|
|
| Line 3: |
Line 3: |
| | == Local News == | | == Local News == |
| | | | |
| − | The next Belgium Chapter meeting is on November 20 in Leuven. This time it is organized together with ISSA Belgium. See the program below.
| + | We are working on the schedule for 2008 and preparing for the EU 08 AppSec conference in Brussels. Stay tuned! |
| | | | |
| − | We also set up a first Luxembourg chapter meeting on November 27 in Luxembourg. See the program below! | + | We also rescheduled the first Luxembourg chapter meeting to February 19 in Luxembourg. See the program below! |
| | | | |
| | == Chapter Board == | | == Chapter Board == |
| Line 11: |
Line 11: |
| | * Erwin Geirnaert, Zion Security | | * Erwin Geirnaert, Zion Security |
| | * Philippe Bogaerts, NetAppSec | | * Philippe Bogaerts, NetAppSec |
| − | * André Mariën, Cybertrust | + | * André Mariën, Inno.com |
| | * Lieven Desmet, K.U.Leuven | | * Lieven Desmet, K.U.Leuven |
| | * Joël Quinet, Unisys | | * Joël Quinet, Unisys |
| Line 17: |
Line 17: |
| | Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects. | | Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects. |
| | | | |
| − | == Structural Sponsors 2007 == | + | == Structural Sponsors 2008 == |
| | OWASP BeLux would like to thank the following organizations for sponsoring this chapter. If you are interested in sponsoring the BeLux chapter please contact seba 'at' deleersnyder.eu . | | OWASP BeLux would like to thank the following organizations for sponsoring this chapter. If you are interested in sponsoring the BeLux chapter please contact seba 'at' deleersnyder.eu . |
| | | | |
| | [http://www.f5.com https://www.owasp.org/images/7/7e/50px-F5_50px.jpg] | | [http://www.f5.com https://www.owasp.org/images/7/7e/50px-F5_50px.jpg] |
| | | | |
| − | == Next Event: Chapter Meeting (20-Nov-2007) in Leuven ==
| |
| − |
| |
| − | ===WHEN===
| |
| − | Tuesday, November 20th, 2007 (18pm-21pm)
| |
| − |
| |
| − | ===WHERE===
| |
| − |
| |
| − | Pizza and drinks are sponsored by [http://www.netappsec.be/ NetAppSec]
| |
| − |
| |
| − | [http://www.cs.kuleuven.be/~distrinet/ Katholieke Universiteit Leuven] sponsors the venue
| |
| − |
| |
| − | Location: Department of Computer Science (auditorium 00.225)
| |
| − | Celestijnenlaan 200 A, 3001 Heverlee
| |
| − |
| |
| − | Map: [http://googlemapsinterface.kuleuven.be/index.cgi?nbol=50.8640699237025,4.67808664523977&zoomlevel=14&plaatsnaam=Departement%20Computerwetenschappen,%20Celestijnenlaan%20200a,%203001%20Heverlee&detailplan=celestijnenlaan200&foto Detailed map] [http://www.cs.kuleuven.be/~lieven/owasp/celestijnenlaan200.png | Parking ]
| |
| − |
| |
| − | This time the OWASP chapter meeting is co-organized with ISSA Belgium (http://www.issa-be.org).
| |
| − |
| |
| − | ===PROGRAM===
| |
| − | The agenda looks as follows:
| |
| − |
| |
| − | * 18h00 - 18h30: Welcome, Pizza and drinks<BR>
| |
| − | * 18h30 - 18h45: Sebastien Deleersnyder, OWASP BeLux<BR>
| |
| − | '''OWASP Update'''<BR>
| |
| − | * 18h45 - 19h00: Tomas Vanhoof, ISSA<BR>
| |
| − | '''ISSA Intro'''<BR>
| |
| − | * 19h00 - 20h00: Patrick Debois<BR>
| |
| − | :'''Operational security impact on developing secure applications'''
| |
| − | :As an experienced programmer you are well experienced in applying the OWASP guidelines. At least we hope so ;-) Still we are ainly involved :within the creation of the application during a project phase. But good security management goes beyond that one phase, enter the operational security. Not having programming skills, these operationalunits over the years have created several security layers around the applications. Think firewalls, intrusion detection, prevention, antivirus systems... These server and network oriented security measures more and more influence application deployment and can also benefit from better application integration.
