This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP NYC AppSec 2008 Conference"
| Line 82: | Line 82: | ||
[http://video.google.com/videoplay?docid=5266888637212683476 VIDEO] / SLIDES | [http://video.google.com/videoplay?docid=5266888637212683476 VIDEO] / SLIDES | ||
|- | |- | ||
| − | | style="width:10%; background:#7B8ABD" | 14:00-14:45 || style="width:30%; background:#BC857A" align="left" | Industry Outlook Panel: ''[http://www.linkedin.com/in/markclancy Mark Clancy] EVP CitiGroup, [http://www.linkedin.com/pub/0/497/86a Jim Routh] CISO DTCC, [http://www.linkedin.com/pub/0/bb1/68a Sunil Seshadri] CISO NYSE-Euronet, [http://www.linkedin.com/pub/0/1ba/4a9 Warren Axelrod] SVP Bank of America, [http://www.linkedin.com/in/bernik Joe Bernik] SVP, RBS,[http://www.linkedin.com/pub/8/878/240 Jennifer Bayuk] Infosec Consultant | + | | style="width:10%; background:#7B8ABD" | 14:00-14:45 || style="width:30%; background:#BC857A" align="left" | '''Industry Outlook Panel:'''<br> |
| − | | style="width:30%; background:#BCA57A" align=" | + | ''[http://www.linkedin.com/in/markclancy Mark Clancy] EVP CitiGroup, <br> |
| − | ''[http://www.linkedin.com/in/adamboulton Adam Boulton]'' | + | [http://www.linkedin.com/pub/0/497/86a Jim Routh] CISO DTCC, <br> |
| − | | style="width:30%; background:#99FF99" align=" | + | [http://www.linkedin.com/pub/0/bb1/68a Sunil Seshadri] CISO NYSE-Euronet, <br> |
| − | ''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Yiannis_Pavlosoglou | Yiannis Pavlosoglou]]'' | + | [http://www.linkedin.com/pub/0/1ba/4a9 Warren Axelrod] SVP Bank of America, <br> |
| + | [http://www.linkedin.com/in/bernik Joe Bernik] SVP, RBS,<br> | ||
| + | [http://www.linkedin.com/pub/8/878/240 Jennifer Bayuk] Infosec Consultant,<br> | ||
| + | [http://www.linkedin.com/in/philvenables Philip Venables] CISO, Goldman Sachs, <br> | ||
| + | [http://www.linkedin.com/in/crecalde Carlos Recalde] SVP, Lehman Brothers, <br> | ||
| + | [http://www.linkedin.com/pub/5/658/872 Tom King] CISO, Barclays Capital <br> | ||
| + | Moderator: [http://www.linkedin.com/in/mahidontamsetti Mahi Dontamsetti]'' | ||
| + | | style="width:30%; background:#BCA57A" align="center" | | ||
| + | '''[http://www.owasp.org/index.php/Security_Assessing_Java_RMI Security Assessing Java RMI] '''<br> | ||
| + | ''[http://www.linkedin.com/in/adamboulton Adam Boulton]''<br> | ||
| + | [http://video.google.com/videoplay?docid=4135644338377752676 VIDEO] / SLIDES | ||
| + | | style="width:30%; background:#99FF99" align="center" | | ||
| + | '''JBroFuzz 0.1 - 1.1: Building a Java Fuzzer for the Web'''<br> | ||
| + | ''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Yiannis_Pavlosoglou | Yiannis Pavlosoglou]]''<br> | ||
| + | [http://video.google.com/videoplay?docid=2546750478041391105 VIDEO] / SLIDES | ||
|- | |- | ||
| − | | style="width:10%; background:#7B8ABD" | 15:00-15:45 || style="width:30%; background:#BC857A" align=" | + | | style="width:10%; background:#7B8ABD" | 15:00-15:45 || style="width:30%; background:#BC857A" align="center" | |
| − | '' [[OWASP_NYC_AppSec_2008_Conference-daniel-cuthbert | Daniel Cuthbert]]'' | + | '''OWASP Testing Guide - Offensive Assessing Financial Applications'''<br> |
| − | | style="width:30%; background:#BCA57A" align=" | + | '' [[OWASP_NYC_AppSec_2008_Conference-daniel-cuthbert | Daniel Cuthbert]]''<br> |
