - 17:00 Hackademics - Student performance metrics visualization
Currently, the platform gathers student performance metrics in the form of how long it took them to solve challenges, how many requests, how much time idle e.t.c. However, the only way for a teacher to see the numbers is with database access.(The data is gathered for the advanced scoring functionality but it is also very useful as performance analytics). We plan to use graphing libraries to create interactive graphs to visualize the comprehension of the student performance. It's a simple front-end feature which will improve the usability of the platform.
Location: Room E104
17:00-18:00 OWASP Automated Threats to Web Applications Project - Website Owner Experiences
The OWASP Automated Threats to Web Applications Project is undertaking research and will publish its outputs immediately prior to AppSec EU 2015. This meeting seeks input from training and conference attendees on their own organisations' experiences of automated attacks:
• What types of automated attacks occur and with what frequency? • What were the symptoms? • How are they detected? • What incident response measures were taken? • What steps were undertaken to prevent or mitigate such attacks?
Participation/contribution can be anonymous or otherwise. The intention is to update the published documents during the session and if possible create additional sector-specific guidance.
Location: Room E104
10h00 - 13h00: OWASP OWTF Architecture Audit
During the past three years, OWTF has know a fast growth thanks to different GSoC projects. But the initial architecture is no more suited for the project nowadays. Identify the different elements of OWTF Define the inter-dependencies Estimate the accuracy of such dependencies Remove unnecessary dependencies Draw a better architecture for OWTF We expect to have a draft of the next architecture better suited for the needs of OWTF by the end of this session.
Location: Room E104
14h00 - 15h00: OWASP OWTF CLI Assessment
Over the past year, the development has been mostly focused on the improvement of the Web User Interface. A side effect is that currently the Command Line Interface (CLI) is broken and does not meet the objectives initially set. Test the CLI Report all commands/flags that are broken Find out the best features that the CLI should offer Gather the findings and draw a new standard for the CLI We expect to have a new standard for the CLI that will be implemented this year in order to enhance and fix its behaviors. This could be part of a GSoC project depending of the output of the session.
Location: Room E104
15h00 - 17h00: OWASP OWTF Hack It For Fun
The OWTF project is written in Python and we want to show how easy it is to hack into the code base. We propose a small workshop where the students would customize OWTF the way the want. Presentation of small code snippets Customize the console output Customize the web interface Competition about Implementing small features We expect to show how easy it is for students to hack into the code base of OWTF. As a reward, the winners of the competition will be offered nice goodies :)
Location: Room E104
Project Developments: The Good , The Bad and the Ugly
17:00 - 17:30 Open Forum with Project leaders Forum discussion with project leaders and Board==>(1 hour session)
- Why my project is not moving forward?
- What can be done to help improve my project?
- How to improve the actual situation of projects
- How to improve the review process
Deliverables:
- Collect information and create a report
- Use the session results and see how can we implement them
- Inform leaders about the actual process
Location: Room E104