| |
| − | :This presentation will show you the impact of f.i. central logmanagement, patch management, identity & access management, loadbalancing, antivirus .. can have on the application deployment and how with little modification of our application it can make a whole world of difference to the security in the trenches. They will be complementary to the OWASP set of guidelines. Also developers will get a better understanding of an additional set of non-functional requirements that are security related.
| |
| − | :'''Patrick Debois''' has been an independent consultant for 15 years and is fascinated by the transition of a projects into operational mode. In order to better understand this interaction, he frequently changes his role from being a project manager, systems engineer, tester and developer.
| |
| − | :His two main technical point of interests are:
| |
| − | :* portal, cms, dms, search (f.i. brussels airport, eurocontrol,www.vrtnieuws.net)
| |
| − | :*identity/access management: (f.i. ministry of Finance, flemish government, telenet).
| |
| − | :Complementary to these technical skills, he stimulates the human factor within projects by using both coaching (NLP) and project manamagement skils(Lean, Scrum).In his latest assignment he is experimenting with Scrum and Coaching within an operational team.
| |
| − | * 20h00 - 20h15: break
| |
| − | * 20h15 - 21h15: Herman Stevens & Swa Frantzen, NET2S<BR>
| |
| − | :'''Security awareness programs for development'''
| |
| − | :Security awareness programs for developers are an effective tool to improve not just the security but can be used as a vehicle to improve efficiency in the development cycle just as well. This talk gives an overview of what the different roles in a development department need to know and introduces some key concepts in order to make such a program a success. Real examples from actual security awareness trainings will be given as well.
| |
| − | :'''Swa Frantzen''' first encountered the Internet in its very early days at the KULeuven as a system administrator at the Computer Science department. Ever since he developed an active interest in the security consequences of that network of networks. Swa served in different functions at different levels between engineering and management in the security service industry (Ubizen, Telindus, SANS, NET2S) and the telecommunications world (EUnet, Scarlet). Currently he is an independent security consultant. He is also one of the handlers at the SANS Internet Storm Center.
| |
| − | :'''Herman Stevens''' (CISA, CISSP) works in the information security field since nearly a decade. At Smals-MvM he developed applications regarding the Belgian social security system. He started at Ubizen as the security product trainer, and later was asked to become information security consultant. The bulk of his work became doing risk assessments, creating security policies, performing PCI audits and especially application security related work such as application security reviews, penetration testing, code review and training developers. Currently he works as a senior consultant at NET2S, where he focuses on security awareness training for development teams.
| |
| − |
| |
| − | === REGISTRATION ===
| |
| − | Please '''send a mail''' to belgium 'at' owasp.org if you plan to attend, so we can size the venue appropriately and keep you updated on last-minute changes.
| |
| | | | |
| | == First Luxembourg Chapter Meeting (19-Feb-2008) in Luxembourg! == | | == First Luxembourg Chapter Meeting (19-Feb-2008) in Luxembourg! == |
| Line 95: |
Line 51: |
| | === REGISTRATION === | | === REGISTRATION === |
| | Please '''send a mail''' to luxembourg 'at' owasp.org if you plan to attend, so we can size the venue appropriately and keep you updated on last-minute changes. | | Please '''send a mail''' to luxembourg 'at' owasp.org if you plan to attend, so we can size the venue appropriately and keep you updated on last-minute changes. |
| − |
| |
| − | == Previous Event: OWASP Day (6-Sep-2007)==
| |
| − | On September 6th, OWASP organized [[OWASP Day]] conferences worldwide triggered by the [http://www.globalsecurityweek.com/ Global Security Week] idea.
| |
| − |
| |
| − | In Belgium we organized the mini-conference in Brussels.
| |
| − |
| |
| − | Speakers:
| |
| − | * Mark Curphey, OWASP Founder, ([http://securitybuddha.com/about/ Marc's blog])
| |
| − | * [http://gnucitizen.org/about/pdp Petko D. Petkov], a.k.a pdp (architect), founder of the [http://gnucitizen.org GNUCITIZEN] group. Co-author of the “XSS Attacks” book.
| |
| − | * Bart De Win, postdoc researcher within the [http://www.cs.kuleuven.be/cwis/research/distrinet/public/index.php DistriNet research group], K.U.Leuven
| |
| − | * [http://gnucitizen.org/about/dk David Kierznowski], founder of [http://blogsecurity.net blogsecurity.net] and active member of the [http://gnucitizen.org GNUCITIZEN] group.
