Difference between revisions of "OWASP New Zealand Day 2019"

Conference Committee

So, far, a fair few kind souls have stepped up to help out:

• John DiLeo - Conference Chair, OWASP New Zealand Leader (Auckland)
• Lech Janczewski - Conference Host Liaison, on-site Health & Safety contact - Associate Professor, University of Auckland School of Business
• Tess Brothersen
• Austin Chamberlain
• Teresa Chan
• Paul Howarth
• Toni James
• Arshad Khan
• Brendan Laing
• Stephen Sherry
• Anneke Smitheram
• Anthony Vargo
• YOU - We are looking for volunteers to help make this our most successful conference yet!

Training

In addition the main conference on Friday, we are pleased to be offer three training opportunities on Thursday, at the same venue. Course details, including registration, are as follows:

Real-World Penetration Testing

Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 5:30 p.m.
Instructors: Vivek Ramachandran and Nishant Sharma
Instructors' Organisation: Pentester Academy
Registration Fee: $500.00
Training Registration Page

Are You a Secure Code Warrior?

Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 12:30 p.m.
Instructor: Jaap Karan Singh
Instructor's Organisation: Secure Code Warrior
Registration Fee: $250.00
Training Registration Page

Threat Modelling: Getting from None to Done

Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 5:30 p.m.
Instructor: Dr. John DiLeo
Instructor's Organisation: OWASP New Zealand Chapter
Registration Fee: $500.00
Training Registration Page

Spaces are going fast, so get in quickly!

Check-in desk will open at 8:00 a.m.

Morning and afternoon tea breaks will be provided; lunch will be on your own.

Presentations

Presentation Abstracts and Speaker Biographies

Track One - Morning (09:20 - 12:10)

Exploiting Vulnerabilities from the OWASP Top 10: SQLi, XSS, XXE, File Injection

David Waters and Kieran Molloy - Pushpay

Abstract

We will give a brief introduction to a selection of the OWASP Top 10 and then demonstrate the exploitation of each of these vulnerabilities using tools and hand crafted attacks. We will also demonstrate how a combination vulnerabilities can be chained together by an attacker.

Speaker Biographies

David is a Senior Software Engineer/Tech Lead and one of the leaders of the Secure Coding Guild at Pushpay, David previously worked for 3 years in the security industry including 1 year in the Security Team at Google in London and draws on 20 years experience as a systems and web developer, primarily working in .NET, Java and JavaScript.

Kieran is a developer with an interest in security.

Threat Modelling When You've Never Done It Before

Kade Morton - Quantum Security

Abstract

Through the Mozilla Open Leaders program I mentored a project from Asuntos del Sur, a humans right group that operates across South America. This is the story of my crash course in basic threat modelling, and how that basic knowledge is now helping activists across South America.

Speaker Biography

Kade is a consultant with Quantum Security. When not doing information security stuff, he volunteers with Mozilla.

That Vulnerability Looks Quite Risky

Peter Jakowetz - Quantum Security

Abstract

Technical findings are great, and finding vulnerabilities in your software so you can fix them is key to ensuring safe and secure code. However what about those things you can’t fix? Do they seem too expensive or hard? This talk will discuss the best way to manage these issues using risk management.

Speaker Biography

Peter is an electrical engineer turned security consultant from Wellington, NZ. Certified in many-a-thing, he spends a good chunk of time working on PCI, ISO and NZISM audits, and making security findings readable to senior management. In his spare time, he enjoys playing with open-source hardware and software, poking cars, and breaking things.

Mob Learning Using the OWASP Top 10 and 30 Days of Security Testing

Mike Clarke - Erudite Software

Abstract

Not sure how to get started learning about security? Why not team up with a group of others in the same boat and learn together?

After learning the basics of the OWASP Top Ten, I took part in the 30 Days of Security Testing challenge through WeTest with 100+ other software testers new to security. My talk is about how a small idea turned into an online workspace of over 100 people new to InfoSec, a series of great Meetups, and lessons learned along the way.

Speaker Biography

I’ve always been interested in IT and fascinated by information security. I worked for the Royal New Zealand Navy as a Communications Warfare Specialist before trying my hand at software testing. I’m currently working for Erudite Software in Auckland, as the sole tester in a development team largely focused on healthcare software solutions. I’ve recently signed on as an organiser for WeTest Auckland, where we throw together Meetups and online challenges to learn about testing.

