This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Belgium Events 2019"
m (Added header with links to the previous and (not yet active) the following year.) |
LievenDesmet (talk | contribs) (→Agenda) |
||
| (4 intermediate revisions by 3 users not shown) | |||
| Line 5: | Line 5: | ||
<!-- Next year: [[Belgium Events 2020|2020]].--> | <!-- Next year: [[Belgium Events 2020|2020]].--> | ||
</noinclude> | </noinclude> | ||
| + | == 25 November 2019 Meeting == | ||
| + | |||
| + | |||
| + | === Where === | ||
| + | |||
| + | * Host: [https://www.radissonhotels.com/en-us/hotels/park-inn-leuven Park Inn by Radisson Leuven] The event is co-located with [https://impulsprogramma-cybersecurity-2019-11-25.eventbrite.com/ a briefing and industry opportunity meeting of the Flanders Cyber Security impuls program]. Feel free to [https://impulsprogramma-cybersecurity-2019-11-25.eventbrite.com/ register] for this co-located event if interested. | ||
| + | |||
| + | * Address: | ||
| + | Park Inn by Radisson Leuven | ||
| + | Martelarenlaan 36 | ||
| + | 3010 Leuven | ||
| + | |||
| + | === Agenda === | ||
| + | |||
| + | *18h00 - 19h00: Welcome & networking | ||
| + | *19h00 - 19h10: ''[https://www.owasp.org/images/a/a3/Owasp_be_update_20191125.pdf OWASP Update]'' by Lieven Desmet (OWASP BE) | ||
| + | *19h10 - 20h00: ''[https://www.owasp.org/images/3/39/Owasp-be-20191125-deryck-recentevolutionsoauth.pdf Recent evolutions in the OAuth 2.0 and OpenID Connect landscape]'' by Philippe De Ryck (Founder of Pragmatic Web Security and Google Developer Expert) | ||
| + | *20u00 - 20u50: ''[https://www.owasp.org/images/2/23/Owasp-be-2019-11-25-desmet.pdf Detection and Prevention of DNS abuse in .eu TLD]'' by Lieven Desmet (DistriNet, KU Leuven) | ||
| + | |||
| + | === Program === | ||
| + | |||
| + | ==== Recent evolutions in the OAuth 2.0 and OpenID Connect landscape ==== | ||
| + | |||
| + | ''Abstract'' | ||
| + | |||
| + | Ever since the introduction of OAuth 2.0, the framework has been in continuous evolution. The initial specification addressed a strong need for delegation. However, since then, various addendums focus on the needs of modern applications. Today, the suite of OAuth 2.0 specifications supports a broad spectrum of different scenarios. For each of these scenarios makes their security assumptions and defines a set of best practices. | ||
| + | |||
| + | In this talk, we will investigate a number of these recent additions. We look at the recently added “Proof of Key for Code Exchange” (PKCE) flow. We also investigate how it is becoming the default flow for Single Page Applications. We also extensively dive into “Proof of Possession” tokens. Their security properties are significantly better than bearer tokens. Consequentially, everyone should know what they entail, and how to use them. You will walk away with a solid overview of recent evolutions in OAuth 2.0, and where to use them in your applications. | ||
| + | |||
| + | ''Speaker Bio'' | ||
| + | |||
| + | Philippe De Ryck helps developers protect companies through better web security. As the founder of Pragmatic Web Security, he travels the world to train developers on web security and security engineering. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. Google recognizes Philippe as a Google Developer Expert for his work on security in Angular applications. | ||
| + | |||
| + | ==== Detection and Prevention of DNS abuse in .eu TLD ==== | ||
| + | |||
| + | ''Abstract'' | ||
| + | |||
| + | This session reports on an extensive analysis of 14 months of domain registration in the .eu TLD. In particular, we investigate domain names that are registered for malicious purposes (such as spam, phishing, botnets C&C, ...). The goal of our research is to understand and identify large-scale malicious campaigns, and to early detect and prevent malicious registrations. | ||
