|
|
| (527 intermediate revisions by 14 users not shown) |
| Line 1: |
Line 1: |
| − | {{Chapter Template|chaptername=Netherlands|extra= The chapter leader is [mailto:[email protected] Bert Koelewijn] | + | {{Chapter Template|chaptername=Netherlands|extra=|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}} |
| − | <paypal>Netherlands</paypal>
| |
| − | |mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-netherlands|emailarchives=http://lists.owasp.org/pipermail/owasp-netherlands}} | |
| | | | |
| − | === Call for Speakers === | + | <!-- First tab --> |
| − | We are continuously looking for speakers and presentations make the chapter meetings as interesting as possible. Therefore we are looking inside and outside OWASP for known international specialists. But we know, there is a lot interesting stuf happening inside the Netherlands, too! <br/>
| + | = Local News = |
| − | '''Presentations:''' Are you working on interesting subject, you would like to share your experiences with the OWASP community. Any topic related to application security will be appreciated!<br/>
| + | =='''News'''== |
| − | '''VAC, Vulnerability, Attack, Countermeasure:''' The goal is an half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br/>
| + | :;OWASP Netherlands Monthly meetup: |
| | + | :: Next meetup [[OWASP_NL_Monthly_Meetup#June_18.2C_2019 | OWASP NL Chapter Meeting, June 18th]] |
| | + | ::Slides and recordings are available [[OWASP_NL_Monthly_Meetup#January_17.2C_2019, Hilversum | OWASP Nl Chapter Meeting, January 17th]] |
| | + | :;OWASP BeNeLux-Day 2018: |
| | + | ::[[OWASP_BeNeLux-Day_2018 | OWASP BeNeLux-Day 2018 - Mechelen, Belgium]] |
| | + | ::[[OWASP_BeNeLux-Day_2017#tab=Conferenceday | Click here for the OWASP BeNeLux-Day 2017]] |
| | | | |
| − | === Sponsorship of a local chapter meeting === | + | =='''Provisional 2017 Chapter Event Calendar'''== |
| − | We are continuously looking for locations to hold local chapter meetings. Therefore, we need companies willing to sponsor of host events.<br>
| + | *Slide Decks from past Chapter meetings can be downloaded from the [[Netherlands#Past_Events | Past Events page]]. |
| − | '''Hosting a local chapter meeting:''' To host a local chapter meeting, you facilitate the meeting location and beverage for the attendees<br> | |
| − | '''Sponsorship of a local chapter meeting:''' You cover the cost of renting the location for the meeting and the payment of the beverages for the attendees<br>
| |
| − | '''Please let us know via the OWASP chapter meeting questionnaire of via email to martin.knobloch@owasp.org<br>'''
| |
| | | | |
| − | == '''OWASP NL Cafe''' == | + | =='''Other OWASP Events'''== |
| − | <font color="red">'''NEW:'''</font>
| + | ::;[[OWASP_Events/upcoming_events | OWASP International, Upcoming Events]] |
| − | Monthly informal platform to speak about (Web) application security matters! No registration required, just drop by!
| |
| − | * no programm
| |
| − | * no agenda
| |
| − | * whatever comes up!
| |
| | | | |
| − | === Next OWASP Cafe:=== | + | =='''Call for Presentations'''== |
| − | Tuesday August 6th, from 7 pm, drop in whenever you can!
| + | ::;[https://docs.google.com/a/owasp.org/spreadsheet/viewform?formkey=dGs1UFN0Ul9YR1pRcGdYRmtYallraUE6MQ#gid=0 OWASP NL Chapter Call For Presentation] |
| | | | |
| − | <pre> | + | =='''Stay in contact:'''== |
| − | Who is in for close to the Central Station in Utrecht?
| + | <center> |
| | + | {| cellspacing="15" |
| | + | |- |
| | + | | [[Image:Meetup-logo-2x.png|120px|link=https://www.meetup.com/OWASP-Chapter-Netherlands-Meetup]] |
| | + | | [[Image:Join the list.png|150px|link=https://groups.google.com/a/owasp.org/forum/#!forum/netherlands-chapter]] |
| | + | | [[Image:Follow-us-on-twitter.png|175px|link=http://www.twitter.com/owasp_NL]] |
| | + | | [[Image:Linkedin-button.gif|135px|link=http://www.linkedin.com/groups/OWASP-Netherlands-Chapter-1987229/about]] |
| | + | |[[Image:slack-horizontal.png|90px|link=https://owasp.slack.com/messages/chapter-netherlands/details/]] |
| | + | |} |
| | + | </center> |
| | | | |
| − | Where:
| + | =='''Sponsors'''== |
| − | To be decided! Any suggestions are welcome!
| + | ::;Our structural Chapter and OWASP [[OWASP_BeNeLux-Day_2017| OWASP BeNeLux-Day 2017 sponsor]] supporters: |
| − | </pre> | + | ::Interested in Sponsoring the Netherlands OWASP Chapter, email netherlands '@' owasp.org |
| | + | <br> |
| | + | '''[https://www.owasp.org/index.php/Corporate_Membership OWASP Corporate Member]:''' |
| | + | <center> |
| | + | {| cellspacing="15" |
| | + | |- |
| | + | | [[File:200x60_netsparker_logo.png|250px|link=https://www.netsparker.com]] |
| | + | |} |
| | + | </center> |
| | + | '''[[OWASP_BeNeLux-Day_2017| OWASP BeNeLux-Day 2017 sponsor]]:''' |
| | + | <center> |
| | + | {| cellspacing="15" |
| | + | | [[File:Achmea_L1_RGB_colour.jpg|250px||link=https://www.achmea.nl/]] |
| | + | |} |
| | + | </center> |
| | + | <center> |
| | + | {| cellspacing="15" |
| | + | | [http://www.vest.nl https://www.owasp.org/images/6/67/Vest.jpg] |
| | + | | [https://secwatch.nl https://www.owasp.org/images/f/ff/Secwatch_logo_small.png] |
| | + | | [[File:Avi Logo Transparent Background 300pix.png|200px|link=https://avinetworks.com/]] |
| | + | |} |
| | + | </center> |
| | + | <center> |
| | + | {| cellspacing="15" |
| | + | |- |
| | + | ] |
| | + | | [http://www.sig.eu/security https://www.owasp.org/images/9/99/SIG_LOGO.png] |
| | + | | [https://www.secura.com/ https://www.owasp.org/images/7/78/Secura_logo_small.png] |
| | + | | [[File:Xebia logo-large-transparent.png|200px|link=https://xebia.com/agile-software-security]] |
| | + | | [https://informatiebeveiliging.nl/ https://www.owasp.org/images/9/9a/Logo_Informatiebeveiliging-200.png] |
| | + | |} |
| | + | </center> |
| | | | |
| − | == '''OWASP NL Chapter Meetings Schedule 2009''' == | + | <!-- |
| − | This is an overview of the 2009 local chapter meeting schedule. Details of the meetings can be found in the announcements that will be posted below this schedule.
| + | [[File:VeraCode logo.png|250px|link=https://www.veracode.com]] |
| − | <pre>
| + | [[File:Vest.jpg|250px|link=http://www.vest.nl]] |
| − | April 9th
| + | [[File:Intigriti_verticaal.jpg|250px|link=http://www.intigriti.be]] |
| − | ---------- | + | [[File:Ecurify-2016.png|250px|link=http://www.securify.nl]] |
| − | Time : 18.00 - 21.30
| + | [[File:HPE_logo_250.png|250px|link=ttp://www8.hp.com/nl/nl/software-solutions/enterprise-security.html]] |
| − | Main Topic : Knowing Your Enemy
| + | [[File:Nixu-logo.png|250px|link=https://www.nixu.com/en/nixubenelux]] |
| − | Presentations: Modern information gathering; how to abuse search engines Dave van Stein
| + | [[File:Logo_xebia.jpg|250px|link=https://xebia.com/agile-software-security]] |
| − | VAC Cross-site scripting Martin Visser
| + | [[File:Logo_Informatiebeveiliging-200.png|250px|link=https://informatiebeveiliging.nl]] |
| − | Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers
| + | --> |
| − | Location : Lange Dreef 17
| + | <!-- Second tab --> |
| − | 4131 NJ Vianen
| |
| − | Sponsor : Sogeti Nederland B.V.