How Can OWASP SAMM Help You Build More Secure Software?

Mohamed Hassan - Aura Information Security

Abstract

Have you ever wondered why you or your team keep having high and critical security vulnerabilities in your software? Why you didn't discover these vulnerabilities earlier than two weeks before going life? How penetration testing can be effective when you're changing your software every two weeks? Can security be easier? How can you embed security into your software life cycle? How do you know if security initiatives are paying off? This talk will answer these questions and more!

Speaker Biography

Mohamed has been a penetration tester for more than six years. Mohamed has delivered security training to developers, in New Zealand and internationally. He also helps organisations embed more security into their software development lifecycle. In his free time, Mohamed likes to keep active and enjoy New Zealand’s landscape.

Track Two - Morning (09:20 - 12:10)

Virtual Patching: Does It Work?

Kirk Jackson - RedShield

Abstract

Writing secure applications is hard, and often vulnerabilities are found after your application has already been released to production.

But what happens if you’re not able to fix the vulnerabilities quickly? Wouldn’t it be great if the someone else could secure your website for you?

Speaker Biography

Kirk works at RedShield, leads the OWASP Wellington-area Meetup, and has previously helped organise the annual OWASP NZ Day in Auckland.

Kirk worked as a Web developer before switching to the defence team - setting up Xero’s security practice, working as a pen tester, and in defence roles at several companies.

Cloud Catastrophes and How to Avoid Them

Mike Haworth - Insomnia Security

Abstract

Cloud and traditional infrastructure are different and sometimes the consequences of not changing mindset can be.. unpleasant.

Speaker Biography

Mike is a Principal Consultant for Insomnia Security, based in Wellington. He likes pentesting most things, and is rubbish at writing bios.

JWAT: Attacking JSON Web Tokens

Louis Nyffenegger - Pentester Lab

Abstract

Nowadays, JSON Web Tokens are everywhere. They are used as session tokens or just to pass data between applications or µservices. By design, JWT contains a high number of security and cryptography pitfalls. In this talk, we are going to learn how to exploit (with demos) some of those issues.

Speaker Biography

Louis is a security engineer based in Melbourne, Australia. He performs pentest, architecture and code review. Louis is the founder of PentesterLab, a learning platform for Web penetration testing. Recently, Louis talked at OWASP AppSecDay Melbourne, and ran two workshops at DEF CON 26, in 2018.

Security Regression Testing on OWASP ZAP Node API

Kim Carter - BinaryMist

Abstract

The OWASP ZAP HTTP intercepting proxy is useful for manually attacking your Web apps and APIs. Now, we have the official Node API to programatically drive ZAP to regression test our creations. I’ll show you how to build a fully featured security regression testing CLI, consumable by your CI/nightly builds.

Speaker Biography

Kim is a Technologist / Engineer, Information Security Professional, Entrepreneur, and the founder of BinaryMist Ltd. He is one of the OWASP NZ Chapter leaders and a Certified Scrum Master. Facilitator, mentor and motivator of cross functional, self managing teams. With a solid 17 years of commercial industry experience across many domains, Kim enjoys teaching others how to apply information security to their Agile processes, bringing the security focus up front where it’s the cheapest to implement, increasing profit and reducing costs. Co-organiser of the Christchurch Hacker Con, International trainer, speaker, published author, and Software Engineering Radio podcast host, focusing on software and network architecture, Web development and engineering, and information security. Kim is also a regular blog poster. Kim loves designing and creating robust software and networks, breaking software and networks, then fixing them and helping organisations increase productivity.

Track One - Afternoon 1 (13:30 - 15:30)

NoHolidayChurchGenius: Password Security with 2020 Vision

Antonio Radich - Quantum Security

Abstract

This season's passwords are now in fashion, similar to last year's, with one difference. Passwords are a staple in the developer toolkit. Developers follow guidelines put out by NIST or the GCSB. Users are ‘efficient’. With everyone striving for the minimum, we can already see "Winter (2019) is coming…"

Speaker Biography

Antonio has been with Quantum Security, as a Security Consultant performing penetration tests and security audits, for two years. He is interested in red teaming, post exploitation, and general security on an organisation level.

