1. Quantify business criticality of a deployed application
   
2. Translate technical risks into business risks (speak the language of management)
   
3. Translate technical risk into approximate financial risk
   

1. Paper describing definitions and formula for determining business criticality
   
2. Paper translating technical language and risks into business language and monetary risk
   

Eoin Keary @

Sherif Koussa @

Konstantinos Papapanagiotou @

Vishal Garg @

Mateo Martinez @

Mikko Saario @

Ofer Maor @

Nuno Loureiro @

Wojciech Dworakowski @

Tobias Gondrom @

Juan Jose Rider @

Alexandre Miguel Aniceto @

1. Defining consuming and instrumental tools data
   

1. A standard schema for describing application security risks of all types, with a place for all relevant information – whether derived statically, dynamically, manually, or architecturally.
   

Dan Cornell @

Jeremy Long @

Paolo Perego @

Sherif Koussa @

1. Discuss positive security properties that should be tracked
   
2. Discuss options for consumer-friendly labeling
   
3. Discuss ways to encourage participation in risk labeling
   

1. White paper sketching out a standard for a software security label and a plan to finalize the standard.
   

Vishal Garg @

Doug Wilson @

Alexandre Miguel Aniceto @

1. Discuss existing methods for counting and scoring defects, by vendors and practitioners willing to share their methodologies.
   
2. Discuss advantages and disadvantages of a standardized approach.
   
3. Discuss the CWSS 0.1 draft and how it might be incorporated into a standard.
   

1. White paper sketching out a standard for rating risks that accomodates individual minor defects all the way through architectural flaws (that may represent many individual defects)
   

Justin Clarke @

Sherif Koussa @

Vishal Garg @

Matteo Meucci @

Elke Roth-Mandutz @

Mateo Martinez @

Doug Wilson @

Ofer Maor @

Wojciech Dworakowski @

Alexandre Miguel Aniceto @

1. Determine which SDLC activities correlate with more secure software
   
2. Determine how to measure the performance of these activities
   

1. Paper describing the SDLC activities that matter and measurement techniques for their performance
   

Nishi Kumar @

L. Gustavo C. Barbato @

Jason Taylor @

Matthew Chalmers @

Justin Clarke @

Seba Deleersnyder @

Sherif Koussa @

Vishal Garg @

Giorgio Fedon @

Ofer Maor @

Nuno Loureiro @

Tobias Gondrom @

1. Discuss and review current document project structures and key elements.
   
2. Review proposal to align to ASVS and discuss whether the current version of ASVS provides an adequate baseline.
   
3. Review other options for structure and numbering.
   
4. Develop a draft structure and numbering plan.
   
5. Discuss any dependencies which may exist, such as common nomenclature and definitions.
   

1. A written recommendation for a unified category and numbering system for applicable document projects.
   
2. Agreement from applicable document project leaders to adopt the finalized version of the system.
   
3. An implementation plan discussing when projects will implement the new system.
   

Vlatko Kosturjak @

1. Attenuated versions of existing apis to sandboxed code.
   
2. Client side sandboxed apps maintaining state and authentication.
   
3. Create a standard for modifying a sandboxed environment
   
4. Deprecate and discourage standards which ambiently or undeniably pass credentials.
   
5. Create a standard for authentication within a sandboxed environment (maybe interfacing with existing auth without passing creds like 0Auth works)
   

1. Browser Security Report
   
2. Browser Security Priority List
   

Michael Coates

Eduardo Vela @

Stefano Di Paola

Isaac Dawson

Chris Eng @

Alexandre Miguel Aniceto @

1. Handle autofocus in a unified and secure way.
   
2. Discuss necessity and capability for the HTML5 form controls.
   
3. Initiate and create documentation and references for developers that address security issues.
   
4. Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags.
   
5. Long Term Goal(s): Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier.
   

1. Browser Security Report
   
2. Browser Security Priority Report
   

Michael Coates @

Tony UcedaVelez @

Stefano Di Paola

Isaac Dawson

Chris Eng @

Nishi Kumar @

Elke Roth-Mandutz @

Giorgio Fedon

Paolo Perego @

Eduardo Vela @

Abraham Kang @

Nuno Loureiro @

Alexandre Miguel Aniceto @

1. Fix the problems with Object.defineProperty() and property unsealing / double-freezing.
   
2. Raise awareness for the power or object freezing in a security context.
   
3. Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented.
   
4. Long Term Goal: Discuss the possibility of vendor supported client side security mechanisms.
   

1. Browser Security Report
   
2. Browser Security Priority List
   

Michael Coates @

Stefano Di Paola

Isaac Dawson

Abraham Kang

Gareth Heyes

1. Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.
   

