This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Boston"

From OWASP
Jump to: navigation, search
(Next Meeting)
(Next Meeting)
Line 21: Line 21:
 
== Next Meeting ==
 
== Next Meeting ==
  
Next Meeting - March 7, 2007
+
Next Meeting - Wednesday, April 4, 2007
  
 
Tool Talk - TBD
 
Tool Talk - TBD
  
Speaker - Jeremiah Grossman, Founder and CTO, WhiteHat Security
+
Speaker - Mark O'Neill, Chief Technical Officer at Vordel
  
 +
"Case Notes from a Vulnerability Assessment performed on a financial services Web Services application "
  
Top 10 Hacks of 2006 and What They Bode for 2007
+
This presentation describes a real-life vulnerability assessment that was conducted on the Web Services applications of a financial services corporation. The vulnerabilities which were discovered are explained, and countermeasures are proposed. Testing strategies are described.  The Vordel SOAPbox tool was used as a launch-pad for the attacks used in this vulnerability assessment.  All customer information has been anonymized.
  
Jeremiah Grossman will:
+
Mark O'Neill is Chief Technical Officer at Vordel, a leading Web Services Security vendor. Mark is the author of the book “Web Services Security”, published by McGraw-Hill/Osborne Media. A frequent conference speaker on Web Services Security, Mark also provides training on secure Web Services to governments (including US Government agencies), insurance companies, and telecoms companies worldwide.
  
Reveal the top 10 attacks of 2006 by creativity and scope
 
Predict what these attacks mean for website vulnerability management in 2007
 
Present strategies to protect your corporate websites
 
Mr. Grossman is a world-renowned expert in Web security and a founding member of the Web Application Security Consortium. He is a frequent speaker at industry events including RSA, the BlackHat Briefings, CSI NetSec, ISACA's Network Security Conference, NASA, ISSA and Defcon.
 
  
 
+
Pizza provided by TBD
 
 
Pizza provided by WhiteHat Security
 
 
'''
 
'''
  

Revision as of 11:08, 21 March 2007

Welcome to the OWASP Boston Chapter

To find out more about the Boston chapter, please send an email to Jim Weiler or just join the OWASP Boston mailing list.

We meet the FIRST WEDNESDAY of EVERY MONTH, 6:30 to 9 pm.

Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.

Information and an RSS feed for meeting updates about this and other Boston area user groups can be found at Boston User Groups.

Location

The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month, 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA.

From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C.

Reviews

Reviews of security podcasts

Next Meeting

Next Meeting - Wednesday, April 4, 2007

Tool Talk - TBD

Speaker - Mark O'Neill, Chief Technical Officer at Vordel

"Case Notes from a Vulnerability Assessment performed on a financial services Web Services application "

This presentation describes a real-life vulnerability assessment that was conducted on the Web Services applications of a financial services corporation. The vulnerabilities which were discovered are explained, and countermeasures are proposed. Testing strategies are described. The Vordel SOAPbox tool was used as a launch-pad for the attacks used in this vulnerability assessment. All customer information has been anonymized.

Mark O'Neill is Chief Technical Officer at Vordel, a leading Web Services Security vendor. Mark is the author of the book “Web Services Security”, published by McGraw-Hill/Osborne Media. A frequent conference speaker on Web Services Security, Mark also provides training on secure Web Services to governments (including US Government agencies), insurance companies, and telecoms companies worldwide.


Pizza provided by TBD

Past Meeting Notes

Feb 2005

Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.


March 2005

Joe Stagner: Microsoft Let's talk about Application Security


April 2005

Jonathan Levin - Of Random Numbers

Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security


May 2005

Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom


June 2005

Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools


July 2005

Mark O'Neill, CTO: Vordel - Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security


September 2005

Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security


October 2005

Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges

Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways


November 2005

Robert Hurlbut, Independent Consultant Threat Modeling for web applications


December 2005

Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled


January 2006

David Low, Senior Field Engineer: RSA Practical Encryption


February 2006

Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source


March 2006

Mateo Meucci; OWASP Italy Anatomy of 2 web attacks

Tom Stracener; Cenzic Web Application Vulnerabilities


April 2006

Dennis Hurst; SPI Dynamics: A study of AJAX Hacking

Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!


May 2006


June 2006

Imperva - Application and Database Vulnerabilities and Intrusion Prevention

Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool