This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "BeNeLux OWASP Day 2016-2"
(→More details in the course description) |
(→OWASP BeNeLux Announcement) |
||
| Line 9: | Line 9: | ||
== OWASP BeNeLux Announcement == | == OWASP BeNeLux Announcement == | ||
| − | * The Call for speakers is | + | * The Call for speakers is closed! |
== Call for Speakers == | == Call for Speakers == | ||
Revision as of 19:29, 13 October 2016
OWASP BeNeLux Announcement
- The Call for speakers is closed!
Call for Speakers
OWASP AppSec conferences are true security conferences with all talks and presentations focusing on various areas of information security. Topics should focus on the technical and social aspects of security, and should not contain marketing or sales pitches.
We encourage and prioritize submissions covering research and new work impacting:
- Secure development of web applications.
- Security testing of web applications.
- Security of DevOps processes, architectures, and tools.
- Security of applications designed for mobile devices.
- Security of Internet of Things devices and platforms.
- Cloud platform security
- Browser security
- HTML5 security
- OWASP tools or projects in practice
Terms
By your submission you agree to the OWASP Speaker Agreement. It requires that you use an OWASP presentation template or other non-branded template. Presentations may not use company-themed decks or include a company logo except on the speaker bio slide. Failure to observe these requirements will result in talk removal.
All presentation slides will be published on the conference website. Pictures and other materials in presentations should not violate any copyrights. Presentation submitters are solely liable for copyright violations. You may choose any Creative Commons license for your slides, including CC0. OWASP suggests the use of open licenses.
We will cover your travel expenses or costs for accommodations.
Deadlines
- Submission of proposal closes: 11 September, 2016 – 23:59
- Notification of acceptance: 2 October, 2016
- Conference Date: 25 November, 2016
Submission
To submit a proposal, please submit an abstract of your intended presentation (500 to 4000 characters), a brief biography (150 to 800 characters) and a headshot (combine multiple files in one zip file). Your planned presentation time is 40 minutes (excluding ~5 minutes for discussion and change of speaker). Feel free to attach a preliminary version of your presentation if available. Any proposal submitted is subject to a democratic vote by the program committee. Keep in mind: The better your description of the talk, the better picture the program committee will have to review your submission. Please proofread your submission; after approval your abstract, biography, and headshot will be published verbatim into the program and website.
Submission page: https://easychair.org/conferences/?conf=owaspbenelux162
Confirmed speakers Conference
The OWASP BeNeLux Program Committee
- Bart De Win / Sebastien Deleersnyder/ Lieven Desmet/ David Mathy, OWASP Belgium
- Martin Knobloch, OWASP Netherlands
- Jocelyn Aubert, OWASP Luxembourg
Tweet!
Event tag is #owaspbnl16
Donate to OWASP BeNeLux
OWASP BeNeLux training day and conference are free, but registration is required!
To support the OWASP organisation, consider to become a member, it's only US$50!
Check out the Membership page to find out more.
Venue is
Hosted by iMinds-Distrinet Research Group (KU Leuven).
Address:
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee
How to reach the venue?
By car
By train
Hotel nearby
Trainingday is November 24th
Location
Agenda
| Time | Description | Room 4.320 | Room 4.350 | Room 4.360 | Room 4.400 |
|---|---|---|---|---|---|
| 08h30 - 9h30 | Registration | ||||
| 09h30 - 11h00 | Training | Breakers, defenders and superheroes! by Riccardo ten Cate |
Handling of Security Requirements in Development Lifecycle by Daniel Kefer |
PWN Android Apps with your Custom Built Toolbox by Steven Wierckx |
Forth training |
| 11h00 - 11h30 | Coffee Break | ||||
| 11h30 - 13h00 | Training | ||||
| 13h00 - 14h00 | Lunch | ||||
| 14h00 - 15h30 | Training | ||||
| 15h30 - 16h00 | Coffee Break | ||||
| 16h00 - 17h30 | Training | ||||
Trainings
Breakers, defenders and superheroes!
In the wonderful world of application security we often learn to break stuff or we learn how to prevent hackers from breaking your stuff. In this training i would love to adres some basic and advanced topics and not only teach developers how to properly test their code like a penetration tester, but also learn the penetration tester to think like a developer so they really can deliver added value when instructing developers on how to fix their code like a baws!