Sharing Is Caring: A Beginner's Guide to Security in the Cloud

Petra Smith - Aura Information Security

Abstract

Thinking of moving your applications to the cloud? How do you make sure they stay secure? This fast, fun, beginner-friendly session will demystify cloud security, introduce you to the most common cloud security models, and help you to choose the model that’s right for you.

Speaker Biography

Petra grew up wanting to be Sailor Mercury – the awkward blue-haired one from Sailor Moon who used computers to protect the world from evil. Now she’s a purple-team security consultant at Aura Information Security, which you have to admit is pretty close. She loves to teach people to pick locks, and gets kind of ranty about privacy, trust, and making digital spaces safe and inclusive for everyone.

Eating the Elephant: Application Security When You Aren't a Startup

Stephen Morgan - Westpac New Zealand

Abstract

DevSecOps, AppSec Engineers, and Continuous Integration Security are a panacea, but how do older institutions with many legacy systems and technical debt even begin to tackle agile application security practices? We will explore ways that you can start working with your developers write secure code.

Speaker Biography

Stephen is an Information Security Consultant at Westpac New Zealand where he wrangles Pen Testers, reviews codes, and diminishes his rapport with developers. He has worn many hats including those of a Customs Officer, Penetration Tester, Java Developer, and (cough) IT Auditor.

What's In a Name? Law of Agency and Domain Name Registrations

Judy Ting-Edwards - Ports of Auckland

Abstract

Have you ever hired Web developers to make a Web site for you but then find out that you don’t actually own the domain name when you checked on whois? Find out why this is the case and how we (maybe) should be doing domain name registrations by taking a leaf from the law of agency’s book.

Speaker Biography

Judy has been registering domain names since 2013 when she was a junior lawyer for a stingy boss. She has recently changed careers to work in infosec, with a special interest in policy and appsec. As a part of a recent web hygiene audit, she discovered inconsistencies in how web devs register domain names in the industry and would like to see the industry come together with a best practice guideline. Risk management has been a constant in both her careers and she is always open to discussions on policies to embrace technology and reduce risks for the business at the same time.

Track Two - Afternoon 1 (13:30 - 15:30)

How to Lose a Container in 10 Minutes

Sarah Young - Microsoft

Abstract

Moving to the cloud and deploying containers? In this talk I discuss both the mindset shift and tech challenges, with some common mistakes made in real-life deployments. We’ll also look at what happens to a container that’s been left open to the Internet for the duration of the talk.

Speaker Biography

Sarah is a security architect based in Melbourne. She has a decade of experience in tech and is particularly interested in cloud security, container security and good ol’ fashioned networking and infrastructure security (having previously worked as a network engineer). In her current role, Sarah helps enterprises move into the cloud securely, design their secure pipeline and adopt automated security processes. Sarah spends most of her spare time speaking at security conferences in various parts of the world, eating hipster brunches and high teas and spending a disproportionate amount of her income on travel. She is still holding out hope that - despite the obvious blockers - either Justin Trudeau or Prince Harry will become her husband one day.

CI Can Make $$$ from Thin Air

Sajeeb Lohani - Privasec

Abstract

This talk covers how people can utilise free tools, outside of their intended use case, in a malicious way. Using TravisCI as an example, we will look into what essentially can become a distributed super computer, to mine bitcoins and distributed denial of service attacks free of any cost whatsoever.

Speaker Biography

Sajeeb is a penetration tester at Privasec, with years of prior development experience. Having graduated from Monash University with a Bachelor of Software Engineering (Honours) in 2017, Sajeeb remains passionate about contributing to and improving cyber security research. Sajeeb gives back regularly to the Melbourne cyber security community by founding the Monash Cyber Security Club, presenting at SecTalks, and mentoring at the Australian Women in Security Network (AWSN) Cadets workshops. Sajeeb also runs initiatives which attempt to responsibly disclose security issues within open source software projects, making the world of software ‘more secure’.

Introduction to Building Secure Electron Applications

Nawaz Gayoom - Provoke Solutions

Abstract

Electron is a popular framework for building desktop apps and is used by many prominent companies today. To build a production-ready Electron app, there are certain security considerations we need to take into account, if we are loading any external content on it.

Speaker Biography

Nawaz is a software developer at Provoke Solutions mostly working on web applications for the past 3 years. In this digital age with increasingly complex systems, it is a personal passion of mine to keep information secure and accessible. Apart from enjoying researching about security and sharing things that I learn along the way while in projects for my clients I do spend some (probably a little more than that) time watching Netflix as well. Other things I like doing include singing, surfing and sampling food.