| − | ''Ayal Yogev & Adi Sharabani'' | + | [ http://video.google.com/videoplay?docid=6800291421728032058 VIDEO] / SLIDES |
| − | | style="width:30%; background:#99FF99" align=" | + | | style="width:30%; background:#BCA57A" align="center" | |
| − | ''Andres Riancho'' | + | '''Flash Parameter Injection (FPI)'''<br> |
| + | ''Ayal Yogev & Adi Sharabani''<br> | ||
| + | [http://video.google.com/videoplay?docid=5602204870320084688 VIDEO] / SLIDES | ||
| + | | style="width:30%; background:#99FF99" align="center" | | ||
| + | '''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Andres_Riancho | w3af - A Framework to own the web]]'''<br> | ||
| + | ''Andres Riancho''<br> | ||
| + | [http://video.google.com/videoplay?docid=3120471281728221977 VIDEO] / VIDEO | ||
|- | |- | ||
| − | | style="width:10%; background:#7B8ABD" | 16:00-16:45 || style="width:30%; background:#BC857A" align=" | + | | style="width:10%; background:#7B8ABD" | 16:00-16:45 || style="width:30%; background:#BC857A" align="center" | |
| − | '' [http://www.aspectsecurity.com/management.htm Jeff Williams]'' | + | '''OWASP Enterprise Security API [[ESAPI | (ESAPI) Project]]'''<br> |
| − | | style="width:30%; background:#BCA57A" align=" | + | '' [http://www.aspectsecurity.com/management.htm Jeff Williams]''<br> |
| − | ''Alexios Fakos'' | + | [http://video.google.com/videoplay?docid=1573692246177088241 VIDEO] / SLIDES |
| − | | style="width:30%; background:#99FF99" align=" | + | | style="width:30%; background:#BCA57A" align="center" | |
| − | ''[http://www.linkedin.com/pub/0/a91/aa2 Vijay Akasapu] & [http://www.linkedin.com/pub/9/279/381 Marshall Heilman]'' | + | '''Cross-Site Scripting Filter Evasion'''<br> |
| + | ''Alexios Fakos''<br> | ||
| + | [http://video.google.com/videoplay?docid=-7011871449560433816 VIDEO] / SLIDES | ||
| + | | style="width:30%; background:#99FF99" align="center" | | ||
| + | '''Case Studies: Exploiting application testing tool deficiencies via "out of band" injection'''<br> | ||
| + | ''[http://www.linkedin.com/pub/0/a91/aa2 Vijay Akasapu] & [http://www.linkedin.com/pub/9/279/381 Marshall Heilman]''<br> | ||
| + | [http://video.google.com/videoplay?docid=-4177461397511303899 VIDEO] / SLIDES | ||
|- | |- | ||
| style="width:10%; background:#7B8ABD" | 17:00-17:45 || style="width:30%; background:#BC857A" align="left" | Threading the Needle: | | style="width:10%; background:#7B8ABD" | 17:00-17:45 || style="width:30%; background:#BC857A" align="left" | Threading the Needle: | ||
Revision as of 17:41, 15 October 2008
2008 OWASP USA, NYC
Last Update: 10/15/2008
Our mission is to make application security "visible," so that people and organizations can make informed decisions about application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work. OWASP is like "public radio" so support our efforts join today as a corporate or individual member learn more CLICK HERE
CLICK HERE FOR VIDEOS - CLICK HERE FOR PHOTOS
2008 OWASP USA, NYC Conference Schedule – Sept 24th - Sept 25th VIDEOS
Day 1 – Sept 24th, 2008 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| Track 1: BALLROOM | Track 2: SKYLINE | Track 3: TIMESQUARE | |||||||
| 07:30-08:50 | Doors Open for Attendee/Speaker Registration
avoid lines come early get your caffeine fix and use free wifi | ||||||||
| 09:00-09:45 | OWASP Version 3.0 who we are, how we got here and where we are going?