1. Browser Security Report
   
2. Browser Security Priority List
   

Michael Coates @

Vishal Garg @

1. Browser Security Report
   
2. Browser Security Priority List
   

Michael Coates @

Stefano Di Paola

Tobias Gondrom @

Alexandre Miguel Aniceto @

1. Browser Security Report
   
2. Browser Security Priority List
   

Michael Coates @

Giorgio Fedon

1. Browser Security Report
   
2. Browser Security Priority List
   

Michael Coates @

1. Browser Security Report
   
2. Browser Security Priority List
   

Michael Coates @

1. Browser Security Report
   
2. Browser Security Priority List
   

Michael Coates @

1. Work on how OWASP can engage with the major web frameworks to move towards a "secure by default" stance
   
2. Work on OWASP resources to provide patches/design approaches in conjunction with the frameworks
   

1. OWASP statement/Press release to publicly ask the frameworks to build security in
   
2. Engagement plan on how we'd work with (if at all) a framework to get ESAPI or similar functionality integrated
   
3. White paper or standard for what we want the web frameworks to provide in terms of XSS defenses. Turning the XSS Prevention Cheat Sheet into a standard/metric for frameworks would be great.
   
4. OWASP Standard defining an appraisal methodology for a framework’s XSS prevention capability based on the other deliverable.
   

Abraham Kang

Tony UcedaVelez @

Fred Donovan @

Juan Jose Rider @

1. Work on what partners we can reach, and what resources they can provide us access to
   
2. Work on who we can work with to reach a maximum amount of developers writing web applications
   
3. Plan engagement with identified organizations
   
4. Plan a call to action for OWASP chapters for identified XSS resources
   

1. A concrete, specific business plan for investing OWASP Funds in a campaign designed to ensure that every developer knows about XSS and what to do to prevent it. The plan should have specific goals, measures, and targets over time so we know if it is on track.
   

Abraham Kang

Sherif Koussa @

1. Improve XSS Attack Payload Detection Techniques
   
2. Identifying Improper Output Handling Flaws in Web Apps
   
3. Feasibility of Profile Page Scripts/Iframes
   
4. Testing Injection of JS Sandbox Code in Responses
   

1. White paper describing “Next Generation WAF Capabilities” such as the ones described above. Include areas requiring additional research and funding.
   

Achim Hoffmann @

Justin Clarke @

Giorgio Fedon

Abraham Kang

Mario Heiderich

Gareth Heyes

Eduardo Vela @

Stefano Di Paola

David Lindsay

Juan Jose Rider @

1. Identify which attacks/vulnerabilities are best suited for virtual patching
   
2. Identify which tools are best suited for virtual patching (appliance vs. embedded, WAFs vs IPS, etc...)
   
3. Identify who should be responsible for virtual patching
   
4. How to develop/test virtual patches
   

1. White paper on “Effective Virtual Patching” that discusses the scenarios above.
   

Achim Hoffmann @

Dan Cornell @

Martin Knobloch @

1. A white paper describing strategies for scaling application security verification programs beyond a single application at a time. Should address achieving coverage of expected controls, depth of assurance, both automated and manual approaches, custom rules, rule management, rule deployment.
   

Achim Hoffmann @

Steven van der Baan @

Cecil Su @

Sherif Koussa @

Matthias Rohr @

Vishal Garg @

Chris Eng @

Nishi Kumar @

Michael Coates @

Giorgio Fedon

Keith Turpin @

Ofer Maor @

Nuno Loureiro @

Mikko Saario @

Wojciech Dworakowski @

Martin Knobloch @

Antonio Fontes @

1. Discuss the OWASP strategy and policy on responsible disclosure of known vulnerabilities in public web applications.
   
2. Should OWASP provide an OT10-Leaks platform in a country with legal protection for anonymous sources?
   

1. A white paper evaluating the various options for handing discovered vulnerabilities. Possible standards and recommendations associated with the options.
   

Michael Coates @

Giorgio Fedon

Eduardo Vela @

Martin Knobloch @

1. Discuss additional reference materials and identifying publicly-available tools targeting a variety of platforms (web, OSX, Unix, mobile platforms, etc) in an effort to provide practical, platform-specific implementation guidance for each of the security practices in the 16 Steps of the Simplified SDL.
   
2. Define the practical “crawl/walk/run” steps for adopting the 16 Practices of the Simplified SDL for development organizations of any size.
   

1. Identify 1-2 target platforms and potential locations for a library of platform-specific guidance and tools associated with each of the 16 practices of the Simplified SDL.
   
2. Identify OWASP contributors who are willing to help build the content for #1.
   
3. Define the practical “crawl/walk/run” steps for adopting the 16 Practices of the Simplified SDL for development organizations of any size.
   

John Menerick @

Daniel Brzozowski @

Alexandre Miguel Aniceto @

1. Estimation of Security prorams currently exist in university settings around the world
   
2. How can OWASP participate and influence the curricula of these educational programs?
   
3. How can we foster relationships between OWASP and universities?
   
4. How can the relationship between OWASP and universities be standardized?
   
5. What can OWASP offer universities and what can they, in turn, expect from each other?
   

1. A study with facts, numbers, and other metrics about application secuirity in academia. The OWASP Academic State of the World.
   
2. A white paper with strategies for infiltrating academia with our priorities.
   

Cecil Su @

Elke Roth-Mandutz @

Heiko Richler @

Lucas C. Ferreira @

Jason Taylor @

Carlos Serrão @

Konstantinos Papapanagiotou @

Mateo Martinez @

L. Gustavo C. Barbato @

Edward Bonver @

Ricardo Melo @

Alexandre Agustini @

1. Understand the current laws/frameworks in place in relation to computer crime and prevention
   
2. Discuss ways these laws are currently failing consumers in protecting assets
   
3. Discuss possible amendments to the laws/frameworks to better protect the public
   

1. A study evaluating the existing computer crime laws and how they might be applied to the current set of application security attacks. Recommendations for a new legal framework.
   