Track One - Afternoon 2 (16:00 - 18:00)

How Do I Content Security Policy?

Kirk Jackson - RedShield

Abstract

Content Security Policy (CSP) helps you secure your Web site, by declaring which javascript and resources it uses. This means that XSS attacks will be greatly limited.

However, setting up CSP on an existing Web site is hard. We’ll discuss an easy approach that you can follow to set up CSP.

Speaker Biography

Kirk works at RedShield, leads the OWASP Wellington-area Meetup, and has previously helped organise the annual OWASP NZ Day in Auckland.

Kirk worked as a Web developer before switching to the defence team - setting up Xero’s security practice, working as a pen tester, and in defence roles at several companies.

OWASP Software Assurance Maturity Model (SAMM) 2.0

John DiLeo - Orion Health

Abstract

The OWASP SAMM Project Team recently release a Beta version of SAMM 2.0, which is currently open for comment. The model provides a framework for assessing the maturity of an organisation’s software assurance program, and identifying areas for future emphasis in improving the security of their development practices. This talk will provide an overview of the model, the benefits that can be realised by organisations utilising the model, and the process for assessing the maturity of the organisation’s software assurance program.

Speaker Biography

John is one of the co-leaders of the OWASP New Zealand Chapter. He moved to Auckland, from the United States, in 2017, and now works as Orion Health's Application Security Architect. John's focus is on developing and managing enterprise-wide Software Assurance Programmes, including the assessment of the organisation's maturity and building a roadmap to improve. This led him to join the core team of the OWASP SAMM project, where he helped to create the new model.

Before moving into application security, John worked as a solution architect, a Web development lead, and in developing discrete-event simulations of distributed systems. Along the way, he's also worked as a college instructor, trainer, and general IT consultant.

Why 'Positive Security' Is the Next Software Security Game Changer, and How to Do It

Jaap Karan Singh - Secure Code Warrior

Abstract

A 2017 report based on 400,000 application scans reported that only 30% passed the OWASP Top 10 policy. This presentation showcases the principles and practice of “positive security” and explains why it is an important game changer that will substantially improve application security.

Speaker Biography

Jaap Karan Singh is the Co-Founder and Chief Singh of Secure Code Warrior, a global security company that makes software development better and more secure. After security testing at BAE Systems in Australia, Jaap moved from hacking Web applications to educating developers on how to protect their own applications. Jaap has delivered training on web application security concepts and run workshops at Australian financial and telecommunications organisations in Australia. He specialises in Javascript technologies such as HTML5, Node, Express and Mongo. He recently created and delivered a course on hacking and protecting modern Javascript applications at OWASP AppSec EU 2016.

Track Two - Afternoon 2 (16:00 - 18:00)

Hardening Your Docker Infrastructure

Kim Carter - BinaryMist

Abstract

The security defaults of Docker are designed to get you up and running (“just work”) quickly, rather than being the most secure. There are many default configurations that can be improved upon. In this talk we’ll walk through improving the security of Docker hosts, containers, networking, and deployments.

Speaker Biography

Kim is a Technologist / Engineer, Information Security Professional, Entrepreneur, and the founder of BinaryMist Ltd. He is one of the OWASP NZ Chapter leaders and a Certified Scrum Master. Facilitator, mentor and motivator of cross functional, self managing teams. With a solid 17 years of commercial industry experience across many domains, Kim enjoys teaching others how to apply information security to their Agile processes, bringing the security focus up front where it’s the cheapest to implement, increasing profit and reducing costs. Co-organiser of the Christchurch Hacker Con, International trainer, speaker, published author, and Software Engineering Radio podcast host, focusing on software and network architecture, Web development and engineering, and information security. Kim is also a regular blog poster. Kim loves designing and creating robust software and networks, breaking software and networks, then fixing them and helping organisations increase productivity.

Reverse Engineering Mobile Apps: Why, What, and the Hows

Karan Sharma

Abstract

I’d like to talk about why Reverse Engineering mobile apps is important for an organisation, what can you discover while reversing an app and how can you apply those lessons to add an additional layer of defense while building your future apps.