| |
| | | | |
| − | May 28th
| + | = Calendar = |
| − | ---------- | + | == Provisional Chapter Event Calendar 2019 == |
| − | Time : 18.00 - 21.30
| + | {| class="wikitable" style="text-align:center;" border="1" | |
| − | Main Topic : AppSec Europe 2009
| + | ! width="300" | Date |
| − | Presentations: AppSec-EU 2009 Sebastien Deleersnyder, Telindus
| + | ! width="350" | Type |
| − | VAC Cross-Site Request Forgery Niels Teusink
| + | ! width="300" | Location |
| − | Open session / discussion about subjects brought forward by
| + | |- align="center" |
| − | the attendees Martin Knobloch/Ferdinand Vroom/Peter Gouwentak
| + | |- align="center" |
| − | Location : ASR Nederland
| + | | [https://www.meetup.com/OWASP-Chapter-Netherlands-Meetup/events/247313273/ February 8th, 2019] |
| − | MD0.60 - Auditorium
| + | | [[OWASP_NL_Monthly_Meetup#January_17.2C_2019| OWASP NL Wiki ]] |
| − | Smallepad 30
| + | | Amsterdam |
| − | 3811MG Amersfoort
| + | |- align="center" |
| − | Sponsor : ASR Nederland
| + | | [https://www.meetup.com/OWASP-Chapter-Netherlands-Meetup/events/261811435/ June 18th, 2019] |
| | + | | [[OWASP_NL_Monthly_Meetup#June_18.2C_2019| OWASP NL Wiki ]] |
| | + | | Amsterdam |
| | + | |} |
| | + | <!-- Third tab --> |
| | | | |
| − | September 24th
| + | = Past Events = |
| − | ----------
| + | *Events held in [[Netherlands Previous Events 2019|2019]] |
| − | Time : 17.30 - 21.30
| + | *Events held in [[Netherlands Previous Events 2018|2018]] |
| − | Main Topic :
| + | *Events held in [[Netherlands Previous Events 2017|2017]] |
| − | Presentations:
| + | *Events held in [[Netherlands Previous Events 2016|2016]] |
| − | Location :
| + | *Events held in [[Netherlands Previous Events 2015|2015]] |
| − | Sponsor :
| + | *Events held in [[Netherlands Previous Events 2014|2014]] |
| | + | *Events held in [[Netherlands Previous Events 2013|2013]] |
| | + | *Events held in [[Netherlands Previous Events 2012|2012]] |
| | + | *Events held in [[Netherlands Previous Events 2011|2011]] |
| | + | *Events held in [[Netherlands Previous Events 2010|2010]] |
| | + | *Events held in [[Netherlands Previous Events 2009|2009]] |
| | + | *Events held in [[Netherlands Previous Events 2008|2008]] |
| | + | *Events held in [[Netherlands Previous Events 2007|2007]] |
| | + | *Events held in [[Netherlands Previous Events 2006|2006]] |
| | + | *Events held in [[Netherlands Previous Events 2005|2005]] |
| | | | |
| − | December 10th
| + | <!-- Fourth tab --> |
| − | ---------- | |
| − | Time : 17.30 - 21.30
| |
| − | Main Topic :
| |
| − | Presentations:
| |
| − | Location :
| |
| − | Sponsor :
| |
| − | </pre>
| |
| | | | |
| | + | = Chapter Leaders = |
| | + | The Netherlands Chapter is supported by the following board: |
| | + | *[https://www.owasp.org/index.php/User:Knoblochmartin Martin Knobloch] |
| | + | *[https://www.owasp.org/index.php/User:Joren Joren Poll] |
| | + | *[https://www.owasp.org/index.php/User:Edwin_Gozeling Edwin Gozeling] |
