This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "AppSec US 2010, CA"
KateHartmann (talk | contribs) |
KateHartmann (talk | contribs) |
||
Line 80: | Line 80: | ||
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | |} <!-- End Banner --> | | style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | |} <!-- End Banner --> | ||
− | ==== | + | ==== Agenda/Schedule ==== |
− | ''' | + | {| border="0" align="center" style="width: 80%;" |
+ | |- | ||
+ | | align="center" colspan="4" style="background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | '''Conference Day 1 - September 9th, 2010''' | ||
+ | |||
+ | |||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | <br> | ||
+ | | style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 133, 122);" | Track 1 - Crystal Cove Auditorium | ||
+ | | style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 165, 122);" | Track 2 - Pacific Ballroom | ||
+ | | style="width: 30%; background: none repeat scroll 0% 0% rgb(153, 255, 153);" | Track 3 - Doheny Beach | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 07:30-08:30 | ||
+ | | align="left" colspan="3" style="width: 80%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Registration and Breakfast + Coffee | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 08:30-08:45 | ||
+ | | align="center" colspan="3" style="width: 80%; background: none repeat scroll 0% 0% rgb(242, 242, 242);" | Welcome to OWASP AppSec US, 2010 | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 08:45-9:30 | ||
+ | | align="center" colspan="3" style="width: 80%; background: none repeat scroll 0% 0% rgb(252, 252, 150);" | #Keynote: Jeff Williams | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 9:30-10:15 | ||
+ | | align="center" colspan="3" style="width: 80%; background: none repeat scroll 0% 0% rgb(252, 252, 150);" | #Keynote: Chenxi Wang | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 10:15-10:35 | ||
+ | | align="left" colspan="3" style="width: 90%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Break - Expo - CTF kick-off | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 10:10-10:45 | ||
+ | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 133, 122);" | [[Image:OWASP AppSec Research 2010 Research R.gif]] [[#BitFlip: Determine a Data's Signature Coverage from Within the Application]] ([[Media:OWASP_AppSec_Research_2010_BitFlip_by_Poehls.pdf|pdf]]) | ||
+ | ''Henrich Christopher Poehls, University of Passau''<br> | ||
+ | |||
+ | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 165, 122);" | [[Image:OWASP AppSec Research 2010 Presentation P.gif]] [[#CsFire: Browser-Enforced Mitigation Against CSRF]] ([[Media:OWASP_AppSec_Research_2010_CsFire_by_Desmet_and_DeRyck.pdf|pdf]]) | ||
+ | ''Lieven Desmet and Philippe De Ryck, Katholieke Universiteit Leuven''<br> | ||
+ | |||
+ | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(153, 255, 153);" | [[Image:OWASP AppSec Research 2010 Presentation P.gif]] [[#Deconstructing ColdFusion]] ([[Media:OWASP_AppSec_Research_2010_Deconstructing_ColdFusion_by_Eng.pdf|pdf]]) | ||
+ | ''Chris Eng, Veracode'' | ||
+ | |||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 10:45-11:10 | ||
+ | | align="left" colspan="3" style="width: 90%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Break - Expo - CTF kick-off, '''Coffee break sponsoring position open''' ($2,000) | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 11:10-11:45 | ||
+ | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 133, 122);" | [[Image:OWASP AppSec Research 2010 Research R.gif]] [[#Towards Building Secure Web Mashups]] ([[Media:OWASP_AppSec_Research_2010_Secure_Mashups_by_DeRyck.pdf|pdf]]) | ||
+ | ''M Decat, P De Ryck, L Desmet, F Piessens, W Joosen, Katholieke Universiteit Leuven'' | ||
+ | |||
+ | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 165, 122);" | [[Image:OWASP AppSec Research 2010 Presentation P.gif]] [[#New Insights into Clickjacking]] ([[Media:OWASP_AppSec_Research_2010_Clickjacking_by_Balduzzi.pdf|pdf]]) ''Marco Balduzzi, Eurecom<br><br>'' | ||
+ | |||
+ | <br> | ||
− | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(153, 255, 153);" | [[Image:OWASP AppSec Research 2010 Presentation P.gif]] [[#How to Render SSL Useless]] ([[Media:Ivan_Ristic_-_Breaking_SSL_-_OWASP.pdf|pdf]]) | |
+ | ''Ivan Ristic, Qualys<br>'' | ||
− | + | |- | |
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 11:55-12:30 | ||
+ | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 133, 122);" | | ||
+ | [[Image:OWASP AppSec Research 2010 Research R.gif]] [[#Busting Frame Busting]] ([[Media:OWASP_AppSec_Research_2010_Busting_Frame_Busting_by_Rydstedt.pdf|pdf]]) | ||
− | + | ''Gustav Rydstedt, Stanford Web Security Research''<br> | |
− | + | ||
− | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 165, 122);" | [[Image:OWASP AppSec Research 2010 Presentation P.gif]] [[#Web Frameworks and How They Kill Traditional Security Scanning]] ([[Media:OWASP_AppSec_Research_2010_Frameworks_Security_by_Hang.pdf|pdf]]) | |
− | + | ''Christian Hang and Lars Andren, Armorize Technologies'' | |
− | + | ||
− | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(153, 255, 153);" | [[Image:OWASP AppSec Research 2010 Demo D.gif]] [[#The State of SSL in the World]] ([[Media:OWASP_AppSec_Research_2010_State_of_SSL_by_Boman.pdf|pdf]]) | |
− | + | ''Michael Boman, Omegapoint<br>'' | |
− | + | ||
− | + | |- | |
− | + | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 12:30-13:45 | |
− | + | | align="left" colspan="3" style="width: 80%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Lunch - Expo - CTF, Lunch sponsor: [[Image:OWASP AppSec Research 2010 IIS logo for program.png]] | |
− | + | |- | |
− | + | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 13:45-14:20 | |
− | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 133, 122);" | [[Image:OWASP AppSec Research 2010 Research R.gif]] [[#(New) Object Capabilities and Isolation of Untrusted Web Applications]] ([[Media:OWASP_AppSec_Research_2010_Obj_Capabilities_by_Maffeis.pdf|pdf]]) | |
+ | ''Sergio Maffeis, Imperial College, London'' | ||
+ | |||
+ | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 165, 122);" | [[Image:OWASP AppSec Research 2010 Presentation P.gif]] [[#Beyond the Same-Origin Policy]] ([[Media:OWASP_AppSec_Research_2010_Beyond_SOP_by_Nagra_and_Samuel.pdf|pdf]]) | ||
+ | ''Jasvir Nagra and Mike Samuel, Google<br>'' | ||
− | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(153, 255, 153);" | [[Image:OWASP AppSec Research 2010 Demo D.gif]] [[#SmashFileFuzzer - a New File Fuzzer Tool]] ([[Media:OWASP_AppSec_Research_2010_Smash_File_Fuzzer_by_Randive.pdf|pdf]]) | |
+ | ''Komal Randive, Symantec'' | ||
− | + | |- | |
− | + | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 14:30-15:05 | |
− | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 133, 122);" | [[Image:OWASP AppSec Research 2010 Demo D.gif]] [[#Security Toolbox for .NET Development and Testing]] ([[Media:OWASP_AppSec_Research_2010_NET_Toolbox_by_Lindfors_and_Konig.pdf|pdf]]) | |
− | + | ''Johan Lindfors and Dag König, Microsoft'' | |
− | |||
− | |||
− | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 165, 122);" | [[Image:OWASP AppSec Research 2010 Demo D.gif]] [[#Cross-Site Location Jacking (XSLJ) (not really)]] ([[Media:OWASP_Appsec_Research_2010_Redirects_XSLJ_by_Sirdarckcat_and_Thornmaker.pdf|pdf]]) | |
+ | ''David Lindsay, Cigital<br>Eduardo Vela Nava, sla.ckers.org'' | ||
− | '' | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(153, 255, 153);" | [[Image:OWASP AppSec Research 2010 Demo D.gif]] [[#Owning Oracle: Sessions and Credentials]] ([[Media:OWASP_AppSec_Research_2010_Owning_Oracle_by_Henrique_and_Ocepek.pdf|pdf]]) |
+ | ''Wendel G. Henrique and Steve Ocepek, Trustwave'' | ||
− | + | |- | |
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 15:05-15:30 | ||
+ | | align="left" colspan="3" style="width: 80%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Break - Expo - CTF, '''Coffee break sponsoring position open''' ($2,000) | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 15:30-16:05 | ||
+ | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 133, 122);" | [[Image:OWASP AppSec Research 2010 Demo D.gif]] [[#Value Objects a la Domain-Driven Security: A Design Mindset to Avoid SQL Injection and Cross-Site Scripting]] ([[Media:OWASP_AppSec_Research_2010_VOs_a_la_DDS_by_Johnsson.pdf|pdf]]) | ||
+ | ''Dan Bergh Johnsson, Omegapoint'' | ||
− | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(188, 165, 122);" | [[Image:OWASP AppSec Research 2010 Presentation P.gif]] [[#Automated vs. Manual Security: You Can't Filter "The Stupid"]] (pdf not available yet)<br> | |
+ | ''David Byrne and Charles Henderson, Trustwave'' | ||