| |
| − | * Simon Roses Femerling, Security Technologist at [http://blogs.msdn.com/ace_team/ ACE Team] Microsoft
| |
| − | * Luc Beirens, [http://www.polfed-fedpol.be/crim/crim_fccu_nl.php FCCU]
| |
| − |
| |
| − | ===WHEN===
| |
| − | Thursday, September 6th, 2007 (2-7pm)
| |
| − |
| |
| − | ===WHERE===
| |
| − | [http://www.telindus.be Telindus, Belgacom ICT] sponsored the venue: <BR>
| |
| − | Location: SURF House, Rue Stroobants 51, 1140 Evere. <BR>
| |
| − | You can find a map and itinary [http://www.surfhouse.be/plan.pdf online]. <BR>
| |
| − |
| |
| − | ===PROGRAM===
| |
| − | The theme of the world-wide OWASP Day is “Privacy in the 21st Century”.
| |
| − |
| |
| − | The event started with an introductory session on WebGoat & WebScarab
| |
| − | at 12h30, the mini-conference itself at 14h.
| |
| − |
| |
| − | The agenda:
| |
| − |
| |
| − | * 12h30 pre-event: [[Belgium#Getting_started_with_WebGoat_.26_WebScarab_.28Erwin_Geirnaert.29|Getting started with WebGoat & WebScarab]] (Erwin Geirnaert)
| |
| − | * 14h00 Welcome & pre-recorded video of OWASP board (Sebastien Deleersnyder)
| |
| − | * 14h20 Key note:[[Belgium#OWASP_Evaluation_and_Certification_Criteria_Draft_.28Mark_Curphey.29|OWASP Evaluation and Certification Criteria Draft]] (Mark Curphey)
| |
| − | * 15h10 [[Belgium#Automated_Web_FOO_or_FUD.3F_.28David_Kierznowski.29|Automated Web FOO or FUD?]] (David Kierznowski)
| |
| − | * 16h00 [[Belgium#OWASP_Pantera_Unleashed_.28Simon_Roses_Femerling.29|OWASP Pantera Unleashed]] (Simon Roses Femerling)
| |
| − | * 16h40 Break
| |
| − | * 17h00 [[Belgium#CLASP.2C_SDL_and_Touchpoints_Compared_.28Bart_De_Win.29|CLASP, SDL and Touchpoints Compared]] (Bart De Win)
| |
| − | * 17h25 [[Belgium#Threats_of_e-insecurity_in_Belgium_and_the_Belgian_response_.28Luc_Beirens.2C_FCCU.29|Threats of e-insecurity in Belgium and the Belgian response]] (Luc Beirens - FCCU)
| |
| − | * 17h50 [[Belgium#For_my_next_trick..._hacking_Web2.0_.28pdp.29|For my next trick... hacking Web2.0]] (pdp)
| |
| − | * 18h40 Panel Discussion: “Privacy in the 21st Century?”, moderator: André Marien (Verizon Business - Cybertrust)
| |
| − | * 19h30 Finish - Drinks !
| |
| − |
| |
| − | ==== Getting started with WebGoat & WebScarab (Erwin Geirnaert) ====
| |
| − | Download [[:Image:OWASPDay2007Belgium_WebGoat-WebScarab.ppt|presentation]].
| |
| − |
| |
| − | In this tutorial you will learn how to use WebScarab to solve the lessons in WebGoat.
| |
| − |
| |
| − | Following points will be explained:
| |
| − | * Configure WebScarab as a local proxy
| |
| − | * Intercepte HTTP requests and responses
| |
| − | * Modify HTTP requests to solve the lesson “Hidden field manipulation”
| |
| − | * Modify HTTP responses to solve the lesson “Bypass client-side Javascript validation”
| |
| − | * Use the session analysis tab in WebScarab
| |
| − | * Use the web services tab in WebScarab
| |
| − | * Use WebScarab to analyze Ajax XML messages
| |
| − |
| |
| − | '''!! Prerequisites:'''
| |
| − | * Bring your own laptop with you!
| |
| − | * Download [[OWASP_WebScarab_Project#Download|WebScarab]] onto your laptop
| |
| − | * Download [[OWASP_WebGoat_Project#Download|WebGoat]] onto your laptop
| |
| − |
| |
| − |
| |
| − | Erwin Geirnaert is CEO and co-founder of [http://www.zionsecurity.com ZION Security]. He is a renowned application security expert and has presented on various conferences like Javapolis, Eurostar, Owasp,… about web security. He is board member of OWASP Belux and actively involved in various OWASP projects like OWASP Java and OWASP WebGoat. Because of his technical experience he loves to do security testing, code review, reverse engineering,.. for Fortune 1000 companies in Europe. More information can be found on his LinkedIn profile: http://www.linkedin.com/in/erwingeirnaert.
