This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP New Zealand Day 2012"

From OWASP
Jump to: navigation, search
(Removed "potential" topics from intro page.)
Line 241: Line 241:
 
</center>
 
</center>
 
 
 +
= Speakers List=
 +
==Speakers List==
 +
 +
===Adam Bell - in2securITy - How do I get into Security? I'm a webdev! (An introduction to in2securITy)===
 +
----
 +
<b>Abstract</b>
 +
 +
A brief introduction to in2securITy, it's aims and goals.  A particular focus on the availability of mentoring, peers and the secure development stream.
 +
 +
 +
 +
===Andrew Kelly - Comply or Die Trying===
 +
----
 +
<b>Abstract</b>
 +
 +
We all have to comply with something: Laws or bylaws - regulations or recommendations - industry standards or industry best-practice. This OWASP talk will focus on the 'real-world' application of security policy and compliance in IT and business. How policy and compliance can actually be very useful when it comes to securing your job, your company - and your company's future. Both from an IT - and a business/commercial prospective. And - along the way - some common myths, misconceptions and downright misunderstandings around policy and compliance may well be busted. Come and listen to a guy who actually thinks compliance and policy ... are fun!
 +
 +
<b>Speaker Bio</b>
 +
 +
Andrew brings 27 years IT experience to OWASP - 24 of them in IT Security - and 13 of those spent in the UK and Europe (okay ... Belgium).
 +
Now despite starting out as a mainframe uber-tech - Andrew's recognised today as being a 'pragmatic' subject-matter expert on corporate information security policy, compliance and governance. Andrew created his first BS 7799-compliant security policy - for a credit card
 +
provider - in Cardiff back in 1999. Since then he's done much the same for the a number of security consultancies (NZ and UK),
 +
Fonterra, Transpower and Telecom (NZ) - and BT, Deutsche Bank, Lloyds/TSB Bank and Legal & General Assurance (UK) - amongst many others.
 +
 +
 +
 +
===Andy Prow and Sam Pickles - Aura and F5 - Web Application Firewalls - Going where no WAFs have gone before...===
 +
----
 +
<b>Abstract</b>
 +
 +
So we all know that WAFs (web application firewalls) are not the silver bullet they're often sold as. Many of us in the pen-testing space completely discount their value as dumb signature based systems that are bypassed with a flurry of keystrokes and encoding. BUT WAFs are getting MUCH smarter, and you may be really interested to see what a really intelligent WAF can do today. Ever thought a WAF could stop attacks against business logic flaws and broken authorisation?
 +
 +
<b>Speaker Bio</b>
 +
 +
Andy Prow is an IT Security Consultant, Trainer and software developer who founded Aura back in 2001. With 18 years in the IT industry Andy has developed code for IBM, Vodafone, Telecom and Microsoft. Andy presents around the world at conferences including Microsoft's TechEd
 +
 +
Sam Pickles is a senior engineer and security specialist with F5 Networks. During over twelve years of security industry experience, Sam has designed and built IT security systems; and conducted network, application and hardware penetration testing in many countries. Sam studied Physics at the University of Otago, and Computer Science at the University of Oxford; and has presented at events including ISIG, First Tuesday, OWASP and AusCERT.
 +
 +
 +
 +
===Brett Moore - Insomnia Security - Increasing The Value of Penetration Testing===
 +
----
 +
<b>Abstract</b>
 +
 +
Penetration testing has become fairy accepted now as part of the requirements of any new project. Is it really part of a company's security practices, or is it just a tick in the box? This presentation will examine how effective this is for organisations and how it can best be used to increase the usefulness from this type of work.
 +
 +
* What is, and what isn't penetration testing
 +
* How cost effective is this method as a security measure?
 +
* How should it fit into the software development lifecycle of any application or network?
 +
* what you should look for in a company doing this work
 +
* what part of the work can you do yourselves 
 +
 +
<b>Speaker Bio</b>
 +
 +
Having conducted vulnerability assessments, network reviews, and penetration tests for the majority of the large companies in New Zealand, Insomnia founder Brett Moore brings with him over ten years experience in information security. During this time, Brett has also worked with companies such as SUN Microsystems, Skype Limited and Microsoft Corporation by reporting and helping to fix security vulnerabilities in their products. Brett has released numerous whitepapers and technical postings related to security issues and has spoken at security conferences both locally and overseas, including BlackHat, Defcon, Syscan, Kiwicon, Ruxcon, and the invitation only Microsoft internal security conference called BlueHat.
 +
 +
 +
 +
===Dean Carter and Shahn Harris - Lateral Security - An (Unofficial) OWASP Top 10 for Managers===
 +
----
 +
<b>Abstract</b>
 +
 +
The OWASP Top 10 Web Application Security Risks has done a fantastic job
 +
at a technical level.
 +
 +
Dean and Shahn have decided to turn their attention to the layer above
 +
and create a Top 10 for Managers.
 +
 +
10 things to assist Managers in ensuring that their web application
 +
projects are delivered in a secure, measurable, repeatable manner.
 +
 +
Oh… and they don’t cost a lot….
 +
 +
 +
 +
=== Denis Andzakovic - Security-Assessment.com - The Dos and Don'ts of Web Application Frameworks ===
 +
----
 +
<b>Abstract</b>
 +
 +
"Don't roll your own" has been common advice over the past decade;
 +
however even when heeding these words, insecure practices and common
 +
mistakes lead to glaring security holes. This talk will cover some of
 +
the common errors made when implementing applcations based around web
 +
frameworks, where to look for vulnerabilities and how to avoid them.
 +
 +
<b>Speaker Bio</b>
 +
 +
Denis is a Security Consultant for Security-Assessment.com, a security
 +
consultancy based in Auckland, Wellington, and Singapore.
 +
 +
 +
 +
===Francois Marier - Mozilla - Defeating Cross-Site Scripting with Content Security Policy===
 +
----
 +
<b>Abstract</b>
 +
 +
Cross-site scripting vulnerabilities are very common in web applications. They have been in the OWASP top 10 for a while and are routinely used by attackers.
 +
 +
There are simple guidelines that one can follow to prevent XSS bugs and most of the web frameworks out there offer some level of protection but at the end of the day, it's easy to make a mistake.
 +
 +
Content Security Policy adds another layer to a website's defenses: browser-enforced restrictions against external resources or unauthorized scripting. An extra response header instructs browsers to enforce a policy set by the server administrator.
 +
 +
 +
 +
===Kirk Jackson - Xero -  Going Down to the Wire===
 +
----
 +
<b>Abstract</b>
 +
 +
You've built the flashiest web app your cow-orkers have ever seen.
 +
Your boss loves you, and nominates you for a promotion next financial
 +
year. You've leveraged the latest hip web framework, and have jaxed
 +
your ajax to the max.
 +
 +
But have you done everything you can to make your application secure?
 +
Are you perhaps, in fact, doing a little _too much_?
 +
 +
A common issue I've come across in the past few years is applications
 +
that share too much information over the wire, or trust too much of
 +
what they receive. In this talk I'll look at some common pitfalls and
 +
techniques to counter them in modern web applications.
 +
 +
Let's go down to the wire.
 +
 +
 +
 +
===Laura Bell - Lateral Security - Blindsided by Security - The Reality of Web Security for the Visually Impaired===
 +
----
 +
<b>Abstract</b>
 +
Digital self-defence is now seen as a valuable life skill. As web developers we try to design systems that can protect as well as provide for our clients. As security consultants, we develop guidelines and frameworks that people can use to decide if a web application is trustworthy and secure. Even the least technical home users are becoming more confident in spotting suspicious behaviour online. Unfortunately, for the visually impaired, it’s not that simple. In a world where visual clues are not enough and where additional technologies such as screen readers are business as usual – web security is a very different matter.
 +
 +
Lateral Security and The Royal New Zealand Foundation for the Blind will examine the guidance and security best practice commonly in use for web applications today and how effective they are for those with visual impairments. In a talk that mixes real world examples, demonstrations and discussion from both a usability and security perspective, we aim to not only outline the issues but also suggest some solutions.
 +
 +
 +
 +
===Nick von Dadelszen - Lateral Security - Mobile NFC 101===
 +
----
 +
<b>Abstract</b>
 +
 +
This talk is designed to provide a detailed understanding of NFC on mobile phones and security considerations associated with the technology.
 +
 +
The participants should leave the presentation with an understanding of the technology behind NFC on mobile phones and how it interacts. They should obtain an understanding of the security considerations for NFC on Mobile and how it differs from standard NFC implementations.
 +
 +
The agenda for the talk will be the following:
 +
- Introduce the audience to NFC
 +
- Discuss the current state of NFC on mobile phones
 +
- Analyse the technology involved and how this is used to develop NFC applications
 +
- Discuss the security considerations of NFC on mobile devices
 +
 +
 +
 +
===Quintin Russ - SiteHost - Internet Junk===
 +
----
 +
<b>Abstract</b>
 +
 +
Junk, we all have it. Some have more, a lot more ... Whether you have accepted your Trademe addiction or are still in denial we all have a problem. Just like Space we are filling up the Internet with junk. What happens to our websites when we are finished with them? How are they closed? Are they ever closed? This talk will look at what sort of junk is left behind and how this can be used to attack your organisation. We will cover the issues with real world examples and time allowing, discuss simple steps to help overcome your Trademe addiction should you have one.
 +
 +
<b>Speaker Bio</b>
 +
 +
Quintin has carved out his own niche in the .nz hosting industry, having spent a large proportion of the last few years becoming an expert in both building and defending systems. He now runs enough infrastructure to ensure he never, ever gets a good night's sleep, and sometimes doesn't even get to snooze through Sunday mornings. Quintin has a keen interest in security, especially as it relates to web hosting. This has ranged from the vicissitudes of shared hosting to code reviews of popular blogging applications. He has previously presented at ISIG, OWASP & Kiwicon.
 +
  
  

Revision as of 05:21, 30 July 2012

OWASP New Zealand Day 2012
30th and 31st August 2012 - Auckland

Owaspnz2012logo.png

Introduction

We are proud to announce the fourth annual OWASP New Zealand Day conference, to be held at the University of Auckland on Friday August 31st, 2012. OWASP New Zealand Day is a one-day conference dedicated to web application security, with an emphasis on secure development techniques to help Kiwi developers build more secure applications.

Based on feedback from last year, the structure of the conference will be slightly different this time.

  • We will be offering training on the day before the conference (Thursday August 30th) rather than at the same time as the conference.
  • After lunch on the conference day, we will split to two tracks - one focused on deep technical topics, the other on policy, compliance and risk management.

The fourth OWASP New Zealand Day will be happening thanks to the support provided by the University of Auckland School of Business, which will kindly offer the same conference venue of the last three years. Entry to the event will, as in the past, be free.

For any comments, feedback or observations, please don't hesitate to contact us.

Registration

As with last year, registration will be performed through the RegOnline system. Registrations will be limited to 300 people, so please register using the following link soon to reserve your spot!

Register here! - https://www.regonline.com/owaspnzday2012


Important dates

  • CFP & CFT closes: 22nd July 2012 [ CLOSED ]
  • Conference Agenda due: 30th July 2012
  • Conference Registration deadline: 20th August 2012
  • Training Registration deadline: 20th August 2012
  • Training Day date: 30th August 2012
  • Conference Day date: 31st August 2012


Conference Venue

The University of Auckland Business School
Owen G Glenn Building
Room: OGGB 260-073 (OGGB4)
Address: 12 Grafton Road
Auckland
New Zealand
Map

Auckland business school small2.jpg Room hall.jpg


Conference Sponsors

University_of_Auckland_crest_small.png
Nz_information_security_forum.png
ICT and Department of Information Systems and Operations Management
  


Gold Sponsors:

SA_Logo_w_DD.gif
      
www.security-assessment.com
      


Silver Sponsors:

INSOMNIA.PNG
      
www.insomniasec.com
      
Lateral_security.jpeg
      
www.lateralsecurity.com
      


Conference Committee

  • Nick Freeman - OWASP New Zealand Leader (Auckland)
  • Adrian Hayes - OWASP New Zealand Leader (Wellington)
  • Lech Janczewski - Associate Professor - University of Auckland School of Business

Please direct all enquiries to nick.freeman@owasp.org and adrian.hayes@owasp.org.


Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_New_Zealand_Day_2012&oldid=133642"