| ||||||||
| 10:00-10:45 | Analysis of the Web Hacking Incidents Database (WHID) Ofer Shezaf |
DHS Software Assurance Initiatives | |||||||
| 11:00-11:45 |
Http Bot Research |
OWASP "Google Hacking" Project |
MalSpam Research | ||||||
| 12:00-13:00 | Capture the Flag Sign-Up
LUNCH - Provided by event sponsors @ TechExpo | ||||||||
| 12:00-12:45 |
Get Rich or Die Trying - Making Money on The Web, The Black Hat Way |
Framework-level Threat Analysis: Adding Science to the Art of Source-code review |
Automated Web-based Malware Behavioral Analysis | ||||||
| 13:00-13:45 |
New 0-Day Browser Exploits: Clickjacking - yea, this is bad... |
Web Intrusion Detection with ModSecurity |
Using Layer 8 and OWASP to Secure Web Applications | ||||||
| 14:00-14:45 | Industry Outlook Panel: Mark Clancy EVP CitiGroup, |
Security Assessing Java RMI |
JBroFuzz 0.1 - 1.1: Building a Java Fuzzer for the Web | ||||||
| 15:00-15:45 |
OWASP Testing Guide - Offensive Assessing Financial Applications |
Flash Parameter Injection (FPI) |
w3af - A Framework to own the web | ||||||
| 16:00-16:45 |
OWASP Enterprise Security API (ESAPI) Project |
Cross-Site Scripting Filter Evasion |
Case Studies: Exploiting application testing tool deficiencies via "out of band" injection | ||||||
| 17:00-17:45 | Threading the Needle:
Bypassing web application/service security controls using Encoding, Transcoding, Filter Evasion, and other Canonicalization Attacks Arian Evans |
Mastering PCI Section 6.6 | Multidisciplinary Bank Attacks
Gunter Ollmann | ||||||
| 18:00-18:45 | OWASP Live CD | Coding Secure w/PHP | Payment Card Data Security and the new Enterprise Java | ||||||
| 19:00-20:00 | OWASP Chapter Leader / Project Leader working session OWSAP Board/Chapter Leaders | (ISC)2 Cocktail Hour all welcome to attend for special announcement presented by: W. Hord Tipton, Executive Director of (ISC)2 |
Technology Movie Night Sneakers, WarGames, HackersArePeopleToo, TigerTeam from 19:00 - 23:00 | ||||||
| 20:00-23:00+ | OWASP Event Party/Reception Event badge required for admission Food, Drinks w/ New & Old Friends - break out the laptop and play capture the flag for fun and prizes. Location: HOTEL BALLROOM
| ||||||||
Day 2 – Sept 25th, 2008 | |||||||||
| 08:00-10:00 | BREAKFAST - Provided by event sponsors @ TechExpo | ||||||||
| 08:00-08:45 | Software Development: The Last Security Frontier
W. Hord Tipton, CISSP-ISSEP, CAP, CISA, CNSS and former Chief Information Officer for the U.S. Department of the Interior Executive Director and member of the Board of Directors, (ISC)² |
Best Practices Guide: Web Application Firewalls
Alexander Meisel |
The Good The Bad and The Ugly - Pen Testing VS. Source Code Analysis | ||||||
| 09:00-09:45 | OWASP Web Services Top Ten | Tiger Team - APPSEC Projects | OpenSource Tools Prof. Li-Chiou Chen & Chienitng Lin, Pace Univ | ||||||
| 10:00-10:45 | Building a tool for Security consultants: A story of a customized source code scanner
Dinis Cruz |
"Help Wanted" 7 Things You Need to Know APPSEC/INFOSEC Employment | Industry Analyst with Forrester Research | ||||||
| 11:00-11:45 |
Pravir Chandra |
Security in Agile Development | Secure Software Impact | ||||||
| 12:00-12:45 | Next Generation Cross Site Scripting Worms | Security of Software-as-a-Service (SaaS) | Open Reverse Benchmarking Project
Marce Luck & Tom Stracener | ||||||
| 12:00-13:00 | Capture the Flag Status
LUNCH - Provided @ TechExpo | ||||||||
| 13:00-13:45 | NIST SAMATE Static Analysis Tool Exposition (SATE) | Lotus Notes/Domino Web Application Security | Shootout @ Blackbox Corral
Larry Suto | ||||||
| 14:00-14:45 | Practical Advanced Threat Modeling
John Steven |
The OWASP Orizon Project: towards version 1.0 Paolo Perego | Building Usable Security | ||||||
| 15:00-15:45 | Off-shoring Application Development? Security is Still Your Problem
Rohyt Belani |
OWASP EU Summit Portugal
Dinis Cruz |
Code Secrets | ||||||
| 16:00-16:45 | Vulnerabilities in application interpreters and runtimes
Erik Cabetas |
Detecting User Disposition - Polar Bears in a Whiteout Robert "RSnake" Hansen | Corruption Dave Aitel | ||||||
| 17:00-17:45 | Event Wrap-Up / Speaker & CTF Awards and Sponsor Raffles | ||||||||
| 18:30-19:30 | OWASP Foundation, Chapter Leader Meeting - to collect ideas to make OWASP better! | ||||||||