| |
| − |
| |
| − | ==== OWASP Evaluation and Certification Criteria Draft (Mark Curphey) ====
| |
| − | Download [[:Image:OWASP_Day_-_Belgium_-_Curphey.pdf|presentation]].
| |
| − |
| |
| − | As opposed to me continuing saying what’s wrong with PCI DSS, it seems to me that OWASP is a perfect forum to simply create and publish a “better criteria”. This can either be adopted and implemented by an organization like OWASP or considered to be incorporated into the PCI or other security standards. We won't get bogged down in the politics up-front, but hold something good up to the world for people to adopt. This project would of course draw on and bring together many of the other OWASP Projects including the Guide (What is a secure web app), Testing Guides (How to test for a secure web app), WebGoat (part of how to certify an individual understands and can find web app issues) etc. Many of those projects may not be complete or a perfect fit today, but this project can bring a common connecting theme to a lot of very valuable IP that OWASP has built over the years. I will also create it in such as way that a corporate could adopt/adapt it themseles as well as an industry. Where other OWASP projects are not complete or currently suitable I will build a requirements doc that can be considered by those teams if they feel appropriate.
| |
| − |
| |
| − | [http://securitybuddha.com/about/ Mark Curphey] ran Foundstone consulting from 2003 until late 2006 during which time the company was sold to McAfee. Before joining Foundstone Mark was the Director of Information Security at Charles Schwab (responsible for the software security program) and has also worked for ISS and several financial services companies in Europe. Mark has a Masters degree in information security from Royal Holloway, University of London and was the original founder of the Open Web Application Security Project (OWASP).
| |
| − |
| |
| − | ==== Automated Web FOO or FUD? (David Kierznowski) ====
| |
| − | Download [[:Image:OWASPDay2007-Belgium-dwk.ppt|presentation]].
| |
| − |
| |
| − | We take a look into automated web application testing technologies and their effectiveness against real life applications.
| |
| − |
| |
| − | Also, we look into one of GNUCITIZENs latest projects, The Technika Security Framework (TSF), which will enable users to automate security testing directly from their browser.
| |
| − |
| |
| − | [http://gnucitizen.org/about/dk David Kierznowski] currently works as a Senior Security Analyst for a leading penetration testing company in the UK. He has worked in the security industry for the past 6 years. David is also the founder of both [http://michaeldaw.org michaeldaw.org] and [http://blogsecurity.net blogsecurity.net] and is an active member of the [http://gnucitizen.org GNUCITIZEN] group.
| |
| − |
| |
| − | ==== OWASP Pantera Unleashed (Simon Roses Femerling) ====
| |
| − | Download [[:Image:OWASPDay2007Belgium_Pantera_Unleash.ppt|presentation]].
| |
| − |
| |
| − | The presentation will provide a glimpse into what Pantera can offer when performing blackbox web assessments. In the age of Web 2.0 we need powerful tools that provide us rich and accurate information and allows us to manipulate that information into our advantage, that's what Pantera is all about.
| |
| − |
| |
| − | Simon Roses Femerling is a Security Technologist at the [http://blogs.msdn.com/ace_team/ ACE Team] at Microsoft. Former PwC and @Stake. He has many years of security experience where he has authored and cooperated in several security Open Source projects and advisories. Simon is natural from wonderful Mallorca Island in the Mediterranean Sea. He holds a postgraduate in E-Commerce from Harvard University and a B.S. from Suffolk University at Boston, Massachusetts.
| |
| − |
| |
| − | ==== CLASP, SDL and Touchpoints Compared (Bart De Win) ====
| |
| − | Download [[:Image:OWASPDay2007Belgium_BartDeWin.ppt|presentation]].
| |
| − |
| |
| − | Over the years, specific methodologies and techniques for secure software
| |
| − | engineering have been proposed, yet dedicated processes have become available
| |
| − | only recently. In this presentation, the highlights of an activity-driven
| |
| − | comparison of three high-profile processes for the development of secure
| |
| − | software are presented.