Speaker Biography

Karan started his career as a network engineer before moving into information security field 8 years ago. He is working as a security consultant for one of the leading financial institutes of NZ. He has a true passion for breaking & fixing web/mobile apps. He enjoy doing app reversing in his free time and love sharing his knowledge with others.

Serverless Authentication with JWT

Mehul Patel

Abstract

Authentication is one of the big parts of every application. Security is always something that is changing and evolving. In this talk, I will cover what JSON Web Tokens (JWTs) are and why using JWTs in your applications when it comes to security is awesome.

Speaker Biography

Hi, I’m Mehul Patel and I specialize in Information Technology and Services. I’m passionate about what I do. I am a Developer Tech by profession, an open source enthusiast, Linux geeky and a maker by heart. I hold Masters in Computers Science and have been working relentlessly and contributing towards the open source community in all ways I can.

I am an active member of the Mozilla Community which is a program run by a group of highly trained & passionate Mozillians(Tech enthusiasts), who share technical knowledge about Firefox, Mozilla, OpenSource and the Web at various regional developer-facing events. Currently, I am acting as a Rust Mobilizer in the community and trying best to aware people about this awesome and secure programming language. I am also part of other opensource peers like WordPress, Red Hat Linux, Debian, OpenStack, Auth0 and much more.

I also represent Mozilla while being on the Campus Advisory Committee, a Reps Mentor and ambassador at Auth0. I have been invited as a Technical Speaker at Google DevFest, LinuxCon, Open Innovation Summit, MozFest, GNUnify’18 and so on to share and educate tech enthusiasts regarding opensource technologies Like Red Hat, WordPress, Rust, Virtualization, server securities & hardening and much more.

Call For Sponsorships

OWASP New Zealand Day 2019 will be held in Auckland on the 22nd of February, 2019, and is a security conference entirely dedicated to application security. The conference is once again being hosted by the University of Auckland with their support and assistance. OWASP New Zealand Day 2019 is a free event, but requires sponsor support to help be an instructive and quality event for the New Zealand community. OWASP is strictly not for profit. The sponsorship money will be used to help make OWASP New Zealand Day 2019 a free, compelling, and valuable experience for all attendees.

The sponsorship funds collected are to be used for things such as:

• Venue - Room use and on-site management fees
• Name tags - We feel that getting to know people within the New Zealand community is important, and name tags make that possible
• Promotion - We would like to reach a wider audience, by utilising paid advertising for the event
• Printed Materials - Printed materials will include program information, room signs, and lanyards
• Recognition items for speakers and trainers
• Morning and afternoon tea, to promote a congenial environment for networking among application security professionals

Facts

Last year, the event was supported by seven sponsors and attracted more than 700 registrations. Plenty of constructive (and positive!) feedback from the audience was received, and we are using this to make the conference more appealing to more people. For more information on the last New Zealand Day event, please visit: https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2018

The OWASP New Zealand community is strong, with more than 500 people currently subscribed to the mailing list (sign up). OWASP New Zealand Day is expected to attract between 900 and 1000 attendees this year.

OWASP regular attendees are IT project managers, IT security managers, IT security consultants, Web application architects and developers, QA managers, QA testers and system administrators.

How to Become a Sponsor

All financial matters related to the conference, including Sponsorship Agreements and payments, are handled through the OWASP Foundation. To express interest in supporting the conference as a sponsor, please contact us by email.

Premium Sponsorship Packages

A La Carte Sponsorship Opportunities

1. Morning and Afternoon Tea Breaks - Conference Day

Sponsorships Available: Four (4)

General Rate: $4,500

Benefits:

• Opportunity to display your company's banner in the conference lobby (see notes below) throughout the day of the conference
• Recognition as sponsoring provider, on signs displayed on service tables during tea breaks
• Sponsor logo printed on attendee badges
• Sponsor logo printed on Room Signs
• Single-colour sponsor logo imprinted on conference tote bags
• Sponsor logo displayed on conference Web page, alongside Platinum Sponsors
• Opportunity to include 150-word company description in About Our Sponsors section of conference Web page
• Written recognition as a leading sponsor, in pre-event publicity communications
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

2. Pre-Conference Reception

On the Thursday evening, the OWASP New Zealand Day Committee will host a reception for speakers, trainers, conference volunteers, and Premier Sponsors. The event will be held at an establishment near the conference venue.

