This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Belgium"

From OWASP
Jump to: navigation, search
(Local News)
 
(591 intermediate revisions by 17 users not shown)
Line 1: Line 1:
{{Chapter Template|chaptername=Belgium|extra=The chapter leader is [mailto:sdl@ascure.com Sebastien Deleersnyder]|mailinglistsite=http://lists.sourceforge.net/lists/listinfo/owasp-belgium/}}
+
{{Chapter Template|chaptername=Belgium|extra=The chapter leaders are [mailto:seba@owasp.org Sebastien Deleersnyder], [mailto:[email protected] Lieven Desmet] and [mailto:[email protected] Bart De Win]
 +
|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-belgium|emailarchives=http://lists.owasp.org/pipermail/owasp-belgium}}  
  
== Local News ==
+
= Local News =
  
'''OWASP Moves to MediaWiki Portal - 10:45, 20 May 2006 (EDT)'''
+
== Upcoming Chapter Meetings ==
  
OWASP is pleased to announce the arrival of OWASP 2.0!
+
* OWASP BE chapter meeting: registration via https://owasp-belgium-2019-11-25.eventbrite.com/
  
OWASP 2.0 utilizes the MediaWiki portal to manage and provide
+
See the {{#switchtablink:Chapter Meetings|Chapter Meetings}} tab for more details and older meetings.
the latest OWASP related information. Enjoy!
 
  
== Latest Chapter Meeting ==
+
== Stay in Touch ==
  
 +
<center>
 +
{| cellspacing="15"
 +
|-
 +
| [[Image:Meetup-logo-2x.png|120px|link=http://www.meetup.com/Belgium-OWASP-Open-Web-Application-Security-Project/]]
 +
| [[Image:Join the list.png|150px|link=http://lists.owasp.org/mailman/listinfo/owasp-belgium]]
 +
| [[Image:Follow-us-on-twitter.png|175px|link=https://twitter.com/owasp_be]]
 +
| [[Image:Linkedin-button.gif|135px|link=https://www.linkedin.com/groups/37865]]
 +
|}
 +
</center>
 +
If you want to be invited for the next OWASP Belgium Chapter meetings, please [http://eepurl.com/iFZtb drop us your contact info].
  
===WHEN===
+
== Structural Sponsors 2019 ==
Monday 8th of May 2006, 18h30 - 22h30.
 
  
===WHERE===
+
OWASP Belgium thanks its structural chapter supporters for 2019 and the OWASP BeNeLux Days 2018:
Deloitte sponsored the venue, drinks and snacks.<br>
 
  
===PROGRAM===
+
<!-- Gold -->
* 18h00 - 18h30: Welcome, get drink & snack <BR>
+
[[File:Vest.jpg|250px|link=http://www.vest.nl]]
* 18h20 - 18h40: Sebastien Deleersnyder, Ascure <BR>
+
[[File:DavinsiLabs.png|250px|link=https://www.davinsilabs.com]]
  [http://www.owasp.org/index.php/Image:OWASP_Belgium_Chapter_Meeting_-_Brussels_-_8_May_2006_-_1_OWASP_Update.ppt OWASP Update]<BR>
 
  
* 18h45 - 19h15: Hillar Leoste, Zone-H<br>
+
<!-- Silver -->
  [http://www.owasp.org/index.php/Image:OWASP_Belgium_Chapter_Meeting_-_Brussels_-_8_May_2006_-_2_2005_Internet_Attack_Statistics_for_Belgium_v1_0.ppt Internet Attack Statistics for Belgium in 2005]<br>
+
[[File:LogoToreon.jpg|250px|link=https://www.toreon.com]]
 +
[[File:Nviso_logo_RGB_baseline_200px.png|250px|link=http://www.nviso.be]]
 +
&nbsp;[[File:LogoIngenicoGroup.png|250px|link=https://ingenico.be]]
  
* 19h15 - 20h30: Johan Peeters, Program Director secappdev.org <br>
+
If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]
  Can "Agile" Development Produce Secure Applications?<br>
 
  Received wisdom has it that secure development and agile processes do <br>
 
  not mix. Is that really so? Agile practices have proven in many <br> 
 
  projects to yield applications with fewer functional defects. Can they <br>
 
  also be put to work to reduce the number of security vulnerabilities?<br>
 
  The audience added to the discussion with questions and remarks!<br> 
 
  
== Chapter Meeting Archive ==
+
= Chapter Meetings =
  
===Meeting Notes OWASP Belgium Chapter Meeting (Leuven, 22-Feb-2006) ===
+
{{:Belgium_Events_2019}}
'''WHEN'''<br>
 
Wednesday 22nd of February 2006, 18h00 - 21h00.<br>
 
  
'''WHERE'''<br>
+
== Previous Years ==
KUL sponsored the venue:
 
Location: Auditorium N00.01, Celestijnenlaan 200A, Heverlee.
 