| + | |||
| + | We explore the ecosystem and modus operandi of elaborate cyber criminal entities that recurrently register large amounts of domains for one-shot, malicious use. We further report on insights in the operational aspects of this business and observe, for instance, that their processes are only partially automated. | ||
| + | |||
| + | Finally, we present our automatic prediction system, that classifies at registration time whether a domain name will be used maliciously or benign. As such, malicious domain registrations can effectively be prevented from doing any harm. As part of the talk, we discuss the first results of this prediction system, which currently runs in production at EURid, the registry of the .eu TLD. | ||
| + | |||
| + | ''Speaker Bio'' | ||
| + | |||
| + | Lieven Desmet is a Senior Research Manager on Secure Software in the imec-DistriNet Research Group at the Katholieke Universiteit Leuven (Belgium), where he outlines and implements the research strategy, coaches junior researchers in web and infrastructure security, and participates in dissemination, valorisation and spin-off activities. | ||
| + | |||
| + | === Registration === | ||
| + | |||
| + | Registration is via EventBrite: https://owasp-belgium-2019-11-25.eventbrite.com. | ||
| + | |||
| + | === Coverage === | ||
| + | |||
| + | n/a | ||
| + | |||
| + | == summit working session on OWASP SAMM == | ||
| + | |||
| + | OWASP Belgium presents a summit working session on OWASP SAMM in Antwerp on 30 April: | ||
| + | |||
| + | Registration via https://www.eventbrite.com/e/open-security-summit-working-session-tickets-60456102831 | ||
| + | |||
== 20 February 2019 Meeting == | == 20 February 2019 Meeting == | ||
| + | |||
| + | <!-- | ||
| + | Burn-down list for customization: | ||
| + | - Replace LINK_PRESENTER_TALK_1 | ||
| + | - Replace LINK_PRESENTER_TALK_2 | ||
| + | - Replace OWASP_UPDATE_PRESENTATION, uncomment the link and delete the placeholder (italicized title) | ||
| + | - Replace SLIDES_TALK_1, uncomment the links and delete the placeholders (italicized title and "not yet available" in the talk's subsection) | ||
| + | - Replace SLIDES_TALK_2, uncomment the links and delete the placeholders (italicized title and "not yet available" in the talk's subsection) | ||
| + | - Provide coverage photos / links to blog posts etc. | ||
| + | --> | ||
=== Where === | === Where === | ||
| Line 19: | Line 90: | ||
*18h15 - 19h00: Welcome & sandwiches | *18h15 - 19h00: Welcome & sandwiches | ||
| − | *19h00 - 19h10: '' | + | *19h00 - 19h10: ''[https://www.owasp.org/images/6/69/Owasp_Belgium_update_2019-02-20_v1.pdf OWASP Update]'' by Sebastien Deleersnyder (OWASP) |
| − | *19h10 - 20h00: ' | + | *19h10 - 20h00: '[https://www.owasp.org/images/5/54/CSP_Martin_Johns_OWASP_BE.pdf 'CSP in the age of Script Gadgets]'' by Prof. Martin Johns (TU Braunschweig) |
*20h00 - 20h10: Break | *20h00 - 20h10: Break | ||
| − | *20h10 - 21h00: | + | *20h10 - 21h00: ''Zero to DevSecOps - security in a DevOps world'' (part [https://www.owasp.org/images/7/7d/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_0.pdf 1], [https://www.owasp.org/images/3/3a/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_1.pdf 2], [https://www.owasp.org/images/0/0c/Zero-to-DevSecOps-OWASP-Meetup-02-19-19_-_part_2.pdf 3]) by Jimmy Mesta (CTO, Manicode Security) |
=== Program === | === Program === | ||
| Line 28: | Line 99: | ||
==== CSP in the age of Script Gadgets ==== | ==== CSP in the age of Script Gadgets ==== | ||
| − | * Speaker: Prof. Martin Johns (TU Braunschweig) | + | * Speaker: <!--[LINK_PRESENTER_TALK_1 Prof. Martin Johns]--> Prof. Martin Johns (TU Braunschweig) |
| − | * Presentation: | + | * Presentation: <!--[[:File:SLIDES_TALK_1]]--> not yet available |