Sponsorships Available: Two (2)

General Rate: $2,000

Benefits:

• Opportunity to display your company's banner at the reception venue (see notes below) during the reception
• Opportunity to address reception attendees, as "hosting" sponsor of reception
• Recognition as sponsoring provider, on signs displayed on service tables/bars during reception
• Sponsor logo printed on Room Signs
• Single-colour sponsor logo imprinted on conference tote bags
• Sponsor logo displayed on conference Web page, alongside Silver Sponsors
• Opportunity to include 100-word company description in About Our Sponsors section of conference Web page
• Written recognition as a leading sponsor, in pre-event publicity communications
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

3. Conference Tote Bags for Attendees

Sponsorships Available: One (1)

General Rate: $1,800

Benefits:

• Single-colour sponsor logo printed on the Conference Tote Bags, along with those of Platinum, Gold, and Silver Sponsors
• Sponsor logo printed on Room Signs
• Sponsor logo displayed on conference Web page
• Opportunity to include 50-word company description in About Our Sponsors section of conference Web page
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

4. Lanyards for Attendee Badges

Sponsorships Available: One (1)

General Rate: $1,800

Benefits:

• Single-colour sponsor logo printed on the Attendee Lanyards, along with the OWASP logo
• Sponsor logo printed on Room Signs
• Sponsor logo displayed on conference Web page
• Opportunity to include 50-word company description in About Our Sponsors section of conference Web page
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

5. Speaker Gifts

Sponsorships Available: One (1)

General Rate: $1,500

Benefits:

• Sponsor logo printed on Room Signs
• Single-colour sponsor logo imprinted on conference tote bags
• Sponsor logo displayed on conference Web page, alongside Silver Sponsors
• Opportunity to include 50-word company description in About Our Sponsors section of conference Web page
• Written recognition as a leading sponsor, in pre-event publicity communications
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

6. Morning and Afternoon Tea Breaks - Training Day

Sponsorships Available: Two (2) --Funded, no longer available

General Rate: $750

Benefits:

• Opportunity to display your company's banner in the training facility lobby (see notes below) throughout the training day
• Recognition as sponsoring provider, on signs displayed on service tables during training day tea breaks
• Sponsor logo displayed on conference Web page, alongside Bronze Sponsors
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

7. International Travel Support

As part of the submission process for presentations, prospective presenters from outside New Zealand are given the opportunity to indicate if they will need travel support to be able to attend OWASP New Zealand Day. Each International Travel Support sponsorship is intended to provide a maximum of $2,500 for one international presenter's travel expenses related to attending, and presenting at, the conference. Supported travel expenses may include: return airfare from the airport nearest the presenter's residence to Auckland, two nights' accommodation in a lodging near the conference venue, and return shuttle transportation between the Auckland airport and the accommodation.

Sponsorships Available: No Limit

General Rate: $2,500

Benefits:

• Sponsor logo displayed on conference Web page, alongside Gold Sponsors
• Opportunity to include 100-word company description in About Our Sponsors section of conference Web page
• Opportunity for sponsor representative to introduce sponsored presenter
• Written recognition as a leading sponsor, in pre-event publicity communications
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

8. Diversity Fund

The OWASP New Zealand Day Diversity and Financial Aid Fund has been established to provide financial assistance to students at New Zealand universities. Each Diversity Fund sponsorship is intended to cover travel expenses for one New Zealand student, from outside the Auckland area, who will be attending or presenting at the conference. Each Diversity Fund support recipient will receive funding for return airfare from their nearest domestic airport to Auckland International Airport, two night's accommodation in a lodging near the conference venue, and return shuttle transportation between the airport and the accommodation.

Sponsorships Available: No Limit

General Rate: $750

Benefits:

• Sponsor logo displayed on conference Web page, as a Diversity Fund Sponsor
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

9. Door Prizes

At the closing session of the conference, the OWASP New Zealand Day Committee will conduct a series of random drawings, awarding donated items to attendees, who must be present to win. There is no minimum or maximum value required for donated items, nor is the number of items provided subject to any limit. It is recommended that items provided be of interest to the conference's target audience, rather than of a generic nature.

Sponsorships Available: No Limit

General Rate: In-Kind Donation

Benefits:

• Verbal recognition, at the time of the prize drawing, as the donor of the prize

10. Other Supporting Sponsorships

If your company would like to provide special items to attendees, funding for paid promotional advertising for the event, or other items that we haven't yet thought of, you are welcome to contact us to discuss your ideas.