Itinerary to Dept Computer Science.
 
Detailed map of campus with building N.
 
BeeWare sponsored the Pizza and Drinks!<br>
 
  
'''PROGRAM'''<br>
+
Events held in
18h00 - 18h20: Welcome, get Pizza & Drink
+
[[Belgium Events 2018|2018]],
18h20 - 18h40: Sebastien Deleersnyder, Ascure
+
[[Belgium Events 2017|2017]],
OWASP (Membership) and new OWASP Projects
+
[[Belgium Events 2016|2016]],
18h40 - 19h30: Philippe Bogaerts, BeeWare
+
[[Belgium Events 2015|2015]],
WebScarab demonstration
+
[[Belgium Events 2014|2014]],
19h30 - 20h45: Web Application Firewalls (WAF): Panel Discussion
+
[[Belgium Events 2013|2013]],
First a WAF Primer was presented.
+
[[Belgium Events 2012|2012]],
Then we organized a panel discussion with people from industry, vendors and research:
+
[[Belgium Events 2011|2011]],
How mature are WAFs?
+
[[Belgium Events 2010|2010]],
What do WAFs protect you from? What not?
+
[[Belgium Events 2009|2009]],
Where do you position WAFs in your architecture?
+
[[Belgium Events 2008|2008]],
What WAF functionality do you really need?
+
[[Belgium Events 2007|2007]],
+
[[Belgium Events 2006|2006]],
A panel Discussion with: <br>
+
[[Belgium Events 2005|2005]].
<br>
 
* Philippe Bogaerts, BeeWare<br>
 
* Jaak Cuppens, F5 Networks<br>
 
* David Van der Linden, ING Belgium<br>
 
* Lieven Desmet, K.U.Leuven<br>
 
  
The audience (up to 50 !) added to the discussion with questions and remarks!<br><br>
+
= Belgium OWASP Chapter Leaders =
  
 +
The Belgium Chapter is supported by the following board:
  
===Belgium OWASP 2006 New Year Drink ===
+
Chapter Leaders
On January 19th we had a New Years Drink.<br>
+
*Sebastien Deleersnyder, Toreon
Presentation (TBD)
+
*Lieven Desmet, KU Leuven
 +
*Bart De Win, PWC
  
===Meeting Notes second OWASP Belgium Chapter meeting (Leuven, 28-Sep-2005)===
+
Board Members
On 28th of September 2005 we had our second OWASP Belgium Chapter meeting. We had nearly 50 people coming to the meeting!<br>
+
*Erwin Geirnaert, Zion Security
 +
*David Mathy, Freelance
 +
*Adolfo Solero, Freelance
 +
*Stella Dineva, Ingenico Payment Services
 +
*Thomas Herlea, NVISO
  
'''WHEN'''<br>
+
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.  
Wednesday 28th of September 2005, 18h00 - 21h00 at Ubizen in Leuven.<br>
+
__NOTOC__ <headertabs></headertabs>
 
+
[[Category:Europe]]
'''PROGRAM'''<br>
 
18h00 - 18h15: Welcome & get a drink <br>
 
 
 
18h15 - 18h45: Sebastien Deleersnyder, Ascure <br>
 
OWASP & OWASP Membership <br>
 
 
 
18h45 - 19h30: Emmanuel Bergmans, I-logs<br>
 
Securing Web Applications with ModSecurity<br>
 
Emmanuel gave an interesting introduction on ModSecurity.<br>
 
The presentation is included as attachment and contains a lot of great pointers and SWOT analysis.<br>
 
Conclusions were:<br>
 
ModSecurity can be particularly useful in an ISP environment<br>
 
Increased effort is necessary to synchronize multiple ModSecurity configurations in a Webfarm<br>
 
 
 
19h30 - 20h45: <br>
 
OWASP Top 10 Vulnerabilities: Panel Discussion<br>
 
OWASP Top 10: <br>
 
The presentation is included with an introduction of the TOP 10.<br>
 
Then we had a lively panel Discussion with: <br>
 
* Erwin Geirnaert, Security Innovation
 
* Dirk Dussart, Belgian Post
 
* Eric Devolder, Mastercard
 
* Herman Stevens, Ubizen
 
* Frank Piessens, KU Leuven
 
 
 
We handled questions about the Top 10:<br>
 
* Is the OWASP Top 10 still necessary?
 
* Are we talking vulnerabilities, solutions or threats?
 
* Can we base our best practices / standards on the Top 10?
 
* How to test your web site security on the Top 10?
 
*
 
 
 
The overall discussion was interesting, and at times diverted to an overall application security discussion. <br>
 
Some of the remarkable opinions covered:<br>
 
Can / or should the OWASP Top 10 form the basis for a certification scheme<br>
 
If it is used as an awareness tool, can we promote it with an OWASP magazine?<br>
 
The OWASP Top 10 is too vague<br>
 
A bigger exhaustive list is needed with a clear classification and taxonomy<br>
 
It should be based on threat modelling.<br>
 
One of the more pertinent questions: how did the original authors come to the Top 10?<br>
 
 
 
 
 
===Meeting Notes First OWASP Belgium Chapter Meeting (Gent, 26-May-2005)===
 
 
 
On 26th of May 2005 we held the first OWASP Belgium Chapter meeting!<br>
 
 
 
It was a big success: we had nearly 40 people attending, despite the Belgium-unlike hot weather.<br>
 
 
 
 
 
'''PROGRAM'''<br>
 
17h30 - 18h00: Welcome & get a drink<br>
 
 
 
18h00 - 18h45: Sebastien Deleersnyder, Ascure <br>
 
OWASP Introduction<br>
 
 
 
19h00 - 19h45: Erwin Geirnaert, Security Innovation<br>
 
How to Break Web Application Security<br>
 
 
 
20h00 - 20h45: professor Frank Piessens, KU Leuven<br>
 
How to Build Secure Web Applications<br>
 
 
 
You can download the presentations.<br>
 
We had some interesting discussions with Frank on the position of security controls: within the code or within the supporting infrastructure?<br>
 
Another idea is also to look for a top 10 solutions for Web Applications and have some guidance system when selecting countermeasures.<br>
 

Latest revision as of 18:57, 13 November 2019

OWASP Belgium

Welcome to the Belgium chapter homepage. The chapter leaders are Sebastien Deleersnyder, Lieven Desmet and Bart De Win


Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Sponsorship/Membership

Btn donate SM.gif to this chapter or become a local chapter supporter. Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? Join Now BlueIcon.JPG


Upcoming Chapter Meetings

See the Chapter Meetings tab for more details and older meetings.

Stay in Touch

Meetup-logo-2x.png Join the list.png Follow-us-on-twitter.png Linkedin-button.gif

If you want to be invited for the next OWASP Belgium Chapter meetings, please drop us your contact info.

Structural Sponsors 2019

OWASP Belgium thanks its structural chapter supporters for 2019 and the OWASP BeNeLux Days 2018:

Vest.jpg DavinsiLabs.png

LogoToreon.jpg Nviso logo RGB baseline 200px.png  LogoIngenicoGroup.png

If you want to support our chapter, please contact Seba Deleersnyder

25 November 2019 Meeting

Where

  • Address:
Park Inn by Radisson Leuven
Martelarenlaan 36
3010  Leuven

Agenda

Program

Recent evolutions in the OAuth 2.0 and OpenID Connect landscape

Abstract

Ever since the introduction of OAuth 2.0, the framework has been in continuous evolution. The initial specification addressed a strong need for delegation. However, since then, various addendums focus on the needs of modern applications. Today, the suite of OAuth 2.0 specifications supports a broad spectrum of different scenarios. For each of these scenarios makes their security assumptions and defines a set of best practices.

In this talk, we will investigate a number of these recent additions. We look at the recently added “Proof of Key for Code Exchange” (PKCE) flow. We also investigate how it is becoming the default flow for Single Page Applications. We also extensively dive into “Proof of Possession” tokens. Their security properties are significantly better than bearer tokens. Consequentially, everyone should know what they entail, and how to use them. You will walk away with a solid overview of recent evolutions in OAuth 2.0, and where to use them in your applications.

Speaker Bio

Philippe De Ryck helps developers protect companies through better web security. As the founder of Pragmatic Web Security, he travels the world to train developers on web security and security engineering. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. Google recognizes Philippe as a Google Developer Expert for his work on security in Angular applications.

Detection and Prevention of DNS abuse in .eu TLD

Abstract

This session reports on an extensive analysis of 14 months of domain registration in the .eu TLD. In particular, we investigate domain names that are registered for malicious purposes (such as spam, phishing, botnets C&C, ...). The goal of our research is to understand and identify large-scale malicious campaigns, and to early detect and prevent malicious registrations.

