This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Boston"
| Line 1: | Line 1: | ||
| − | {{Chapter Template|chaptername=Boston|extra=The chapter leader is [mailto:[email protected] Jim Weiler]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Boston|emailarchives=http://lists.owasp.org/pipermail/owasp-Boston}} | + | {{Chapter Template|chaptername=Boston|extra=The chapter leader is [mailto:[email protected] Jim Weiler]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-Boston|emailarchives=http://lists.owasp.org/pipermail/owasp-Boston}} |
| − | ==== Local News ==== | + | ==== Local News ==== |
| − | |||
| − | To find out more about the Boston chapter, just join the [http://lists.owasp.org/mailman/listinfo/owasp-boston OWASP Boston mailing list]. | + | <paypal>Boston</paypal> |
| + | |||
| + | To find out more about the Boston chapter, just join the [http://lists.owasp.org/mailman/listinfo/owasp-boston OWASP Boston mailing list]. | ||
== Boston Application Security Conference 2010 --- FREE == | == Boston Application Security Conference 2010 --- FREE == | ||
| − | [[ | + | [[2010 BASC Homepage|Boston Application Security Conference]] |
| + | |||
| + | [[2010 BASC Call For Papers|Boston Application Security Conference - Call For Papers]] | ||
| − | [ | + | [http://www.owasp.org/index.php/2010_BASC_Homepage Listing Of All Pages Related To The Boston Application Security Conference] |
| − | + | == Local Chapter Information --- Our Seventh Year == | |
| − | + | The chapter shipping/mailing address is: | |
| − | + | OWASP Boston 35 Wachusett Dr Lexington, MA. 02421 | |
| − | + | == Reviews == | |
| − | |||
| − | |||
| − | + | [http://www.owasp.org/index.php/Reviews_of_security_podcasts Reviews of security podcasts] | |
| − | + | ==== Chapter Meetings ==== | |
| − | + | We usually meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm. | |
| − | We usually meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm. | ||
| − | Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the [http://lists.owasp.org/mailman/listinfo/owasp-boston OWASP Boston mailing list]. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers. | + | Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the [http://lists.owasp.org/mailman/listinfo/owasp-boston OWASP Boston mailing list]. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers. |
| − | Information for meeting updates about this and other Boston area user groups can also be found at [http://bug.bostonusergroups.org/Lists/Groups%20Calendar/calendar.aspx BostonUserGroups]. | + | Information for meeting updates about this and other Boston area user groups can also be found at [http://bug.bostonusergroups.org/Lists/Groups%20Calendar/calendar.aspx BostonUserGroups]. |
| − | == Location == | + | == Location == |
| − | The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month (''' Unless a speaker can only present another night'''), 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA. | + | The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month ('''Unless a speaker can only present another night'''), 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA. |
| − | From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C. | + | From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C. |
== Upcoming Meetings == | == Upcoming Meetings == | ||
| Line 43: | Line 43: | ||
'''Thursday June 2''' | '''Thursday June 2''' | ||
| − | Location - '''Microsoft NERD''' - http://microsoftcambridge.com/About/Directions/tabid/89/Default.aspx | + | Location - '''Microsoft NERD''' - http://microsoftcambridge.com/About/Directions/tabid/89/Default.aspx |
| + | |||
| + | '''Topic - Bringing Sexy Back: Defensive Measures That Actually Work''' | ||
| − | + | Presenter - Paul Asadoorian, Founder & CEO, PaulDotCom Enterprises | |
| − | + | There is a plethora of information available on how to break into systems, steal information, and compromise users. As a penetration tester, I have performed testing on a regular basis that reveals severe security weaknesses in several organizations, and many of my peers have reported on the same. However, once you "own" the network and report on how you accomplished your goals, now what? Sure, we make defensive recommendations, but consistently it has been proven that security can be bypassed. Not enough focus is given to what works defensively. We have a lot of technology at our disposal: firewalls, intrusion detection, log correlation, but it provides little protection from today's threats and is often not implemented effectively. This talk will focus on taking an offensive look at defense. Applying techniques that are simple, yet break the mold of traditional defensive measures. We will explore setting up "traps" for attackers, slowing them down with simple scripts, using honeypots, planting bugs, and most importantly tying these methods to "enterprise security". This talk will also include real-world examples of the techniques in action from a live, heavily attacked site. Topics will include: | |
| − | |||
| − | |||
| − | Paul Asadoorian is currently the "Product Evangelist" for Tenable Network Security, where he showcases vulnerability scanning and management through blogs, podcasts and videos. Paul is also the founder of PaulDotCom, an organization centered around the award winning "PaulDotCom Security Weekly" podcast that brings listeners the latest in security news, vulnerabilities, research and interviews with the security industry's finest. Paul has a background in penetration testing, intrusion detection, and is the co-author of "WRT54G Ultimate Hacking", a book dedicated to hacking Linksys routers. | + | *Using wireless “attacks” on the attackers |
| + | *Implementing the Metasploit Decloak engine to find the attackers | ||
| + | *Setting traps to detect web application attacks | ||
| + | *Integrating results into your enterprise log management tool | ||
| + | |||
| + | The goal of this talk is to make defense “sexy”… | ||
| + | |||
