This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Louisville"
(→Upcoming Events) |
(→TBA) |
||
| Line 40: | Line 40: | ||
| − | == TBA == | + | == NEXT CHAPTER MEETING TBA == |
== Past Meetings == | == Past Meetings == | ||
Revision as of 13:09, 17 March 2010
OWASP Louisville
Welcome to the Louisville chapter homepage. The chapter leader is Chris Parker
Participation
OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
Sponsorship/Membership
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
<paypal>Louisville</paypal>
Upcoming Events
Details are posted on our site: http://www.isacaky.org/2010/certified-ethical-hacker-ceh-training-may-13-14th/
Secure 360
This regional Conference is held at the RiverCentre in St. Paul, MN. on May 11th and 12th. This Conference is in its 5th year and attracts 500+ paid attendees with over 800 in attendance including attendees, speakers, sponsors and exhibitors.
Secure360°™ 2010 is shaping up as another exciting event and we would like your help to make it an outstanding success!
The dates and location are set: May 11 & 12, 2010 at the St. Paul River Center. Hundreds of practitioners and managers come to Secure360°™ to hear from people like YOU – experienced professionals with specific expertise and real-world knowledge of information risk issues and mitigation techniques. We encourage you to submit a proposal to present an Educational Session at Secure360°™.
Submission of Abstracts
If you have some knowledge to share and would like to submit an abstract, or know of someone who might be interested in presenting, please visit our website and access the Call for Presentations.
Submitters will be guided through four submission steps:
Create an Account in our Speakers’ database at http://www.secure360.org/register/speaker Retrieve your personal password from your email box (Note: Registration emails are normally received within minutes. If you don't receive an email with your registration link within 12 hours, check you junk mail folder. If you still do not see it, contact [email protected]) Review your Bio, make any necessary changes, and add your photo (Note: Make sure your photo is high enough quality for both the Website and our printed materials. Enter up to five Session Proposals (or view the list of "My Sessions" that you already submitted) Submit for Review Notices will be sent out in February
-- Lorna Alamri
OWASP Connections skype: lorna.alamri [email protected]
NEXT CHAPTER MEETING TBA
Past Meetings
Please note: videos of our meetings are below in the presentations sections. We will try to take video of each meeting based on the speaker's permission. Demos may be omitted.
The January 2010 OWASP meeting featured a presentation from Rafal Los of HP.
Speaker: Rafal Los on Flash and Web 2.0 security
Rafal Los, Security Specialist with Hewlett-Packard's Application Security Center (ASC), is an industry veteran who has worked in a variety of security positions— from consultant to Information Security Officer in the Fortune 100— within some of the most demanding business environments. Rafal’s unique blend of technical expertise and business knowledge enable him to teach audiences about security techniques, programs and processes that they can both understand strategically, and realistically apply. He has extensive experience in security testing, risk analysis and management, penetration testing and architecture and policy. Previous successes include building and implementing a successful web application security program for one of the largest and most diverse companies in the world.
The third OWASP meeting featured a presentation from Rohyt Belani of Intrepidus Group.
Along with being the CEO and co-founder of the Intrepidus Group, Rohyt is also Adjunct Professor at Carnegie Mellon University. Prior to starting the Intrepidus Group, Mr. Belani has held the positions of Managing Director at Mandiant, Principal Consultant at Foundstone and Researcher at the US-CERT. He is a contributing author for Osborne’s Hack Notes – Network Security, as well as Addison Wesley’s Extrusion Detection: Security Monitoring for Internal Intrusions. Mr. Belani is a regular speaker at various industry conferences including Black Hat, OWASP, ASIS, SecTOR, Hack in the Box, Infosec World, DallasCon, CPM, ISSA meetings, and several forums catering to the FBI, US Secret Service, and US Military. He has written technical articles and columns for online publications like Securityfocus and SC magazine, and has been interviewed by BBC Radio, Forbes magazine, TechNewsWorld, InformationWeek, Information Today, IndustryWeek, E-Commerce Times, SmartMoney, and Hacker Japan. Mr. Belani holds a Bachelor of Engineering in Computer Engineering from Bombay University and a Master of Science in Information Networking from Carnegie Mellon University. He currently leads the OWASP Java Project a world-wide consortium of Java security experts.
Please see the description from Rohyt on his presentation on the 18th.