| | + | *[https://www.owasp.org/index.php/User:Cooper Tom Wirschell] |
| | | | |
| | + | <br> |
| | + | |
| | + | Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects. |
| | | | |
| − | '''Registration'''<br>
| + | <!-- Fifth and last tab --> |
| − | If you want to attend, please send an email to: bert.koelewijn@owasp.org | + | = Chapter Support = |
| − | <br/>
| + | === Chapter Sponsoring === |
| − | <br/>
| + | OWASP Netherlands is looking for organizations to sponsor our chapter. |
| − | All OWASP chapter meetings are free of charge and you don't have to be an OWASP member to attend. There are never any vendor pitches or sales presentations at OWASP meetings.<br/>
| + | If you are interested in sponsoring the Netherlands chapter please contact us via email: [mailto:netherlands@owasp.org netherlands 'at' owasp.org]. |
| − | <br/>
| |
| − | NOTE TO CISSP's: OWASP Meetings count towards CPE Credits.<br/>
| |
| − | <br/>
| |
| − | <br/>
| |
| | | | |
| − | =='''OWASP NL Mini-Meetings''' == | + | === Donation === |
| − | <font color="red">'''NEW:'''</font>
| + | If you would like to donate to our chapter, please use the PayPal link at the top of this page. |
| − | Platform to discus on specific issues related to (Web) Application Security. The topic's are brought in by the OWASP NL community!<br>
| + | ;Thank you! |
| − | Something on your mind to discus, put your idea online at: Mini Meetings [[Netherlands_Mini_Meeting_2009|Netherlands_Mini_Meeting_2009]]
| |
| − | To attend the meeting, send an email to the contact's email address!
| |
| | | | |
| − | === Next Mini-Meeting: === | + | === Call for Speakers === |
| − | <pre> | + | We are continuously looking for speakers.<br>'''Presentations:''' Are you working on an interesting subject, would you like to share your experience with the OWASP community and do you have presentation skills. Please let us know! Any topic related to web application security will be appreciated!<br>'''VAC, Vulnerability, Attack, Countermeasure:''' The VAC is a re occuring part of the chapter meetings. The VAC is a half hour in-depth technical presentation about a vulnerability, how it can be exploited and how to prevent it!<br> |
| − | Topic : Tools of the trade; exchange real-life experiences
| + | <span style="font-weight: bold;">Links: </span> |
| − | Contact : Dave van Stein, dvstein+owasp [-at-] gmail [-dot-] com
| + | [http://www.owasp.org/index.php/Speaker_Agreement Speaker Agreement] |
| − | ---------- | + | [http://www.owasp.org/images/5/54/Presentation_template.ppt Template] |
| − | Date : 27th August 2009
| + | Interested in presenting at a local chapter meeting, please send an email to: netherlands 'at' owasp.org |
| − | Time : 18:00 (sandwiches provided) to 21:30
| |
| − | Location : ps_testware
| |
| − | Dorpsstraat 26
| |
| − | 3941 JM Doorn
| |
| − | Details : Exchange real-world experience about web testing tools. What is really useable and what is not.