− | <br> | + | | align="left" style="width: 30%; background: none repeat scroll 0% 0% rgb(153, 255, 153);" | [[Image:OWASP AppSec Research 2010 Research R.gif]] [[#Session Fixation - the Forgotten Vulnerability?]] ([[Media:OWASP_AppSec_Research_2010_Session_Fixation_by_Schrank_Braun_Johns_and_Poehls.pdf|pdf]]) |
+ | ''Michael Schrank and Bastian Braun, University of Passau<br>Martin Johns, SAP Research'' | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 16:15-17:00 | ||
+ | | align="center" colspan="3" style="width: 90%; background: none repeat scroll 0% 0% rgb(242, 242, 242);" | Panel Discussion: "Is Application Security a Losing Battle?" ([[Media:|pdf]]) | ||
+ | |- | ||
+ | | style="width: 10%; background: none repeat scroll 0% 0% rgb(123, 138, 189);" | 19:00-23:00 | ||
+ | | align="center" colspan="1" style="background: none repeat scroll 0% 0% rgb(43, 58, 109);" | [[Image:OWASP_AppSec_Research_2010_Stockholm_City_Hall_exterior_small.jpg|Stockholm City Hall, photo by Yanan Li]] | ||
+ | | align="center" colspan="1" style="background: none repeat scroll 0% 0% rgb(43, 58, 109); color: white;" | '''Gala Dinner''' at [http://international.stockholm.se/Tourism-and-history/The-Famous-City-Hall/Pictures-of-the-City-Hall/ <span style="color:rgb(163, 178, 229);">Stockholm City Hall<span>]<br>Sponsored by<br>[[Image:OWASP AppSec Research 2010 Google logo for program.png]] | ||
+ | | align="center" colspan="1" style="background: none repeat scroll 0% 0% rgb(43, 58, 109);" | [[Image:OWASP_AppSec_Research_2010_Stockholm_City_Hall_Golden_Hall_small.jpg|The Golden Hall, photo by Yanan Li]] | ||
+ | |} | ||
==== Registration ==== | ==== Registration ==== | ||
Revision as of 17:09, 16 July 2010
UC Irvine Conference Center | CLICK HERE TO REGISTER
Welcome
|
| style="width: 110px; font-size: 95%; color: rgb(0, 0, 0);" | |}
Agenda/Schedule
Conference Day 1 - September 9th, 2010
| |||
|
Track 1 - Crystal Cove Auditorium | Track 2 - Pacific Ballroom | Track 3 - Doheny Beach |
07:30-08:30 | Registration and Breakfast + Coffee | ||
08:30-08:45 | Welcome to OWASP AppSec US, 2010 | ||
08:45-9:30 | #Keynote: Jeff Williams | ||
9:30-10:15 | #Keynote: Chenxi Wang | ||
10:15-10:35 | Break - Expo - CTF kick-off | ||
10:10-10:45 | #BitFlip: Determine a Data's Signature Coverage from Within the Application (pdf)
Henrich Christopher Poehls, University of Passau |
#CsFire: Browser-Enforced Mitigation Against CSRF (pdf)
Lieven Desmet and Philippe De Ryck, Katholieke Universiteit Leuven |
#Deconstructing ColdFusion (pdf)
Chris Eng, Veracode |
10:45-11:10 | Break - Expo - CTF kick-off, Coffee break sponsoring position open ($2,000) | ||
11:10-11:45 | #Towards Building Secure Web Mashups (pdf)
M Decat, P De Ryck, L Desmet, F Piessens, W Joosen, Katholieke Universiteit Leuven |
#New Insights into Clickjacking (pdf) Marco Balduzzi, Eurecom
|
#How to Render SSL Useless (pdf)
Ivan Ristic, Qualys |
11:55-12:30 |
Gustav Rydstedt, Stanford Web Security Research |
#Web Frameworks and How They Kill Traditional Security Scanning (pdf)
Christian Hang and Lars Andren, Armorize Technologies |
#The State of SSL in the World (pdf)
Michael Boman, Omegapoint |
12:30-13:45 | Lunch - Expo - CTF, Lunch sponsor: | ||
13:45-14:20 | #(New) Object Capabilities and Isolation of Untrusted Web Applications (pdf)
Sergio Maffeis, Imperial College, London |
#Beyond the Same-Origin Policy (pdf)
Jasvir Nagra and Mike Samuel, Google |
#SmashFileFuzzer - a New File Fuzzer Tool (pdf)
Komal Randive, Symantec |
14:30-15:05 | #Security Toolbox for .NET Development and Testing (pdf)
Johan Lindfors and Dag König, Microsoft |
#Cross-Site Location Jacking (XSLJ) (not really) (pdf)
David Lindsay, Cigital |
#Owning Oracle: Sessions and Credentials (pdf)
Wendel G. Henrique and Steve Ocepek, Trustwave |
15:05-15:30 | Break - Expo - CTF, Coffee break sponsoring position open ($2,000) | ||
15:30-16:05 | #Value Objects a la Domain-Driven Security: A Design Mindset to Avoid SQL Injection and Cross-Site Scripting (pdf)
Dan Bergh Johnsson, Omegapoint |
#Automated vs. Manual Security: You Can't Filter "The Stupid" (pdf not available yet) David Byrne and Charles Henderson, Trustwave |
#Session Fixation - the Forgotten Vulnerability? (pdf)
Michael Schrank and Bastian Braun, University of Passau |
16:15-17:00 | Panel Discussion: "Is Application Security a Losing Battle?" ([[Media:|pdf]]) | ||
19:00-23:00 | Gala Dinner at Stockholm City Hall Sponsored by |
Registration
Registration Now Open!
