This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Boston"
(→Next Meeting ''' Tuesday March 10 ''') |
(→Next Meeting ---- Tuesday March 10) |
||
| Line 49: | Line 49: | ||
== Next Meeting ---- ''' Tuesday March 10 ''' == | == Next Meeting ---- ''' Tuesday March 10 ''' == | ||
| − | |||
| − | '''Web Application Analysis | + | '''Web Application Source Code Threat Analysis; Pen Test Tools, from Security Compass''' |
| + | '''Tool demo - ''' | ||
| − | ''' | + | '''Exploit-Me Series – Free Firefox Application Penetration Testing Suite''' |
| − | |||
| − | Sahba Kazerooni is a security consultant with a strong background in J2EE software architecture and development. At Security Compass he harvests his unique blend of development and security knowledge in threat modeling, runtime security assessment, and source code review of client applications while at the same time leveraging his field experience to deliver Security Compass' one-of-a-kind training curriculum to organizations around the world. Mr. Kazerooni is an expert in application security assessments, having performed threat analysis, penetration testing, and source code review on numerous client applications. Sahba also plays a critical role in the developing and delivering the curriculum of Security Compass training services. He has developed and taught courses on various topics such as Exploiting and Defending Web Applications, Application Security Awareness, and Secure Coding in J2EE | + | The Exploit-Me series of tools are plug-ins to Firefox that allow for easy "right-click" style parameter fuzzing for web applications. The toolset is made specifically for security consultants, developers and QA staff to facilitate testing of applications. Sahba Kazerooni of Security Compass will demonstrate the use of the XSS-Me and SQL Inject Me tools. |
| + | |||
| + | |||
| + | '''Main Presentation''' | ||
| + | |||
| + | '''Framework-Level Threat Analysis - Adding science to the art of source code review''' | ||
| + | |||
| + | A traditional Threat Model is an effective tool for determining the threats that pose a risk to the architectural components of an application. But what if we wish to enumerate the threats that face the developmental components? Framework-Level Threat Analysis is a systemic approach to code review that speaks to the development staff by examining the underlying object model of an application. | ||
| + | |||
| + | |||
| + | In Framework-Level Threat Analysis, you are reviewing the application’s source code and breaking it down to it’s various components (servlet container, servlets, controller, delegate, command/business object, DAO, etc…), very similar to how you break down an app into its various architectural components in a standard TM. You then analyze a good number of use cases and model the way that data moves between the various components. The next step is to analyze each of the components in the path (can be as detailed as reviewing class by class) and document which security controls are happening where in the call flow. Once you’ve done that, it becomes visually apparent which security controls are missing in each use case. | ||
| + | |||
| + | |||
| + | Sahba Kazerooni is a security consultant with a strong background in J2EE software architecture and development. At Security Compass he harvests his unique blend of development and security knowledge in threat modeling, runtime security assessment, and source code review of client applications while at the same time leveraging his field experience to deliver Security Compass' one-of-a-kind training curriculum to organizations around the world. Mr. Kazerooni is an expert in application security assessments, having performed threat analysis, penetration testing, and source code review on numerous client applications. Sahba also plays a critical role in the developing and delivering the curriculum of Security Compass training services. He has developed and taught courses on various topics such as Exploiting and Defending Web Applications, Application Security Awareness, and Secure Coding in J2EE. He has presented at conferences around the world, including the Black Hat Security Conference in Amsterdam. He delivers Java secure coding training at the SANS Institute and has provided numerous presentations through ISC2 to their elite network of certified information security professionals. | ||
== Past Meeting Notes == | == Past Meeting Notes == | ||
Revision as of 13:34, 9 March 2009
Welcome to the OWASP Boston Chapter
<paypal>Boston</paypal>
To find out more about the Boston chapter, just join the OWASP Boston mailing list.
We meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm.
Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.
Information and an RSS feed for meeting updates about this and other Boston area user groups can be found at Boston User Groups.
Location
The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month ( Unless a speaker can only present another night), 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA.
From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C.
Boston OWASP Board
President
Jim Weiler 781 356 0067
Program Committee
Mark Arnold
Jim Weiler 781 356 0067
Local Chapter Information
The chapter shipping/mailing address is:
OWASP Boston 35 Wachusett Dr Lexington, MA. 02421
Reviews
Next Meeting ---- Tuesday March 10
Web Application Source Code Threat Analysis; Pen Test Tools, from Security Compass
Tool demo -
Exploit-Me Series – Free Firefox Application Penetration Testing Suite
The Exploit-Me series of tools are plug-ins to Firefox that allow for easy "right-click" style parameter fuzzing for web applications. The toolset is made specifically for security consultants, developers and QA staff to facilitate testing of applications. Sahba Kazerooni of Security Compass will demonstrate the use of the XSS-Me and SQL Inject Me tools.