| |
| − | Attendees : Min 6, max 8, currently 3 attendees
| |
| − | </pre>
| |
| | | | |
| − | == '''Meeting Minutes''' ==
| + | <!-- |
| − | === Meeting minutes May 28th 2009 === | + | === Call for Location === |
| − | | + | For the OWASP Netherlands chapter meetings to come, we are continuously looking for locations! |
| − | At May 28th, the Dutch OWASP chapter came together at the ASR building in Amersfoort. The main topic of the evening was AppSec 2009. There were 2 speakers and approximately 20 attendees.<br/>
| + | Most preferable, the location is good accessible with public transport and by car. Free parking should be provided. |
| − | <br/>
| + | What do we expect: |
| − | There was no sponsor talk or general announcement so after a very short welcome talk by Bert the evening started.<br/>
| + | *meeting room for at least 50 people |
| − | <br/>
| + | *lunch for attendees |
| − | '''First presentation:''' AppSec 2009 by Sebastien Deleersnyder. <br/>
| + | **drinks, sandwiches... |
| − | The first presentation of the evening was a recap of AppSec 2009 in Poland. The conference was a big success with around 170 attendees. The meeting preceded the 2009 edition of Confidence [http://2009.confidence.org.pl/] resulting in a week of security presentations and workshops. All AppSec presentations and many movies, pictures, and other material can be found on the AppSec wiki [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2009_-_Poland] but a few items are worth mentioning in specific. First of all OWASP is growing and changing. These changes include a simplification of the membership fees, the introduction of a 'code of ethics', and a general review of all 120 projects. Other highlights are the project ASVS, which has reached an international standard status and updated versions of WebGoat and LabRat.<br/>
| + | *a small present for the speakers |
| − | Lastly besides a Wiki and a LinkedIn group, OWASP is now also active on Twitter [http://twitter.com/owasp] & [http://twitter.com/owasp_nl] and has two overview pages with all video [http://www.owasp.org/index.php/Category:OWASP_Video] and audio materials [http://www.owasp.org/index.php/OWASP_Podcast].<br/>
| + | **(e.g. bottle of wine, for speakers from aboard alcohol might be less practical if flying in only with hand luggage) |
| − | Feel free to use all the materials (as long as you abide by the new code of ethics off course) and visit the OWASP websites frequently for updates !<br/>
| + | Interested in sponsoring a local chapter meeting, please send an email to: netherlands 'at' owasp.org |
| − | <br/>
| + | --> |
| − | '''Second presentation:''' VAC Cross-Site Request Forgery by Niels Teusink. <br/>
| + | <!-- Don't remove this tag --> |
| − | After succesfull VAC's about SQL injection and Cross-site scripting, the topic of this evening's VAC was Cross-site Request Forgery, also known as CSRF. CSRF is probably one of the least understood vulnerabilities, but can have tremendous consequences when succesfully exploited. In essence it is an attack that misuses the victim's autorisations with malicious scripts. CSRF attacks can also be easily combined with other attack, like e.g. XSS, making them even more dangerous. <br/>
| + | __NOTOC__ |
| − | Despite the name suggests, these attacks do not have to be on different websites (domains). With the continuing trend to combine multiple functionalities in a single application, so-called onsite request forgeries are becoming more and more frequent. Contrary to XSS and SQL injection, CSRF can not be blocked by input validation. In order to prevent these kind of attacks, an application has to able to verify the authenticity of a request. This can be achieved by several methods like using a unique identifier for a session or each request or requiring additional user input like a CAPTCHA or a one-time token. <br/>
| + | <headertabs></headertabs> |
| − | <br/>
| + | [[Category:Europe]] |
| − | '''Open Discussion''' <br/>
| |
| − | The evening was closed with an open discussion about how to improve knowledge sharing among the OWASP members. Many interesting discussions start during the drinks after the presentations on the OWASP evenings, discussions that sadly often are stopped prematurly due to time restraints.<br/>
| |
| − | As an addition on the quarterly presentation evenings, the Dutch chapter decided to also start mini-meetings and the OWASP cafe.<br/>
| |
| − | Mini-meetings will not be planned on beforehand, but instead will be planned when a topic is proposed and enough attendees have stated an interest in the topic. The attendees will have to select a location themselves but can request a donation from the OWASP for drinks and snacks. Topics discussed at the mini-meeting will have to be listed in minutes so other members can also profit from this knowledge exchange.<br/>
