This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Bucharest AppSec Conference 2018 Workshops"
Oana Cornea (talk | contribs) |
Oana Cornea (talk | contribs) |
||
| Line 45: | Line 45: | ||
'''Intended audience:''' developers, security professionals <br> | '''Intended audience:''' developers, security professionals <br> | ||
'''Skill level:''' intermediate <br> | '''Skill level:''' intermediate <br> | ||
| − | '''Requirements:''' | + | '''Requirements:''' for optimal benefit, participants should have a good knowledge of the OAuth and OIDC frameworks <br> |
'''Seats available:''' 20 (first-come, first served)<br> | '''Seats available:''' 20 (first-come, first served)<br> | ||
'''Price: '''free <br> | '''Price: '''free <br> | ||
[https://www.eventbrite.com/e/owasp-bucharest-appsec-conference-2018-tickets-47960216298 Register here] | [https://www.eventbrite.com/e/owasp-bucharest-appsec-conference-2018-tickets-47960216298 Register here] | ||
|} | |} | ||
Revision as of 06:40, 20 August 2018
Workshop | |||||
| Time | Title | Trainers | Description | ||
| Workshop 25th of October 3,5 hours: begins at 09:00 |
Automated CI Pipelines using ZAP, Docker and static code analysis | Spyros Gasteratos | Description: In this workshop we will go through customizing ZAP's docker images and some static code analysis scripts to work with GitLab CI so that it automatically tests the deployed web application. Moreover we will write an example ZAP orchestration script to better test specific parts of the example application.
At the end of the workshop the attendees will have example configuration files, orchestration scripts, rules and Dockerfiles for all tools used. | ||
| Workshop 25th of October 3 hours: begins at 13:30 |
OAuth and OpenID Connect best practices |
Johan Peeters | Description: OAuth and OpenID Connect (OIDC) quickly became dominant in the API economy. Was this because they were shiny new toys or are they really superior to older protocols for obtaining authorization and identity information such as SAML? While SAML was designed for the enterprise, OAuth and OIDC’s creation myth is from a different universe: it gives social media users the possibility to delegate limited access to partially trusted clients. Since, OAuth and OIDC have been employed well beyond the confines of social media. Consequently, a good deal of creativity to adapt a protocol designed for Discretionary Access Control (DAC) in a social media context to enterprise Mandatory Access Control (MAC) requirements has been observed - I cannot help feeling the wheel has been reinvented many times over. In this workshop, we discuss some of the design patterns that have come to the fore and reflect on the road ahead. What standard updates can we expect? Should we be compiling best practices? If so, what do they contain?
Intended audience: developers, security professionals | ||