Main Presentation
Framework-Level Threat Analysis - Adding science to the art of source code review
A traditional Threat Model is an effective tool for determining the threats that pose a risk to the architectural components of an application. But what if we wish to enumerate the threats that face the developmental components? Framework-Level Threat Analysis is a systemic approach to code review that speaks to the development staff by examining the underlying object model of an application.
In Framework-Level Threat Analysis, you are reviewing the application’s source code and breaking it down to it’s various components (servlet container, servlets, controller, delegate, command/business object, DAO, etc…), very similar to how you break down an app into its various architectural components in a standard TM. You then analyze a good number of use cases and model the way that data moves between the various components. The next step is to analyze each of the components in the path (can be as detailed as reviewing class by class) and document which security controls are happening where in the call flow. Once you’ve done that, it becomes visually apparent which security controls are missing in each use case.
Sahba Kazerooni is a security consultant with a strong background in J2EE software architecture and development. At Security Compass he harvests his unique blend of development and security knowledge in threat modeling, runtime security assessment, and source code review of client applications while at the same time leveraging his field experience to deliver Security Compass' one-of-a-kind training curriculum to organizations around the world. Mr. Kazerooni is an expert in application security assessments, having performed threat analysis, penetration testing, and source code review on numerous client applications. Sahba also plays a critical role in the developing and delivering the curriculum of Security Compass training services. He has developed and taught courses on various topics such as Exploiting and Defending Web Applications, Application Security Awareness, and Secure Coding in J2EE. He has presented at conferences around the world, including the Black Hat Security Conference in Amsterdam. He delivers Java secure coding training at the SANS Institute and has provided numerous presentations through ISC2 to their elite network of certified information security professionals.
Past Meeting Notes
Feb 2005
Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.
March 2005
Joe Stagner: Microsoft Let's talk about Application Security
April 2005
Jonathan Levin - Of Random Numbers
Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security
May 2005
Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom
June 2005
Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools
July 2005
Mark O'Neill, CTO: Vordel - Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security
September 2005
Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security
October 2005
Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges
Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways
November 2005
Robert Hurlbut, Independent Consultant Threat Modeling for web applications
December 2005
Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled
January 2006
David Low, Senior Field Engineer: RSA Practical Encryption
February 2006
Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source
March 2006
Mateo Meucci; OWASP Italy Anatomy of 2 web attacks
Tom Stracener; Cenzic Web Application Vulnerabilities
April 2006
Dennis Hurst; SPI Dynamics: A study of AJAX Hacking
Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!
May 2006
June 2006
Imperva - Application and Database Vulnerabilities and Intrusion Prevention
Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool
September 2006
Mike Gavin, Forrester Research: Web Application Firewalls
November 2006
January 2007
Dave Low, RSA the Security Division of EMC: encryption case studies
March 2007
Jeremiah Grossman, CTO Whitehat Security: Top 10 Web Application Hacks of 2006
June 2007
Tool Talk - Jim Weiler - WebGoat and Crosssite Request Forgeries
Danny Allan; Director, Security Research, Watchfire
Topic: Exploitation of the OWASP Top 10: Attacks and Strategies
September 2007
Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century"
October 2007
George Johnson, Principal Software Engineer EMC; CISSP
An Introduction to Threat Modeling.
Jim Weiler CISSP
Web Application Security and PCI compliance.
November 2007
Tom Mulvehill Ounce Labs
Description – Tom will share his knowledge and expertise on implementing security into the software development life cycle. This presentation will cover how to bring practicality into secure software development. Several integration models will be explored as well as solutions for potential obstacles
December 2007
Scott Matsumoto; Principal Consultant, Cigital
Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security
March 2008
Chris Eng; Senior Director, Security Research, Veracode
Description – Attacking crypto in web applications
June 2008
Main Speaker - Jeremiah Grossman; Founder and CTO, Whitehat Security
Appetizer - Hacking Intranets from the Outside (Just when you thought your network was safe) Port scanning with JavaScript
Main Topic - Business Logic Flaws: How they put your Websites at Risk
December 2008
Main Speaker - Brian Holyfield, Gothem Digital Science
Tamper Proofing Web Applications http://www.gdssecurity.com/l/b/2008/12/04/