Abraham Kang

1. Presentation of the discussion had in January – what were we looking for, what conclusions were reached and why;
   
2. The OWASP Academic Portal Project – what is it, advantages, contributors, roadmap;
   
3. Alternative ways of working with Universities when possible – Summer School proposal (ISCTE);
   
4. OWASP Appsec Tutorial Series – How to best disseminate it and use it.
   

1. Deliver the above as a fundable business plan complete with financial and resource requirements, timelines, metrics, etc…
   

Paulo Coimbra @

Dinis Cruz @

Nishi Kumar @

Cecil Su @

Heiko Richler @

Lucas C. Ferreira @

Jason Taylor @

Mateo Martinez @

Konstantinos Papapanagiotou @

Carlos Serrão @

Matteo Meucci @

Elke Roth-Mandutz @

Daniel Brzozowski @

L. Gustavo C. Barbato @

Ricardo Melo @

Alexandre Agustini @

1. Presentation of the OWASP Training Model;
   
2. How to keep the initiative alive – people, methodologies, contents, materials;
   
3. Trainers Database – assessment of quality;
   
4. Connection with the Paid Training Model;
   
5. Set up a strategy to apply for currently available state European funding.
   

1. Deliver the above as a fundable business plan complete with financial and resource requirements, timelines, metrics, etc…
   
2. Team and Model to apply for currently available state European funding.
   

Paulo Coimbra @

Dinis Cruz @

Nishi Kumar @

Cecil Su @

Heiko Richler @

Lucas C. Ferreira @

L. Gustavo C. Barbato @

Jason Taylor @

Achim Hoffmann @

Mark Bristow @

Mateo Martinez @

Carlos Serrão @

Konstantinos Papapanagiotou @

Vishal Garg @

Matteo Meucci @

Jeremy Long @

Seba Deleersnyder @

Ralph Durkee @

Ricardo Melo @

1. To create an organized package that can be used by companies for the purposes of educating developers on securely coding web applications and web services
   

1. A curriculum for the above based on OWASP materials and a plan to build it out.
   

Nishi Kumar @

Jason Taylor @

Carlos Serrão @

Konstantinos Papapanagiotou @

Daniel Brzozowski @

L. Gustavo C. Barbato @

Keith Turpin @

Ralph Durkee @

Mikko Saario @

Ricardo Melo @

Mateo Martinez @

Tobias Gondrom @

Alexandre Agustini @

Sherif Koussa @

1. To learn more about the OWASP TOP 10 cases in Hacking-Lab - Vulnerable Apps in HL
   
2. Experience the users's view of a training - lab descriptions, exercises, send-solution, ranking, global ranking, my profile
   
3. Experience the teacher's view of a training - solution movies, accpet or reject solutions from users, solution movie
   
4. Experience the Hacking-Lab LiveCD (accessing the lab), teaming, levels in HL, avatar, rankings
   
5. Talk about a potential collaboration between OWASP and Hacking-Lab for the future. Free OWASP TOP 10 training.
   

1. A plan to create free awesome OWASP T10 awareness training using HL and others. Integrate the various environments and create a prototype if possible.
   

Cecil Su @

Jason Taylor @

Achim Hoffmann @

Carlos Serrão @

Konstantinos Papapanagiotou @

Vishal Garg @

Mateo Martinez @

Daniel Brzozowski @

Tony UcedaVelez @

Ralph Durkee @

Ricardo Melo @

Martin Knobloch @

Juan Jose Rider Jimenez @

Alexandre Miguel Aniceto @

1. A plan for a marketing/awareness campaign that starts to promote the top and bottom-line business advantages of application security. Prototype awareness concepts if possible.
   

1. Establish model for CC-licensed exams creation
   
2. Establish model for CC-licensed exams distribution and usage
   
3. Establish a first CC-licensed exam to test the concept (an alpha will be brought to the working session)
   
4. Try OWASP training and exam end-to-end to experience and improve training and exam usage scenarios
   

1. A business plan for evaluation by the community at large. What is the investment, schedule, metrics, benefit…
   

Matthew Chalmers @

Mateo Martinez @

Jeremy Long @

Matteo Meucci @

Paolo Perego @

Ralph Durkee @

Martin Knobloch @

1. Determine whether certification would have value for OWASP's Community
   
2. Determine a model by which certification based on OWASP materials could succeed
   
3. Determine a model for creation and distribution of a CC-licensed certification exam based on OWASP materials
   
4. (if agreed) Determine a model for supporting the administration of certification based on OWASP Materials
   