| |
| − |
| |
| − | Bart De Win is a postdoctoral researcher in the research group DistriNet, Department of Computer Science at the Katholieke Universiteit Leuven. His research interests are in secure software engineering, including software development processes, aspect-oriented software development and model driven security.
| |
| − |
| |
| − | ==== Threats of e-insecurity in Belgium and the Belgian response (Luc Beirens, FCCU) ====
| |
| − | Download [[:Image:OWASP_Day_Belgium_FCCU_e-insecurity.pdf|presentation]].
| |
| − |
| |
| − | The presentation will give a short overview of the actual threats on the e-society in Belgium.
| |
| − | How are public and private sector organized (or not) to tacle the different problems ?
| |
| − | What are the tasks of the police within this framework ?
| |
| − |
| |
| − | Since 1991, chief superintendent Luc Beirens is engaged in computer forensics and cyber crime investigations. He is head of the Federal Computer Crime Unit of the Federal Police since 2001. Aside consulting his detectives in current cyber crime investigations, he is responsible for the reorganization, the equipment and the training of Belgian police services concerned with cyber crime investigations. As member of the European Working Party on Information Technology Crime (EWPITC) of Interpol since 1995 and the EUROPOL cyber crime expert group since 2001, he has cooperated in writing several documents concerning computer forensics and cyber crime investigations. He lectures in these fields at several police academies and universities.
| |
| − | His is involved in several organizations and platforms that are concerned with e-security, ICT forensics and cyber crime combating. Before his detective career, he has worked from 1987 till 1995 as analyst and project manager on the development of the Police Information System of the Belgian Gendarmerie. He holds master degrees in criminology and information technology.
| |
| − |
| |
| − | ==== For my next trick... hacking Web2.0 (pdp) ====
| |
| − | Download [[:Image:OWASP_Day_Belgium_2007-pdp.ppt|presentation]].
| |
| − |
| |
| − | Web2.0, if I can summarize it with a few simple words, is all about communication, distribution, information, agents, clients and servers. Those who understand the 2.0 fundamentals have the power to manipulate the global Web to suit their needs - hackers, the new digital breed of the 2.0 world. Web2.0 hacking is a mean for communicating and distributing critical information in a better way. It can be used to build ghost infrastructures from where to launch attacks - anonymously, no traces, nothing. Web2.0 hacking is also about the thin line between client-side and server-side security. It is about the endpoints and the electronic highways. It is about reaching the masses and yet being able to perform attacks on specific targets. Web2.0 hacking is also about distribution and influence, covert channels, bots, IA, ghosts inside the electronic frame. Web2.0 hacking is also a movement, a cyber subculture where individuals show their technical abilities, and understandings of the world and use that to manipulate their way through the system.
| |
| − |
| |
| − | Web2.0 hacking practices should never be related to AJAX and JavaScript exploitation techniques only. Although it is true that client-side security has a significant part of the Web2.0 ecosystem, it is important to realize its role. There are far too many other aspects that we need to look into. My aim is to cover these aspects and reveal the hidden dangers.
| |
| − |
| |
| − | [http://gnucitizen.org/about/pdp Petko D. Petkov], a.k.a pdp (architect), is the founder and leading contributer of the [http://gnucitizen.org GNUCITIZEN] group. He is a senior IT security consultant based in London, UK. His day-to-day work involves identifying vulnerabilities, building attack strategies and creating attack tools and penetration testing infrastructures. Petko is known in the underground circles as pdp or architect but his name is well known in the IT security industry for his strong technical background and creative thinking. He has been working for some of the world's top companies, providing consultancy on the latest security vulnerabilities and attack technologies.
| |
| − |
| |
| − | === REGISTRATION ===
| |
| − | Please '''send a mail''' to belgium 'at' owasp.org if you plan to attend, so we can size the venue appropriately and keep you updated on last-minute changes.
| |
| | | | |
| | == Past Events == | | == Past Events == |
We are working on the schedule for 2008 and preparing for the EU 08 AppSec conference in Brussels. Stay tuned!
We also rescheduled the first Luxembourg chapter meeting to February 19 in Luxembourg. See the program below!
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.
OWASP BeLux would like to thank the following organizations for sponsoring this chapter. If you are interested in sponsoring the BeLux chapter please contact seba 'at' deleersnyder.eu .
Location: Verizon Business Security Solutions Offices, 18 rue Robert Stümper - L2557 Luxembourg - Luxembourg.
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