| |
| − | The OWASP cafe will be planned each first thursday of the month on a location that will be listed on the OWASP Dutch chapter site. The rules are simple: the evening starts at a certain time, ends at a certain time and will be filled with drinks, snacks, and nerd/hacker/geek humor and discussions in between.<br/>
| |
| − | Check the website frequently for the location of the next mini-meeting and OWASP cafe !<br/>
| |
| − | <br/>
| |
| − | <hr>
| |
| − | | |
| − | === Meeting minutes April 9th 2009 ===
| |
| − | | |
| − | At April 9th, the Dutch OWASP chapter came together at the office of Sogeti in Vianen. The main topic of the evening was "knowing your enemy". There were 3 speakers and approximately 50 attendees.<br/>
| |
| − | <br/>
| |
| − | The sponsor of the evening started with a small welcome and an overview of their internal security program named PASS. After some small announcements from the OWASP the evening started.<br/>
| |
| − | <br/>
| |
| − | '''First presentation:''' Modern information gathering; how to abuse search engines by Dave van Stein.<br/>
| |
| − | The first presentation of the evening was about using search engines and crawlers to gain detailed information about webservers and websites. Ill configured webservers allow search engine crawlers to collect much information about a system, information that is stored and can be retrieved with search engines. Many websites and tools make use of this mechanism and, combined with DNS and WHOIS information, are able to provide detailed or sensitive information like usernames, vulnerabilities, present files or network topology about a system without targeting it directly.<br/>
| |
| − | Restricting crawlers to access a system can act as a first line of defence and reduce exposure and risks.<br/>
| |
| − | <br/>
| |
| − | '''Second presentation:''' VAC Cross-site scripting by Martin Visser. <br/>
| |
| − | The second VAC on an OWASP meeting was about Cross-site scripting also known as XSS. XSS vulnerabilities are often misunderstood and underestimated but facts show that XSS vulnerability abusing attacks are nowadys the fastest growing and most widespread type of exploit. In short XSS vulnerabilities allow for user input to be executed when containing javascript or HTML code. When combined with other vulnerabilities the possibilities of these attacks are vitually limitless.<br/>
| |
| − | The only way to prevent these attacks is to sanitize all input and output fields, but this can be more difficult than it appears to be. Simply blacklisting fragments like <script> is not sufficient due to the possibility of recursivity (e.g. <scr<script>ipt>) and encoding (e.g. URL encoding: %3C%73%63%72%69%70%74%3E). Using multiple layers of filters on various places is the only way to assure enough protection against these types of attacks.<br/>
| |
| − | <br/>
| |
| − | '''Third presentation:''' Beveiligingsaspecten van webapplicatie-ontwikkeling by Wouter van Kuipers. <br/>
| |
| − | The third presentation of the evening was about the efficiency of a source code analyer for php based websites. Approximately 33% of all websites use php and this can be explained by the low learning curve and ease of use of the language. Due to the low learning curve many php developers have little experience with programming and almost no awareness regading security resulting in many unsecure websites. Source code analysis can help preventing many security issues, but their usage does have some limitations. Firstly the scan on itself takes only a few minutes, but analysing the results requires much longer and depends greatly on how familiar the analyser is with the scanned source code. Second these analysers produce many flase positives, making analysis even more time consuming. Lastly not all vulnerabilities are detected with the same efficiency. Especially vulnerabilities that are dependent on the application logic like injection or XSS are not always efficiently detected.<br/>
| |
| − | Concluding, like all tools, a source code analyser can be a powerful tool, but one has to be aware of its limitations. These tools can provide results very fast, but when used on unfamiliar code the analysis can be very time consuming.
| |
| − | <br/>
| |
| − | | |
| − | == Scheduled OWASP NL Chapter Meetings: ==
| |
| − | === Meeting Schedule May 28th 2009: AppSec Europe 2009 ===
| |
| − | | |
| − | '''Summary'''
| |
| − | The main goal of the upcoming OWASP-NL meeting is to provide an abstract of the recently held AppSec Europe 2009, a VAC about CSRF and, new, an open discussion on application security subjects brought forward by the attendees.