1. A business plan for evaluation by the community at large.
   

Matthew Chalmers @

Mateo Martinez @

Jeremy Long @

Matteo Meucci @

Seba Deleersnyder @

Daniel Brzozowski @

Paolo Perego @

Edward Bonver @

Ralph Durkee @

Nuno Loureiro @

Ricardo Melo @

Martin Knobloch @

Alexandre Miguel Aniceto @

1. Construct an ordered list of topics and OWASP projects for future episodes
   
2. Produce documentation on how OATS can be used for further outreach to programmers
   
3. Compile a list of volunteers and responsibilities
   

1. Roadmap of future topics and direction of the project
   
2. List of volunteers & responsibilities
   

1. OWASP Codes of Conduct
   

1. Serial Decomp: Decode, canonicalize, filter
   
2. Structured data (SSN, CC, etc.)
   
3. Unstructured data (comments, blogs, etc.)
   
4. Other input exaples (ws-, database, etc.)
   

1. A clear and concise user guide for getting ESAPI input validation up and running.
   

Justin Clarke @

John Steven @

1. Understand AppSensor Fundamentals
   
2. Define AppSensor Detection Points applicable to most applications
   
3. Implement detection points into code
   

1. Status of AppSensor Whitepaper including AppSensor Roadmap
   
2. Updated AppSensor-Tutorial code with new lessons and lesson structure enhancements
   
3. Updated Getting Started Guide for new adopters and developers leveraging feedback from session
   

Colin Watson

Chris Schmidt @

1. Increase coverage and functionality of existing Output Encoding Codecs
   
2. Create new codecs to cover more output encoding contextual needs
   
3. Introduce these codecs in a way that doesn't interfere with ESAPI Modularization Tasks
   
4. Draft an implementation guide for Application Framework Developers to implement ESAPI Output Encoding into their Application Frameworks
   

1. Increase coverage and functionality of existing Output Encoding Codecs
   
2. New drop in set of codecs for the ESAPI Encoder to use for additional contexts
   
3. Implementation Guide for Framework Developers to integrate Output Encoding into their Application Framework. This should be a simple guide that can be distributed en masse to framework developers as a push to get them involved in making their frameworks more secure by eliminating XSS.
   

Justin Clarke @

Abraham Kang

1. Produce an informal threat model for each development scenario
   
2. Impart clear and simple shared understanding of threats associated with each development scenario (and dispel common misunderstandings/idioms)
   
3. Define solution that resists defined attacks
   
4. Deliver solution implementation (snippets) to https://code.google.com/p/secure-coding-workshop/
   

1. (see objectives) Threat Models
   
2. (see objectives) Code Snippets
   
3. Plan and Extra-summit work-items for exercises in Phone and RIA contexts during next summit
   

Jim Manico @

Chris Schmidt @

Justin Clarke @

Neil Matatall @

Tony UcedaVelez @

Fred Donovan @

Alexandre Miguel Aniceto @

Antonio Fontes @

1. A practical guideline for protecting against CSRF in the real world.
   
2. A concise, clear standard for determining whether an application is vulnerable to CSRF.
   

Achim Hoffmann @

Ryan Barnett @

Mark Thomas @

Vishal Garg @

1. Create design and code examples for protecting access to database tables and rows by role
   
2. Create design and code examples for protecting access to data when 'auto-wiring' and marshalling
   
3. Create design and code examples for protecting sensitive data at rest
   

1. A short reference architecture/coding examples type of guideline that clearly explains positive and negative examples of accessing persisted data.
   

Chris Schmidt @

Justin Clarke @

Dan Cornell @

John Steven @

Ralph Durkee @

Alexandre Miguel Aniceto @

1. Determine how to scale the idea
   
2. Determine how to get funding for it
   
3. Schedule at least two following OWASP Secure Coding Workshop days in 2011
   

1. A business plan for OSCW to be evaluated by the community at large. What is the investment, schedule, metrics, benefit…
   

Justin Clarke @

Jeremy Long @

1. Define which APIs needs to be implemented
   
2. Define the module's namespace inside the gem
   
3. Write cucumber scenarios to define overall integration tests
   
4. Write rspec contexts for each API for fine grain test
   
5. (hopefully: implementing at least 5% of APIs starting from their rspecs)
   

1. Cucumber scenarios
   
2. Rspec context for each API choosen
   
3. 5% of APIs being implemented
   

1. Build ESAPI-core version 1 for Java 1.5+
   
2. Document planning phase and design decisions around ESAPI-core
   
3. Produce library usage documentation
   

1. Build a design plan for ESAPI core.
   
2. Deploy the first version of the ESAPI-core Jar.
   

Jim Manico @

1. Goals and Scope of initial "Security Refactorings"
   
2. High level Organization of Code Example Smells
   
3. Format to present Security Refactorings
   
4. Solutions and Segmenting of work.
   

1. 1. Goals and Scope of initial "Security Refactorings"
   
2. 2. High level Organization of Code Example Smells
   
3. 3. Format to present Security Refactorings
   
4. 4. Solutions and Segmenting of work.
   