Site takedown services, anti-phishing filters, and millions of dollars worth of protective technologies…..and the spear phishers are still successful! This presentation will discuss why this is the case. Today, phishing is a key component in a “hackers” repertoire. Phishers are combining social engineering with application security flaws in well known websites to make automated detection of targeted phishing attacks almost impossible. The result - hijacked online brokerage accounts, stolen identities and e-bank robberies. During this talk, I will present the techniques used by attackers to execute such spear phishing attacks, and real-world cases that I have responded to that will provide perspective on the impact. I will then discuss countermeasures that have been proven to be effective and are recommended by reputed bodies like SANS and Carnegie Mellon University.
The second OWASP meeting will featured a presentation from Adrian Crenshaw of Irongeek. Adrian is a Louisville based Security professional that has worked in the IT industry for the last twelve years.
Adrian runs the information security website Irongeek.com, which specializes in videos and articles that illustrate how to use various pen-testing and security tools. He's currently working on an MBA, but is interested in getting a network security/research/teaching job in academia. Please see the description from Adrian on his presentation on the 19th.
Title: Mutillidae: Using a deliberately vulnerable set of PHP scripts to illustrate the OWASP Top 10
Description: A while back I wanted to start covering more web application pen-testing tools and concepts in some of my videos and live classes. Of course, I needed vulnerable web apps to illustrate common web security problems. I like the WebGoat project, but sometimes it's a little hard to figure out exactly what they want you to do to exploit a given web application, and it's written in J2EE (not a layman friendly language). In an attempt to have something simple to use as a demo in my videos and in class, I started the Mutillidae project. Mutillidae is a deliberately vulnerable set of PHP scripts meant to illustrate the OWASP Top 10. This talk will cover installing Mutillidae in a test environment, and how to use it to illustrate the OWASP Top 10 web vulnerabilities in easy to understand terms.
March 2009
The first Louisville OWASP meeting was launched with the help of the Kentuckiana ISSA Chapter, on Friday March 6 2009. The Louisville OWASP chapter is closely associated with the Kentuckiana ISSA chapter and will offer ISSA members, other security professionals, application developers, and all other interested parties, a free forum to learn and discuss the newest developments in application security. Following March’s meeting, we will meet quarterly on a different day and time. The information on future meetings will be following soon. Please provide feedback to the board.
Everyone is welcome to join us at our chapter meetings.
Louisville OWASP Chapter Board Members
Scope of the board is to discuss and approve local activities, meetings and plans.The board meetings will be announced at a later date. The board currently includes the following members:
- Chapter Leader: Chris Parker
- Kristen Sullivan
- Carl Alexander
- Brian Blankenship
- Mitchell Greenfield
- Mark Thacker
- Ajay Gupta
- Mark Maxey
- Curtis Koenig
- Scott MacArthur
Join our group on LinkedIn
http://www.linkedin.com/groups?gid=1917263
Meeting Presentations
We are now trying to video all of our presentations thanks to our newest board member, Adrian Crenshaw! The taping of our meetings will be with the consent of our speakers. Thanks.
June 2009 Presentation Adrian Crenshaw
September 2009 Presentation Rohyt Belani
January 2010 Presentation Rafal Los
About OWASP
The OWASP Foundation is a 501(c)3 non-profit organization incorporated in the United States of America. OWASP's all-volunteer participants produce free, professional quality, open-source documentation, tools, and standards. Consult the how OWASP works web page for more information about projects and governance.
OWASP Membership
OWASP is an open source project dedicated to finding and fighting the causes of insecure software. All of our materials are free and offered under an open source license, so you do not have to become a member to use them or participate in our projects, mailing lists, conferences, meetings or other activities. On the other hand OWASP rely membership fees and sponsorship to support his activities. There are also unique benefits to become a corporate member such as the use of OWASP materials within your organization without the restrictions associated with the various open source licenses. OWASP individual members also get discounts to security conferences and other perks. For more information consult the OWASP Membership web page.
Articles, Links, etc.
OWASP article with the official SCG release on Darkreading magazine today.
http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=216402325
The Rocky Road to More Secure Code
OWASP Sheds Light on its Security Standards
http://www.sdtimes.com/OWASP_SHEDS_LIGHT_ON_ITS_SECURITY_STANDARDS/About_OWASP_and_SECURITY/33469