We explore the ecosystem and modus operandi of elaborate cyber criminal entities that recurrently register large amounts of domains for one-shot, malicious use. We further report on insights in the operational aspects of this business and observe, for instance, that their processes are only partially automated.

Finally, we present our automatic prediction system, that classifies at registration time whether a domain name will be used maliciously or benign. As such, malicious domain registrations can effectively be prevented from doing any harm. As part of the talk, we discuss the first results of this prediction system, which currently runs in production at EURid, the registry of the .eu TLD.

Speaker Bio

Lieven Desmet is a Senior Research Manager on Secure Software in the imec-DistriNet Research Group at the Katholieke Universiteit Leuven (Belgium), where he outlines and implements the research strategy, coaches junior researchers in web and infrastructure security, and participates in dissemination, valorisation and spin-off activities.

Registration

Registration is via EventBrite: https://owasp-belgium-2019-11-25.eventbrite.com.

Coverage

n/a

summit working session on OWASP SAMM

OWASP Belgium presents a summit working session on OWASP SAMM in Antwerp on 30 April:

Registration via https://www.eventbrite.com/e/open-security-summit-working-session-tickets-60456102831

20 February 2019 Meeting

Where

Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee

Agenda

  • 18h15 - 19h00: Welcome & sandwiches
  • 19h00 - 19h10: OWASP Update by Sebastien Deleersnyder (OWASP)
  • 19h10 - 20h00: ''CSP in the age of Script Gadgets by Prof. Martin Johns (TU Braunschweig)
  • 20h00 - 20h10: Break
  • 20h10 - 21h00: Zero to DevSecOps - security in a DevOps world (part 1, 2, 3) by Jimmy Mesta (CTO, Manicode Security)

Program

CSP in the age of Script Gadgets

  • Speaker: Prof. Martin Johns (TU Braunschweig)
  • Presentation: not yet available

Abstract

Content Security Policy (CSP) was first introduced in 2012. It should have been a silver-bullet defense against various injection attacks, including the rampant Cross-Site Scripting vulnerabilities. Unfortunately, modern development practices and legacy code bases proved to be substantial obstacles. New versions of CSP were released to address usability and compatibility for developers. Unfortunately, researchers discovered many bypasses and vulnerabilities in real-world CSP policies. The latest problem is known as script gadgets, where data is turned into code by legitimate functionality.

In this session, we will take a look at the problems you might encounter when deploying CSP. We start at CSP level 1 and work towards the latest level 3 version. We discuss CSP's features, potential bypasses, and pitfalls to avoid. In the end, you will have gained the knowledge to deploy a secure and effective CSP policy.

Speaker Bio

Martin Johns is a full professor at the TU Braunschweig.

Zero to DevSecOps - security in a DevOps world

  • Speaker: Jimmy Mesta (CTO, Manicode Security)
  • Presentation: not yet available

Abstract

The way that software is being deployed is undergoing a massive transformation. As a result, security teams are at a point where they must adapt or be left in the dust. Traditional application security used to be heavyweight and human-driven. Tasks are more often than not mostly manual efforts. Time-consuming security testing often breaks down in an automated world. Dynamic vulnerability scanning and manual code reviews are incompatible with a world where code changes are automatically being pushed to production hundreds of times per day.

This talk will share lessons learned from helping teams of all sizes and maturity levels with their transformation to a DevSecOps model where security goes from being a blocker to an enabler. Specifically, we will cover some of the tools and processes you can start using right now. These tools allow you to start adding real value to your organization through enhanced visibility, vulnerability discovery, and feedback loops. It is time to adapt and embrace a new era of security.

Speaker Bio

Jimmy Mesta is CTO at Manicode Security. He is a DevSecOps, Mobile, and Kubernetes Secure Coding Instructor.

Registration

Registration is via EventBrite: https://owasp-belgium-2019-02-20.eventbrite.com.

Coverage

n/a

Previous Years

Events held in 2018, 2017, 2016, 2015, 2014, 2013, 2012, 2011, 2010, 2009, 2008, 2007, 2006, 2005.

The Belgium Chapter is supported by the following board:

Chapter Leaders

  • Sebastien Deleersnyder, Toreon
  • Lieven Desmet, KU Leuven
  • Bart De Win, PWC

Board Members

  • Erwin Geirnaert, Zion Security
  • David Mathy, Freelance
  • Adolfo Solero, Freelance
  • Stella Dineva, Ingenico Payment Services
  • Thomas Herlea, NVISO

Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.