1. Define 'What is O2'
   
2. Map out easy ways to start using O2
   
3. Document success stories and 'real world' O2 usage
   

1. Simple user’s guide that shows how to install, configure, and use O2 to do a few simple common things.
   
2. Detailed workflows for the more complex features
   
3. Roadmap for the next version of O2
   

Jason Taylor @

Steven van der Baan @

Sherif Koussa @

Daniel Brzozowski @

Anurag Agarwal @

Giorgio Fedon

Achim Hoffmann @

Paolo Perego @

Neil Matatall @

Abraham Kang

Tony UcedaVelez @

L. Gustavo C. Barbato @

Alexandre Agustini @

Vlatko Kosturjak @

1. Primary: Create core knowledge base on project wiki site
   
2. Recruit volunteers to contribute to project
   
3. Establish relationships with key players (i.e. Apple/Google/etc)
   
4. Create the OWASP Mobile Top 10
   

1. Project wiki page
   
2. A project home page, roadmap, and action plan. Look at the OWASP Ecosystem concept to see what all you should have in place.
   
3. OWASP Mobile Top 10
   

Tom Neaves @

Mateo Martinez @

Justin Clarke @

Sherif Koussa @

Vishal Garg @

Dan Cornell @

Chris Eng @

Jim Manico @

Jack Mannino @

Nishi Kumar @

Giorgio Fedon

Steve Jensen

Neil Matatall @

Abraham Kang

Mikko Saario @

Vlatko Kosturjak @

Chris Wysopal @

Antonio Fontes @

1. Discussion on major enhancements to the next version of the development guide
   
2. Discussion on aligning the guide to ASVS standard and OWASP common numbering scheme
   
3. Discussion on improving the usefulness of the guide to all stakeholders
   
4. Collaboration with other OWASP guides - Top 10, ASDR, CRG and TG
   

1. An updated outline for the development guide that is tied into the OWASP common numbering scheme
   
2. A short white paper with ideas for revisions to the Development Guide for evaluation and discussion by the community at large.
   
3. A committed project manager who can reach out to experts to get the document completed.
   

Eoin Keary @

Steven van der Baan @

Abraham Kang

Keith Turpin @

Fred Donovan @

1. Discuss expierences with using ASVS
   
2. Discuss specific requirements and ideas for improvement
   
3. Create a white paper with ideas for revisions to the ASVS
   

1. A short white paper with ideas for revisions to the ASVS, ready for evaluation by the community at large. Actual suggested revisions to the document are helpful, but not required if time does not allow.
   

Steven van der Baan @

Wojciech Dworakowski @

Jim Manico @

Vishal Garg @

Abraham Kang

Keith Turpin @

Alexandre Miguel Aniceto @

1. What techniques are effective for scaling web security within a large company?
   
2. Strategies for developer education that work?
   
3. Automated defenses - what techniques are currently in use?
   
4. Benefits/considerations for using security bounty programs and public hacking initiatives.
   
5. What can OWASP build or develop to assist with enterprise wide application security?
   

1. A white paper detailing specific recommendations for Enterprise Web Security.
   
2. A plan for building an ecosystem specifically targeting enterprise web security. What does it take to scientifically advance the state of the art?
   

Dinis Cruz @

Chris Schmidt @

Justin Clarke @

Matthias Rohr @

Matteo Meucci @

Mateo Martinez @

Ofer Maor @

Wojciech Dworakowski @

Tobias Gondrom @

1. Show the v3, and debating what we need to create an excellent v4
   

1. An updated outline for the testing guide that is tied into the OWASP common numbering scheme
   
2. A short white paper with ideas for revisions to the Testing Guide for evaluation and discussion by the community at large.
   
3. A committed project manager who can reach out to experts to get the document completed.
   

Cecil Su @

Lucas C. Ferreira @

Keith Turpin @

Achim Hoffmann @

Tom Neaves @

Vishal Garg @

Giorgio Fedon @

Stefano Di Paola @

Pavol Luptak @

Andre Gironda @

Edward Bonver @

Wojciech Dworakowski @

Vlatko Kosturjak @

Antonio Fontes @

Christian Martorella @

1. Restart the Java project
   
2. Find new leadership
   
3. Recruit volunteers
   
4. Build a new Roadmap for the project
   

1. Action plan for the project
   
2. New project leader
   

Daniel Brzozowski @

1. Kickstart the project
   
2. Define leadership and roles
   
3. Prioritize documents
   
4. List all Portuguese materials available
   

1. A prioritized action plan for getting OWASP materials created in Portuguese
   

Sandra Paiva @

L. Gustavo C. Barbato @

Ricardo Melo @

Alexandre Agustini @

1. Reviewing existing methodologies and their pros and cons
   
2. Assigning business impacts to threats
   
3. Assigning technical impacts to threats
   
4. Threat Rating System.
   
5. Can we bring attack trees into main stream threat modeling methodology?
   

1. A document with a public recommendation on the use of threat modeling
   
2. An OWASP standard defining what a threat model is.
   
3. An OWASP standard defining a workflow for creating and maintaining a threat model.
   
4. A white paper providing recommendations on how organizations can use threat modeling to achieve better security earlier in the process. Including a business-case rationale for threat modeling would be excellent.
   