Sponsorships Available: No Limit

General Rate: In-Kind Donation

Benefits:

• Sponsor logo displayed on conference Web page, as a Supporting Sponsor
• Visual and verbal recognition of sponsor at opening and closing sessions of conference

Notes

Sponsor Logos:

• Logos are to be provided by the respective sponsors, as digital files (JPEG and PNG preferred)
• Logos provided should be full colour
• For lanyards and tote bags (including Platinum/Gold/Silver Sponsors), a single-colour version of the logo should also be provided, in a separate file. If a single-colour version of the logo is not provided by the sponsor, the OWASP New Zealand Day Committee reserves the right to electronically convert the full-colour logo to a single-colour version, or omit the sponsor's logo from the imprinted items if that proves infeasible.

Sponsor Banners:

• Lobby and stage-side banners are to be provided by the respective sponsors, must be free-standing, and their size is subject to approval by the OWASP New Zealand Day Committee.
• The conference venue includes two tracks, conducted in separate auditoriums; Platinum Sponsors may display one banner to the side of each auditorium's stage; Gold Sponsors may display a banner to the side of the stage in one auditorium. Gold Sponsors may express an auditorium preference, but final locations are at the discretion of the OWASP New Zealand Day Committee.
• There will be a maximum of four (4) sponsor banners displayed in each auditorium, with placement priority given to Platinum Sponsors.

Promotional Items:

• Printed materials are limited in dimensions to A4 size - either a single sheet, printed on one or both sides; or a single A3 sheet, folded in half
• Small imprinted items are also acceptable - pens, stress balls, USB keys, fidget spinners, etc.
• Design of printed materials and imprinted items are subject to approval by OWASP New Zealand Day Committee
• RECRUITMENT: In addition to the promotional item allowances included in Premium Sponsorship Packages, any sponsor may provide one A5-size card with information on actual current vacancies for which candidates are actively being sought

All amounts listed are in New Zealand dollars (NZD)

Diversity and Financial Aid fund

Thanks to the generous support of our lovely sponsors, we have some funding available to help people from around New Zealand attend the OWASP NZ Day, who would otherwise find it hard to attend. In particular, we welcome applications from women, people of colour, LGBTIQ, and all others. You all deserve to be able to learn more about security, and we’ll do our best to help make that happen!

Our funds are limited, and we’ll be reviewing applications every week, starting at the end of January. Submit your application soon, so we can approve them promptly, and you’ll be in several review cycles!

Process:

• Fill out our Application Form
• We will review and approve applications each week. The first reviews will be completed by 29 January.
• We will contact all applicants and let them know the result of the review.
• Successful applicants will be contacted to help sort things out.

We use the following criteria to help us decide who gets approved:

• We are biased towards (but not exclusively for) diverse applicants.
• We do attempt to maximise cost efficiency and will aim to get as many people to OWASP as possible, with our limited funds.

Each successful recipient can choose whether to be kept anonymous (in which case only the OWASP NZ committee will know the details of your funding), or to be put in touch with the supporting company whose sponsorship is going towards your attendance. We think some of our sponsors may enjoy the opportunity to chat with you on the day talk about your experiences and plans for the future, but that’s totally optional and up to you.

If you have any questions, feel free to drop us an email: john.dileo@owasp.org

Code of Conduct

We want to make the OWASP NZ Day a welcoming environment for all attendees. To that end, we would like to remind you that all activities associated with this event are subject to OWASP's Conference Policies. At their core, these policies are intended to promote and maintain an inclusive, welcoming environment for all participants - actions detrimental to that environment are unwelcome.

Speakers, trainers and sponsors have all been reminded of these policies, and are expected to abide by them like all attendees.

If you have any concerns during the day, please seek out John, Austin, or Brendan. We will make ourselves visible at the start of the day, so you know what we look like.

Call for Presentations

UPDATE: The Call for Presentations is now CLOSED. The committee is reviewing the proposals received, and will be notifying submitters of their selection status shortly.

OWASP New Zealand Day conferences attract a high quality of speakers from a variety of security disciplines, including architects, Web developers and engineers, system administrators, penetration testers, policy specialists and more.