| |
| − | <table>
| |
| − | <tr>
| |
| − | <td width="350">
| |
| − | ASR Nederland<br/>
| |
| − | <br/>
| |
| − | MD0.60 - Auditorium<br/>
| |
| − | Smallepad 30<br/>
| |
| − | 3811MG Amersfoort<br/>
| |
| − | </td>
| |
| − | <td width="650">
| |
| − | [[Image:ASR Nederland logo.jpg|200px]]
| |
| − | </td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td width="350">
| |
| − | </td>
| |
| − | <td width="650">
| |
| − | | |
| − | <br/>
| |
| − | | |
| − | <br/>
| |
| − | </td>
| |
| − | </tr>
| |
| − | </table>
| |
| − | | |
| − | '''18.30 - 18.45 Introduction (OWASP organization, projects, sponsor) '''<br> | |
| − | | |
| − | '''18.45 - 19.45 AppSec-EU 2009 (Sebastien Deleersnyder, Telindus) '''<br>
| |
| − | Update on the AppSec-EU 2009: <br>
| |
| − | OWASP State of the union, an update on OWASP and OWASP projects and of course the highlights of the AppSec-EU 2009 presentations.
| |
| − | | |
| − | '''19.45 - 20.00 Break '''<br>
| |
| − | | |
| − | '''20.00 - 20.30 VAC Cross-Site Request Forgery (Niels Teusink, Fox-IT) ''' ([[Media:20090409_VAC-CSRF-Niels_Teusink.pdf]])<br>
| |
| − | CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.
| |
| − | | |
| − | Niels Teusink holds a bachelor degree in Computer Science and has been experimenting with IT security for over a decade. He has worked for Fox-IT since 2005; first as a software engineer and since 2007 as a penetration tester. He has since performed dozens of penetration tests for all sorts of companies, including governments, banks and nuclear installations.
| |
| − | | |
| − | '''20.30 - 21.15 Open session / discussion (Martin Knobloch/Ferdinand Vroom/Peter Gouwentak) ''' <br>
| |
| − | Open session / discussion about subjects brought forward by the attendees.
| |
| − | | |
| − | The Announcement of this meeting: [[Media:Announcement OWASP-NL May 28th 2009.pdf]]<br>
| |
| − | The flyer of this meeting: [[Media:owasp_NL_may2009.pdf]]
| |
| − | <br/>
| |
| − | <hr>
| |
| − | === Meeting Schedule 9th April Knowing Your Enemy ===
| |
| − | | |
| − | '''Summary'''
| |
| − | The main goal of the upcoming OWASP-NL meeting is to provide information to managers, architects, designers, developers and security and risk professionals. The speakers will give specific examples and there will be time to ask questions.
| |
| − | <table>
| |
| − | <tr>
| |
| − | <td width="350">
| |
| − | Lange Dreef 17<br/>
| |
| − | 4131 NJ Vianen<br/>
| |
| − | </td>
| |
| − | <td width="650">
| |
| − | [[Image:Sogeti_Nederland_b_v_Logo.jpg|http:\\www.sogeti.nl]] | |
| − | </td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td width="350">
| |
| − | </td>
| |
| − | <td width="650">
| |
| − | About Sogeti Nederland B.V.
| |
| − | Sogeti Nederland B.V. is one of top-5 IT companies of the Netherlands. Our workforce of over 3,500 employees provides top quality IT consultancy and services to leading companies in several industry sectors in the Netherlands. Our focus is local, but we are part of Sogeti Worldwide, offering IT services in the American, German, French, Belgian, UK, Swedish, Swiss and Spanish markets.
| |
| − | | |
| − | Our core business is the design, construction, deployment, testing and maintenance of IT solutions. We stand for quality and IT skills; this is visible in our service and in the methods developed by us such as DYA®, Regatta®, TMap®, TPI® , Inframe®, and TEmb.
| |
| − | | |
| − | Vision
| |
| − | Sogeti delivers value by aligning the results of her services to the strategic goals of the client, thereby committing herself to the success of the client. We prove our commitment by assuming responsibility in various forms and to various degrees.
| |
| − | | |
| − | New trends
| |
| − | Our own research institute ViNT (Institute for Research into New Technology) keeps us and our clients ahead of the newest technology trends and their potential influence, benefits and risks.
| |
| − | <br/>
| |
| − | More information about Sogeti can be found on our website www.sogeti.nl.