Some of the topics i would like to adresss are:
- Content security policy and how to defeat it with HTML injections
- Advanced cross site scripting
- Cross site request forgery
- Mass Assignment (Parameter binding) attacks
- External entity attacks
- Path/directory traversal attacks (File inclusion attacks)
- File upload injections
- Server side template injections
- Authentication and authorization
Handling of Security Requirements in Development Lifecycle
The bigger the company you're working in, the more technologies and methodologies used by development teams you are going to face. At the same time, you want to address security risks in an appropriate, reliable and traceable way for all of them.
After a short introduction of a unified process for handling security requirements in a large company, the main part of the talk is going to focus on a tool called SecurityRAT (Requirement Automation Tool) which has been developed in order to support and accelerate this process. The goal of the tool is first to provide a list of relevant security requirements according to properties of the developed software, and afterwards to handle these in a mostly automated way - integration with an issue tracker being used as a core feature.
The tool was open sourced in May 2016 (available at https://github.com/SecurityRAT) and is continuously being further developed since then. The newest implemented features, work in progress and future plans will form the last part of the talk.
PWN Android Apps with your Custom Built Toolbox
Frustrated with the various tools and environments needed to perform mobile pentesting? All available Android test distributions have drawbacks and missing and/or non-working tools etc. Learn how to create your own customized mobile pentesting toolbox with the tools you really want/need.
Not sure which steps to follow when performing a mobile application security assessment? Our renowned trainer, Steven Wierckx, will show you which steps to follow and what issues to focus on.
More details in the course description
Download the full training description
Trainers
Riccardo ten Cate
As a penetration tester and software developer from the Netherlands Riccardo is specialized in web-application security and has extensive knowledge in securing web applications in multiple coding languages.
Daniel Kefer
Daniel has been working in the application security field since 2007. Having started as a penetration tester, he soon became passionate about proactive security efforts and working closely with developers. Since 2011 he has been working for 1&1 where he focuses on design and continuous improvement of the internal secure SDLC process and its implementation in different development departments. Apart from 1&1, he also works as a volunteer for the OWASP SAMM project.
Steven Wierckx
I’m a Software and Security Tester with 15 years of experience in programming, security testing, source code review, test automation, functional and technical analysis, development and database design. I’m a team player with a constant drive to learn new things. I have a passion for web application security and I write articles for several professional magazines with regards to that topic. I have created several courses on testing software for security problems and I teach courses on secure coding, security awareness, security testing and threat modelling.
Conferenceday is November 25th
Agenda
| Time | Speaker | Topic | Presentation |
|---|---|---|---|
| 08h30 - 09h00 | Registration | ||
| 09h00 - 09h15 | Opening | ||
| 09h15 - 10h00 | 1st Speaker | 1st talk | TBD |
| 10h00 - 10h45 | 2nd Speaker | 2nd talk | TBD |
| 10h45 - 11h15 | Morning Break | ||
| 11h15 - 12h00 | 3rd Speaker | 3rd talk | TBD |
| 12h00 - 12h45 | 4th Speaker | 4th Talk | TBD |
| 12h45 - 13h45 | Lunch | ||
| 13h45 - 14h30 | 5th Speaker | 5th Talk | TBD |
| 14h30 - 15h15 | 6th Speaker | 6th Talk | TBD |
| 15h15 - 15h45 | Break | ||
| 15h45 - 16h30 | 7th Speaker | 7th Talk | TBD |
| 15h15 - 15h45 | Closing | ||
Talks
Placeholder
Speakers
Placehoder
Speaker information comes here
Social Event,starting at 7PM
Social Event information
Become a sponsor of OWASP BeNeLux
There are 3 combined sponsorship packages (Gold, Silver or Bronze) that cover the BeNeLux chapter meetings 2017 and the BeNeLux OWASP Days 2016 in Leuven.
Download our sponsor brochure here and contact us for questions or sponsorship confirmation!
Your sponsorship will be invested directly in the chapter meetings, supporting speaker and catering expenses.
The sponsorship will also be dedicated to cover the costs of the OWASP 2016 BeNeLux event.
Hosted and co-organized by
Made possible by our Sponsors