We would like a variety of technical levels in the presentations submitted, corresponding to the three focus areas of the conference:

Track One:

• Introductions to various Information Security topics, and the OWASP projects
• Policy, Compliance and Risk Management

Track Two:

• Technical topics

Introductory talks should appeal to an intermediate to experienced software developer, without requiring a solid grounding in application security or knowledge of OWASP projects. These talks should be engaging, encourage developers to learn more about information security, and give them techniques that they can immediately return to work and apply to their jobs.

This being an OWASP conference, the selection process for talks in Track One will give priority to those related to OWASP's Projects, Tools, and Guidance (check out the current [OWASP Project Inventory](https://www.owasp.org/index.php/Category:OWASP_Project#tab=Project_Inventory) for more information). If multiple submissions are received related to the same OWASP Project/Tool, preference will be given to speakers actively involved as leaders or members of the respective project teams.

Technical topics are running all day and should appeal to two audiences - experienced software security testers or researchers, and software developers who have a “OWASP Top Ten” level of understanding of web attacks and defences. You could present a lightning, short or long talk on something you have researched, developed yourself, or learnt in your travels. Ideally the topics will have technical depth or novelty so that the majority of attendees learn something new.

We would also like to invite talks that will appeal to those interested in the various non-technical topics that are important in our industry. These talks could focus on the development of policies, dealing with compliance obligations, managing risks within an enterprise, or other issues that could appeal to those in management roles.

We encourage presentations to have a strong component on fixing and prevention of security issues. We are looking for presentations on a wide variety of security topics, including but not limited to:

• Web application security
• Mobile security
• Cloud security
• Secure development
• Vulnerability analysis
• Threat modelling
• Application exploitation
• Exploitation techniques
• Threat and vulnerability countermeasures
• Platform or language security (JavaScript, NodeJS, .NET, Java, RoR, Python, etc)
• Penetration Testing
• Browser and client security
• Application and solution architecture security
• PCI DSS
• Risk management
• Security concepts for C*Os, project managers and other non-technical attendees
• Privacy controls

The submission will be reviewed by the OWASP New Zealand Day conference committee and the highest voted talks will be selected and invited for presentation.

PLEASE NOTE:

• Due to limited funds availability, the conference budget does not include a plan to cover expenses for international speakers. However, if sponsorship funds are received for this purpose, we will issue a call for support applications from those outside New Zealand who have submitted proposals. Please indicate in the "additional information" section, whether you would be able to present without such support.
• If you are selected as a speaker, and your company is willing to cover travel and accommodation costs, the company will be recognised as a "Supporting Sponsor" of the event.

Please submit your presentation on PaperCall.

Submission Deadline: Friday, 11th January 2019 (NOW CLOSED)

Applicants will be notified in the following week after the deadline, whether they were successful or not.

Call For Trainers

The Call for Trainers is now closed. Trainers selected to present training have been contacted, and details are now being finalised.

We are happy to announce that training will run on Thursday, 21 February 2019, the day before the OWASP NZ Day conference. The training venue will be Level 0, Rooms: case rooms 1(005), 2(057), 3(055), and 4(009), kindly provided by the University of Auckland School of Business, in the same building as the OWASP NZ Day conference itself. Classes can contain up to 69 students, with power for laptop usage and Wi-Fi. A wide range of half-day or full-day training proposals will be considered, see the Call for Papers for a list of example topics.

If you are interested in running one of the training sessions, please contact John DiLeo (john.dileo@owasp.org) with the following information:

• Trainer name
• Trainer organisation
• Telephone + email contact
• Short Trainer bio
• Training title
• Trainer requirements (e.g. a projector, whiteboard, etc)
• Trainee requirements (e.g. laptop, VMware/VirtualBox, etc)
• Training summary (less than 500 words)
• Target audience (e.g. testers, project managers, security managers, web developers, architects)
• Skill level required (Basic / Intermediate / Advanced)
• What attendees can expect to learn (key objectives)
• Short course outline

The fixed price per head for training will be $250 for a half-day session and $500 for a whole-day session. As this training is part of an OWASP event, part of the proceeds go back to OWASP. The split is as follows:

• 25% to OWASP Global - used for OWASP projects around the world
• 25% to OWASP NZ Day - used for NZ Day expenses
• 50% to the training provider.

Submission Deadline: Friday, 21st December 2018

Applicants will be notified in the following week after the deadline, whether they were successful or not.