OWASP Membership ($50 annual membership fee) gets you a discount of $50.
$375 Until 7/31/2010 | Non-Members | After 7/31/2010 - $445 |
$325 Until 7/31/2010 | OWASP Members | After 7/31/2010 - $395 |
$250 | Students with valid Student ID | |
$375 Until 7/31/2010 | New Registration Option! Become an OWASP Member and attend the event! | |
$1350 | 2-Day Training Course | |
$675 | 1-Day Training Course |
Who Should Attend AppSec USA 2010:
- Application Developers
- Application Testers and Quality Assurance
- Application Project Management and Staff
- Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff
- Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance
- Security Managers and Staff
- Executives, Managers, and Staff Responsible for IT Security Governance
- IT Professionals Interesting in Improving IT Security
For student discount, attendees must present proof of enrollment when picking up your badge.
Volunteer
Volunteers Needed!
Get involved!
We will take all the help we can get to pull off the best Web Application Security Conference of the year! Volunteers get free admission and invitation to the VIP event. This is your chance to rub elbows with the big players and mingle with potential networking contacts or even future employers!
Please contact neil(at)owasp.org to volunteer for a specific area:
- Security
- Speakers and Trainers
- Vendors
- Facilities
More opportunities and areas will be added as time goes on. Our File:Volunteer Sheet.doc can be downloaded which outlines some of the responsibilities and available positions. Note: this document references the the DC conference last year, this is just for a general guideline. Updated document coming soon.
Training
T1. Web Security Testing - 2-Days - $1350 | ||||
---|---|---|---|---|
Summary
Instructor: Joe Basirico, Security Innovation |
T2. Building Secure Ajax and Web 2.0 Applications - 2-Days - $1350 | ||||
---|---|---|---|---|
Summary | ||||
T3. Assessing and Exploiting Web Applications with Samurai - WTF - 2-Days - $1350 | ||||
Summary
Instructor: Justin Serle, InGuardians | ||||
T4. Application Security Leadership Essentials - 2-Days - $1350 | ||||
Summary | ||||
T5. Software Security Remediation: How to Fix Application Vulnerabilities 1-Day - Sept 7th- $675 | ||||
Summary |
T6. Live CD 1-Day - Sept 8th- $675 |
---|
Summary |
Venue
UC Irvine Conference Center Center
AppSec USA 20010 will be taking place at the UC Irvine Conference Center in Irvine, CA.
Hotel
We have reached a deal with Hyatt Regency of Irvine. The standard room rate will be $109. The hotel will be offering a shuttle service to and from both the UC Irvine campus as well as the John Wayne Airport!
Space is limited so be sure to book sooner than later. Please use this link to reserve a room https://resweb.passkey.com/go/owasp2010
UC Irvine also has special arrangements with local hotels here
Sponsors
Sponsors
We are currently soliciting sponsors for the AppSec US 2010 Conference. Please refer to our List of Sponsorship Opportunities (or PDF).
Please contact Kate Hartmann for more information.
Slots are going fast so contact us to sponsor today!
Platinum Sponsors |
[File:Qualys-468-60.png] | |||
Gold Sponsors |
||||
Silver Sponsors |
||||
Organizational Sponsors |
||||
Reception Sponsors |
||||
Coffee Sponsors |
Travel
Traveling to the OC Metro Area