''Abstract'' | ''Abstract'' | ||
| Line 43: | Line 114: | ||
==== Zero to DevSecOps - security in a DevOps world ==== | ==== Zero to DevSecOps - security in a DevOps world ==== | ||
| − | * Speaker: Jimmy Mesta (CTO, Manicode Security) | + | * Speaker: <!--[LINK_PRESENTER_TALK_2 Jimmy Mesta]--> Jimmy Mesta (CTO, Manicode Security) |
| − | * Presentation: | + | * Presentation: <!--[[:File:SLIDES_TALK_2]]--> not yet available |
''Abstract'' | ''Abstract'' | ||
| Line 58: | Line 129: | ||
=== Registration === | === Registration === | ||
| − | Registration via EventBrite: https://owasp-belgium-2019-02-20.eventbrite.com. | + | Registration is via EventBrite: https://owasp-belgium-2019-02-20.eventbrite.com. |
=== Coverage === | === Coverage === | ||
n/a | n/a | ||
Latest revision as of 19:14, 5 December 2019
These are the 2019 events of the OWASP Belgium Chapter.
Previous year: 2018.
25 November 2019 Meeting
Where
- Host: Park Inn by Radisson Leuven The event is co-located with a briefing and industry opportunity meeting of the Flanders Cyber Security impuls program. Feel free to register for this co-located event if interested.
- Address:
Park Inn by Radisson Leuven Martelarenlaan 36 3010 Leuven
Agenda
- 18h00 - 19h00: Welcome & networking
- 19h00 - 19h10: OWASP Update by Lieven Desmet (OWASP BE)
- 19h10 - 20h00: Recent evolutions in the OAuth 2.0 and OpenID Connect landscape by Philippe De Ryck (Founder of Pragmatic Web Security and Google Developer Expert)
- 20u00 - 20u50: Detection and Prevention of DNS abuse in .eu TLD by Lieven Desmet (DistriNet, KU Leuven)
Program
Recent evolutions in the OAuth 2.0 and OpenID Connect landscape
Abstract
Ever since the introduction of OAuth 2.0, the framework has been in continuous evolution. The initial specification addressed a strong need for delegation. However, since then, various addendums focus on the needs of modern applications. Today, the suite of OAuth 2.0 specifications supports a broad spectrum of different scenarios. For each of these scenarios makes their security assumptions and defines a set of best practices.
In this talk, we will investigate a number of these recent additions. We look at the recently added “Proof of Key for Code Exchange” (PKCE) flow. We also investigate how it is becoming the default flow for Single Page Applications. We also extensively dive into “Proof of Possession” tokens. Their security properties are significantly better than bearer tokens. Consequentially, everyone should know what they entail, and how to use them. You will walk away with a solid overview of recent evolutions in OAuth 2.0, and where to use them in your applications.
Speaker Bio
Philippe De Ryck helps developers protect companies through better web security. As the founder of Pragmatic Web Security, he travels the world to train developers on web security and security engineering. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. Google recognizes Philippe as a Google Developer Expert for his work on security in Angular applications.
Detection and Prevention of DNS abuse in .eu TLD
Abstract
This session reports on an extensive analysis of 14 months of domain registration in the .eu TLD. In particular, we investigate domain names that are registered for malicious purposes (such as spam, phishing, botnets C&C, ...). The goal of our research is to understand and identify large-scale malicious campaigns, and to early detect and prevent malicious registrations.
We explore the ecosystem and modus operandi of elaborate cyber criminal entities that recurrently register large amounts of domains for one-shot, malicious use. We further report on insights in the operational aspects of this business and observe, for instance, that their processes are only partially automated.