Colin Watson

Mateo Martinez @

Dinis Cruz @

Jim Manico @

Neil Matatall @

Christian Martorella @

Steven van der Baan @

Nishi Kumar @

Cecil Su @

Antonio Fontes @

Sherif Koussa @

Matthias Rohr @

Vishal Garg @

Matteo Meucci @

Seba Deleersnyder @

Tony UcedaVelez @

L. Gustavo C. Barbato @

Edward Bonver @

Ofer Maor @

1. Improve visibility of this project to other document project leaders
   
2. Discussion and documenting suggested enhancements to the next version of the guide
   
3. Collaboration with other OWASP guides
   
4. Plan for implementation of common numbering schema
   

1. An updated outline for the Quick Reference Guide that is tied into the new OWASP common numbering scheme
   
2. A short white paper with ideas for revisions to the Quick Reference Guide
   

Abraham Kang

Juan Jose Rider @

1. Build the first version of the OWASP Common vulnerability list
   

1. Debating the vulnerability list and deliver the first version of the project.
   

Keith Turpin @

Fred Donovan @

Wojciech Dworakowski @

Vlatko Kosturjak @

1. Define a clear strategy for building and deploying the infrastructure for OWASP Code Projects
   
2. Determine if a second OWASP Projects Committee needs to be spun off (OWASP Code Projects Committee) to manage this infrastructure
   
3. Identify key leaders and outline the functional requirements and resources that the infrastructure will need to succeed
   

1. Draft Business Plan for OWASP Projects Infrastructure
   

1. Define a Disclosure Policy for OWASP Projects
   
2. Define a strategy and policy for disclosing vulnerabilities to users
   
3. Refine and Develop a template to be used for disclosing
   
4. Identify a committee or leaders to head up this effort and maintain it
   

1. OWASP Project Disclosure Policy
   
2. OWASP Security Bulletin Template
   
3. OWASP Project Adherence Rules
   

1. Restart OWASP .NET Project.
   
2. Create/Update project roadmap.
   
3. Define new project structure (i.e. subprojects).
   
4. Involve new people in this project.
   

1. OWASP .NET Project plan - white paper with the new vision of the project.
   
2. Updated OWASP .NET Project wiki page.
   

Antonio Fontes @

1. Universal Committee Governance Document/Policies
   
2. Review Board Governance and By-Laws (Including Board composition/elections)
   
3. Committee alignment to OWASP Goals/Mission including Authorities, Individual Missions and Areas of Responsibility (AoR).
   
4. Providing budgets to committees for direct oversight and spending in their AoR
   
5. Additional transparency in OWASP accounting (Expenditures, Expense Reports for Officers/Committee Members.....)
   

1. Universal Committee Governance Document and operating Policies
   
2. Proposed updated OWASP By-Laws
   
3. Committee mission clarifications and delineation of areas of responsibility
   
4. New model for funding OWASP activities
   
5. New policies to enhance transparency
   

Nishi Kumar @

Joe Bernik

Matthew Chalmers @

Sarah Baso @

Doug Wilson @

Kate Hartmann @

John Steven @

Seba Deleersnyder @

1. Review changes made in the last 2 years
   
2. Discuss the high level steps of a project life-cycle
   
3. Approve the OWASP GPC Governance Document
   
4. Streamline project initialization process to make it easier for new projects
   
5. Implement project governance change approved by the Board to limit use of "OWASP" brand name to projects of certain maturity
   

1. Initial draft for an RFP for a centralized OWASP project hosting solution
   
2. A project lifecycle flow chart to identify the necessary steps to improving the visibility of a project's health
   
3. An envisioned structure for the future of OWASP Projects
   

Nishi Kumar @

1. The OWASP 2011 Industry Plan. To discuss plans for working with industry in a closer manner. The plan should contain specific activities, commitments, dates, and expected outcomes.
   

David Campbell

Eoin Keary

Matt Tesauro

Joe Bernik

Nishi Kumar @

Lucas C. Ferreira @

Tobias Gondrom @

Vehbi Tasar

Colin Watson

Jason Taylor @

Sarah Baso @

Mateo Martinez @

Konstantinos Papapanagiotou @

1. Develop a plan for reaching out to other organizations in order to expand OWASP's exposure to the larger security and developer communities.
   
2. Create a budget and funding plan for the Membership Committee
   
3. Be ready to conduct a survey of new and existing OWASP Members and Supporters. Develop survey questions and specifics for the implementation.
   

1. The OWASP 2011 Membership Plan – describing the membership program and recommendations, marketing plans. The plan should contain specific membership targets for all membership classes and detailed strategies for achieving the goals.
   

Mateo Martinez @

Dan Cornell @

Tony UcedaVelez @

Ofer Maor @

1. Define the mission of the Connections Committee
   
2. Agree engagement/working patterns with the other global committees
   

1. The OWASP 2011 Connection Plan – describing the current connections program and detailing the specifics for what will happen in 2011. The plan should contain specific goals and strategies for achieving the goals.
   

Doug Wilson @

Andre Gironda @

1. Challenges and solutions to run a successful OWASP chapter
   

1. The OWASP 2011 Chapter Plan – describing the current state of OWASP chapters worldwide and identifying what will happen in 2011 to grow the number of chapters and improve their quality.
   

Matthew Chalmers @

Matteo Meucci @

Mateo Martinez @

Ferdinand Vroom @

Helen Gao @

L. Gustavo C. Barbato @

Ofer Maor @

Wojciech Dworakowski @

Martin Knobloch @

Vlatko Kosturjak @

Antonio Fontes @

1. Estimate how the past achievements do support the current educational developments
   
2. Evaluate how we can get the projects involved in developing (or at least reviewing) training material
   
3. Define new goals for the upcoming period
   
4. Define success factors for the upcoming period
   

1. The OWASP 2011 Education Plan – describing the specific plans for education in 2011 with schedule, targets, action plans, etc…
   

Cecil Su @

Jason Taylor @

1. Discuss the GCC's current 2011 Plan of action and new initiatives
   
2. Review comments provided in the Conference Planner Survey
   
3. Discuss mechanisms to improve Planner/Operational Support
   
4. Discuss mechanisms to improve event marketing/sponsorships
   
5. Discuss Global Conference Sponsorship Plan
   

1. The OWASP 2011 Conference Plan – describing the plan for continuing to make our conferences even better, specifically defining the various tiers of conferences, naming, partnering with other entities, and other challenges.
   

Nishi Kumar @

Lucas C. Ferreira @

Ralph Durkee @

Matthew Chalmers @

Matteo Meucci @

Mateo Martinez @

Neil Matatall @

Seba Deleersnyder @

L. Gustavo C. Barbato @

1. Identify the specific needs for a participation tracking system
   
2. Develop a working framework that provides an open, distributed and accountable mechanism to track participation
   
3. Discuss initial "points system" detail and point values
   
4. Discuss normalization of system points
   

1. Point Tracking System
   
2. Initial set of point values
   
3. A white paper recommending an approach for tracking/measuring OWASP participation to be used for prioritizing support whenever needed.
   

Martin Knobloch @

1. Having annual OWASP Foundation Bord Member election? During annual OWASP Summit's?
   
2. Professionalize OWASP PR, hiring more OWASP employees, at least one for PR?
   
3. Hiring more OWASP professionals?
   
4. Paying for OWASP Board Members and OWASP Leaders?
   
5. Creating an European OWASP entity?
   

1. A white paper recommending an approach for professionalizing OWASP without upsetting the progress we are making in the existing structure. Specifically consider the budget requirements for the plan and the effect that this would have on existing budgets.
   

Lorna Alamri @

Mark Bristow @

Matthew Chalmers @

Justin Clarke @

1. Define the members of the group
   
2. Define the rules of engagement for the group
   
3. Discuss how to fund Brazilian chapters
   
4. Discuss the translation of OWASP materials to Portuguse
   
5. Define the rules for hosting AppSec Brazil
   

1. Objectives and working plan to improve OWASP presence in Brazil
   

Eduardo Jorge Feres Serrano Neves @

1. Develop v1 of OWASP Global Sponsorship Model
   
2. Develop 2012 Call for AppSec Conferences (and new management system)
   
3. Develop messaging plan for new initiatives
   

Lucas C. Ferreira @

Neil Matatall @

Ralph Durkee @

Michael Coates @

Colin Watson

Martin Knobloch @

Seba Deleersnyder @

Jim Manico @

Mark Bristow @

1. Create an APAC mailing list
   
2. Regional Membership – Currently there are very few paying members in APAC. The reasons are both economical and cultural. Ofer volunteered to create a model that is easy to implement and administer. He will propose the model to the membership committee.
   
3. Conferences in APAC – Annual conferences in China as well as additional conferences in other APAC area. Conference organizers should summit their schedule to Global Conference Committee as early as possible, preferably one year in advance. This will help GCC allocating funds and recommending vendor sponsors to support the conference. Offer CPE or participation certificate. This will not only provide conference/workshop participants something to show, it will also create awareness among his colleagues and employers. Please note the certificate will be similar to CPE credits, Continual Professional Education, and will not be a general OWASP certificate.
   
4. Membership Perks/Discounted Training – We need to show people more in APAC what’s in the membership for them. Proposed to provide paid members free or discounted in-person training during or outside of conferences.
   
5. Online itinerary, tripit.com - The goal is attract members by improving communication and corporation among chapters. This will be especially beneficial to chapters outside of US and Europe. Cecil will use tripit or another method for entering itineraries. Local chapters can invite the traveler to their meeting, training or just for a drink.
   

Anthony Lai

Mohd Fazli Azran

Cecil Su

Steven Cheng

Gandhi

Zaki Akhmad

Onn-chee Wong

Kate Hartmann

Mark Bristow

1. Internationalization
   
2. Global Job Board
   
3. New OWASP chapters in parts of the world where we have not spread much yet
   

1. A white paper with specific recommendations on how we can ensure the greatest amount of access and involvement with OWASP for all people everywhere.
   

Mateo Martinez @

Cecil Su @

1. Define what it means to be an OWASP Leader
   

1. Definition of critera for OWASP Leaders
   
2. A standard defining exactly what characterizes an OWASP Leader, for use in providing benefits and prioritizing support.
   