| |
| − | <br/>
| |
| − | </td>
| |
| − | </tr>
| |
| − | </table>
| |
| − | | |
| − | '''18.30 - 18.45 Introduction (OWASP organization, projects, sponsor) '''<br>
| |
| − | '''18.45 - 19.30 Modern information gathering; how to abuse search engines Dave van Stein '''([[Media:20090409_passsive_reconnaissance-Dave_van_Stein.pdf]])<br>
| |
| − | Great generals already know the key to success is "knowing your enemy". In hacking terms this is called information gathering, fingerprinting or reconnaissance. Traditionally this phase consisted of using public records like WHOIS and DNS combined with active scans on servers. With the rise of advanced search engines like Yahoo, Live Search and Google a whole new type of reconnaissance has come to life; passive reconnaissance. Often servers are not properly configured which causes lots of valuable information to become available without accessing the server at all. Recently several hacker-tools appeared which use the full capabilities of these search engines giving hackers a head-start at mapping the network they plan to attack. The goal of this session is to give insight in the methods and tools hackers have at their disposal to gather information about systems they plan to attack without accessing the system itself.
| |
| − | Dave van Stein has close to 8 years of experience in software testing. Since the beginning of 2008 he's working for ps_testware as a web application security testing specialist.
| |
| − | | |
| − | '''19.30 - 20.00 VAC Cross-site scripting Martin Visser '''([[Media:20090409_VAC_Cross-site-scripting_Martin_Visser.pdf]])<br>
| |
| − | Martin Visser is a software designer with Sogeti Nederland B.V. specialized in secure application development with Microsoft technologies. He has experience with Microsoft server technologies like ASP.NET, SharePoint and Biztalk. Martin also developed and teaches a 2-day "Application Security - Microsoft development" course both within and outside Sogeti.
| |
| − | | |
| − | '''20.00 - 20.15 Break ''' <br>
| |
| − | '''20.15 - 21.00 Beveiligingsaspecten van webapplicatie-ontwikkeling Wouter van Kuipers ''' ([[Media:20090409_presentatie_Wouter_van_Kuipers.pdf]])<br>
| |
| − | Het ontwikkelen van webapplicaties verschilt op verschillende aspecten met het ontwikkelen van desktop applicaties, met name op het gebied van security. Voor grote bedrijven zijn er oplossingen beschikbaar als bijvoorbeeld SDL, maar voor het midden- en kleinbedrijf zijn dit soort oplossingen beperkt, omdat zij vaak niet de middelen hebben om dergelijke strategieën uit te kunnen voeren. Voor zijn scriptie heeft Wouter van Kuipers middels een literatuuronderzoek, interviews met ontwikkelaars en een onderzoek naar Fortify 360 gekeken hoe het midden- en kleinbedrijf omgaat met deze verschillen en hoe zij het ontwikkelproces kunnen optimaliseren op het gebied van security.
| |
| − | | |
| − | Na een MBO opleiding in de IT is Wouter van Kuipers via de HBO opleiding 'Communicatie Systemen' begin 2007 begonnen met een master
| |
| − | Informatiekunde aan de Radboud Universiteit Nijmegen, welke hij in maart dit jaar hoopt af te ronden. Tijdens zijn MBO studie is zijn interesse in het ontwikkelen van webapplicaties gewekt, wat in 2003 resulteerde in het opzetten van een eigen web-development bedrijf. Dit bedrijf is met name gespecialiseerd in het ontwikkelen van webapplicaties op maat, en het ondersteunen van bedrijven op het gebied van web-developement op freelance basis.
| |
| − | | |
| − | The flyer of this meeting: [[Media:owasp_NL_april2009.pdf]]
| |
| − | | |
| − | == Past Events ==
| |
| − | * Events held in [[Netherlands_Previous_Events_2008|2008]]
| |
| − | * Events held in [[Netherlands_Previous_Events_2007|2007]]
| |
| − | * Events held in [[Netherlands_Previous_Events_2006|2006]]
| |
| − | * Events held in [[Netherlands_Previous_Events_2005|2005]]
| |
Welcome to the Netherlands chapter homepage.
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