Finally, we present our automatic prediction system, that classifies at registration time whether a domain name will be used maliciously or benign. As such, malicious domain registrations can effectively be prevented from doing any harm. As part of the talk, we discuss the first results of this prediction system, which currently runs in production at EURid, the registry of the .eu TLD.
Speaker Bio
Lieven Desmet is a Senior Research Manager on Secure Software in the imec-DistriNet Research Group at the Katholieke Universiteit Leuven (Belgium), where he outlines and implements the research strategy, coaches junior researchers in web and infrastructure security, and participates in dissemination, valorisation and spin-off activities.
Registration
Registration is via EventBrite: https://owasp-belgium-2019-11-25.eventbrite.com.
Coverage
n/a
summit working session on OWASP SAMM
OWASP Belgium presents a summit working session on OWASP SAMM in Antwerp on 30 April:
Registration via https://www.eventbrite.com/e/open-security-summit-working-session-tickets-60456102831
20 February 2019 Meeting
Where
- Host: DistriNet Research Group (KU Leuven) (Both speakers are faculty of the Secure Application Development course held in Leuven from 2019-02-18 to 2018-02-22.)
- Address (map, directions):
Department of Computer Science (foyer at ground floor) Celestijnenlaan 200 A 3001 Heverlee
Agenda
- 18h15 - 19h00: Welcome & sandwiches
- 19h00 - 19h10: OWASP Update by Sebastien Deleersnyder (OWASP)
- 19h10 - 20h00: ''CSP in the age of Script Gadgets by Prof. Martin Johns (TU Braunschweig)
- 20h00 - 20h10: Break
- 20h10 - 21h00: Zero to DevSecOps - security in a DevOps world (part 1, 2, 3) by Jimmy Mesta (CTO, Manicode Security)
Program
CSP in the age of Script Gadgets
- Speaker: Prof. Martin Johns (TU Braunschweig)
- Presentation: not yet available
Abstract
Content Security Policy (CSP) was first introduced in 2012. It should have been a silver-bullet defense against various injection attacks, including the rampant Cross-Site Scripting vulnerabilities. Unfortunately, modern development practices and legacy code bases proved to be substantial obstacles. New versions of CSP were released to address usability and compatibility for developers. Unfortunately, researchers discovered many bypasses and vulnerabilities in real-world CSP policies. The latest problem is known as script gadgets, where data is turned into code by legitimate functionality.
In this session, we will take a look at the problems you might encounter when deploying CSP. We start at CSP level 1 and work towards the latest level 3 version. We discuss CSP's features, potential bypasses, and pitfalls to avoid. In the end, you will have gained the knowledge to deploy a secure and effective CSP policy.
Speaker Bio
Martin Johns is a full professor at the TU Braunschweig.
Zero to DevSecOps - security in a DevOps world
- Speaker: Jimmy Mesta (CTO, Manicode Security)
- Presentation: not yet available
Abstract
The way that software is being deployed is undergoing a massive transformation. As a result, security teams are at a point where they must adapt or be left in the dust. Traditional application security used to be heavyweight and human-driven. Tasks are more often than not mostly manual efforts. Time-consuming security testing often breaks down in an automated world. Dynamic vulnerability scanning and manual code reviews are incompatible with a world where code changes are automatically being pushed to production hundreds of times per day.
This talk will share lessons learned from helping teams of all sizes and maturity levels with their transformation to a DevSecOps model where security goes from being a blocker to an enabler. Specifically, we will cover some of the tools and processes you can start using right now. These tools allow you to start adding real value to your organization through enhanced visibility, vulnerability discovery, and feedback loops. It is time to adapt and embrace a new era of security.
Speaker Bio
Jimmy Mesta is CTO at Manicode Security. He is a DevSecOps, Mobile, and Kubernetes Secure Coding Instructor.
Registration
Registration is via EventBrite: https://owasp-belgium-2019-02-20.eventbrite.com.
Coverage
n/a