Chris Schmidt @

Mark Bristow @

Daniel Brzozowski @

Martin Knobloch @

Vlatko Kosturjak @

Antonio Fontes @

1. Revisit goals from previous working session
   
2. Identify available Google Apps (e.g. Code Review, Moderator, Short Links, Project Hosting, Groups, etc) that we can leverage to support OWASP Website Infrastructure.
   
3. Review Website Overhaul Proposal for consideration
   
4. Decide what elements should be outsourced/contracted to expedite implementation
   
5. Resolve on schedule for achieving goals
   

1. A project plan describing the future of web support for the OWASP ecosystem (think social) that covers all the various constituents, stakeholders, users, leaders, etc…. The plan will define all the steps necessary to get there and provide a rough estimate of the effort to get there. To the maximum extent possible, the plan will be designed to be parallelizable so that parts can be worked independently.
   

Achim Hoffmann @

Michael Coates @

Colin Watson

Nishi Kumar @

Dinis Cruz @

Matthew Chalmers @

Justin Clarke @

Mark Bristow @

Seba Deleersnyder @

1. A white paper describing the OWASP brand and the challenges of getting people to use the brand without abusing it. The paper will update the OWASP Brand Guidelines and make recommendations about other ways to promote and protect the brand.
   

Lucas C. Ferreira @

Matthew Chalmers @

Matteo Meucci @

Martin Knobloch @

1. Determine strategic conferences/events OWASP can participate in to engage developers.
   
2. Determine new/existing projects that can be leveraged to attract developers to OWASP
   
3. Determine method for allowing developers to promote their activities in OWASP
   

1. A white paper describing strategies for reaching developers with OWASP philosophy, materials, tools, etc…
   

Steven van der Baan @

L. Gustavo C. Barbato @

Antonio Fontes @

1. Identify privacy enhancing & verification aspects of existing tools and documents
   
2. Create a one-page OWASP projects-to-privacy cross reference factsheet
   

1. Complete and approve OWASP's response to the FTC's staff report "Protecting Consumer Privacy in an Era of Rapid Change - A Framework for Businesses and Policymakers"
   
2. A white paper discussing how the privacy ecosystem overlaps with the OWASP ecosystem and whether there should be more bridges built between them.
   

Lorna Alamri @

Achim Hoffmann @

Elke Roth-Mandutz @

David Campbell @

Abraham Kang

1. A white paper describing the outcomes from Samy’s EU tour and whether it is something that we can or should replicate.
   

1. Create a whitepaper on application security for critical systems
   
2. Create a whitepaper on how application security protects people
   

1. A white paper describing how the safety ecosystem overlaps with the OWASP ecosystem and whether there should be more bridges built between them.
   

1. Open letter to governments
   
2. Open letter to insurance companies
   
3. Tools inoperability
   
4. Tools customization by security consultants
   
5. Wiki leaks & WebAppSec
   

1. A white paper on how OWASP can use “quotes” effectively to drive awareness and action. The paper will suggest specific strategies for obtaining, vetting, and promoting quotes to achieve our aims.
   

1. A white paper capturing possible missed opportunities during the 2000’s and suggesting strategies for doing better in the 2010’s.
   

1. A process for gathering and addressing suggestions for new OWASP funding opportunities.
   
2. A recommendation on whether or not the investment in a CEO would be cost-effective.
   

Dinis Cruz @

Mark Bristow @

Doug Wilson @

Martin Knobloch @

Doug Wilson @

Martin Knobloch @

Vlatko Kosturjak @

Juan Jose Rider @

1. Educate security professionals and developers on, and dispel the myths about, audit and control
   
2. Educate auditors on OWASP, software development and web & application security
   
3. Discuss ways OWASP can help security pros, developers and auditors work together for mutual benefit and world domination
   

1. A white paper describing specific strategies for interacting with auditors as described above.
   

Achim Hoffmann @

Justin Clarke @

1. Discuss the goals of the OWASP Licensing model for OWASP documents and informative materials.
   
2. Understand better the corporate use cases for OWASP documentation and artifacts.
   
3. Identify possible options for licensing changes to spur growth in corporate sponsorships.
   

1. Licensing Requirements for OWASP documentation
   
2. List existing Licenses used by OWASP projects.
   
3. Problem corporations face with adopting and utilizing OWASP materials and code
   
4. Recommendations for changes in the OWASP License
   
5. OWASP: Licensing FAQs
   

Alexandre Miguel Aniceto @ Test

1. Determine realistic ways to promote OWASP offerings to governments around the world
   
2. Determine what governments are looking for from OWASP
   
3. Determine resources that governments could provide that would assist the OWASP mission
   
4. Explore the practicality of liaison roles to/from government organizations
   

1. A list of suggestions to pass along to the Global Connections Committe for the best ways of engaging government
   
2. A high level outline of what OWASP has to offer governments at large
   
3. A list of items that government agencies are looking for from OWASP
   
4. An outline of strategy for pursuing interaction with different governments in depth
   

Mateo Martinez @

Colin Watson

Martin Knobloch @

1. First steps on the goal of building partnerships involving Euro/American Goverment Agencies + Euro/American Universities + OWASP Foundation to push forward web appsec education goals.
   
2. To assess the potential of the European funding currently available and designed to support 'Transatlantic Education' - Call for proposals 2011