| + | '''Presenter Bio''' | ||
| + | |||
| + | Paul Asadoorian is currently the "Product Evangelist" for Tenable Network Security, where he showcases vulnerability scanning and management through blogs, podcasts and videos. Paul is also the founder of PaulDotCom, an organization centered around the award winning "PaulDotCom Security Weekly" podcast that brings listeners the latest in security news, vulnerabilities, research and interviews with the security industry's finest. Paul has a background in penetration testing, intrusion detection, and is the co-author of "WRT54G Ultimate Hacking", a book dedicated to hacking Linksys routers. | ||
'''Thursday May 26''' | '''Thursday May 26''' | ||
| − | Location - Microsoft Waltham (201 Jones Rd., Sixth Floor Waltham, MA) | + | Location - Microsoft Waltham (201 Jones Rd., Sixth Floor Waltham, MA) |
| − | '''Topic - OWASP Top 10 issue #4 – Insecure Direct Object Reference''' | + | '''Topic - OWASP Top 10 issue #4 – Insecure Direct Object Reference''' |
| − | Presenter - Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels and President of OWASP Boston | + | Presenter - Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels and President of OWASP Boston |
| − | Jim Weiler will discuss threat models, risks and various remediations of issue #4 in the 2010 OWASP Top 10 – Insecure Direct Object References. | + | Jim Weiler will discuss threat models, risks and various remediations of issue #4 in the 2010 OWASP Top 10 – Insecure Direct Object References. |
| − | '''Topic - A Web-Application Architecture for Regulatory Compliant Cloud Computing''' | + | '''Topic - A Web-Application Architecture for Regulatory Compliant Cloud Computing''' |
| − | Presenter - Arshad Noor, StrongAuth | + | Presenter - Arshad Noor, StrongAuth |
| − | The emergence of cloud-computing as an alternative deployment strategy for IT systems presents many opportunities, yet challenges traditional notions of data-security. The fact that data-security regulations are developing teeth, leaves information technology professionals perplexed on how to take advantage of cloud-computing while proving compliance to regulations for protecting sensitive information. | + | The emergence of cloud-computing as an alternative deployment strategy for IT systems presents many opportunities, yet challenges traditional notions of data-security. The fact that data-security regulations are developing teeth, leaves information technology professionals perplexed on how to take advantage of cloud-computing while proving compliance to regulations for protecting sensitive information. |
| − | This presentation presents an architecture for building the next generation of web-applications. This architecture allows you to leverage emerging technologies such as cloud-computing, cloud-storage and enterprise key-management (EKM) to derive benefits such as lower costs, faster time-to-market and immense scalability with smaller investments - while proving compliance to PCI-DSS, HIPAA/HITECH and similar data-security regulations. | + | This presentation presents an architecture for building the next generation of web-applications. This architecture allows you to leverage emerging technologies such as cloud-computing, cloud-storage and enterprise key-management (EKM) to derive benefits such as lower costs, faster time-to-market and immense scalability with smaller investments - while proving compliance to PCI-DSS, HIPAA/HITECH and similar data-security regulations. |
| − | '''Presenter Bio''' | + | '''Presenter Bio''' |
| − | Arshad Noor is the CTO of StrongAuth, Inc, a Silicon Vally-based company that specializes in enterprise key management. He is the designer and lead-developer of StrongKey, the industry's first open-source Symmetric Key Management System, and the KeyAppliance - the industry's first appliance combining encryption, tokenization, key-management and a cryptographic hardware module at an unprecedented value. He has written many papers and spoken at many forums on the subject of encryption and key-management over the years. | + | Arshad Noor is the CTO of StrongAuth, Inc, a Silicon Vally-based company that specializes in enterprise key management. He is the designer and lead-developer of StrongKey, the industry's first open-source Symmetric Key Management System, and the KeyAppliance - the industry's first appliance combining encryption, tokenization, key-management and a cryptographic hardware module at an unprecedented value. He has written many papers and spoken at many forums on the subject of encryption and key-management over the years. |
''' CANCELLED ''' | ''' CANCELLED ''' | ||
| − | '''Topic – Secure Application design and Coding''' | + | '''Topic – Secure Application design and Coding''' -- CANCELLED |
| + | |||
| + | Presenter - Josh Abraham, Rapid 7 | ||
| − | + | '''Speaker Bio ''' | |
| − | + | == Past Meeting Notes == | |
| − | |||
'''April 2011''' | '''April 2011''' | ||
| − | |||
| + | Ed Adams Security Innovation -- the new OWASP Exams Project and the work being done by the OWASP Academies Working Group | ||
| + | |||
| + | <br> | ||
'''March 2011''' | '''March 2011''' | ||
| − | |||
| − | Owning the world, one mobile app at a time, and web services pen testing. | + | Josh Abraham, Rapid 7 |
| + | |||
| + | Owning the world, one mobile app at a time, and web services pen testing. | ||
| + | <br> | ||
'''Febrary 2011''' | '''Febrary 2011''' | ||
| + | |||
Rob Cheyne, CEO of Safelight Security - | Rob Cheyne, CEO of Safelight Security - | ||
| − | Security Leadership series: Delivering a successful security presentation | + | Security Leadership series: Delivering a successful security presentation |
| + | <br> | ||
'''December 2010''' | '''December 2010''' | ||
| − | |||
| − | + | Application Architecture Security Assessment - Second session | |
| + | Rob Cheyne, CEO SafeLight Security Advisors | ||
| + | |||
| + | <br> | ||
'''November 2010''' | '''November 2010''' | ||
| − | |||
| − | + | Open SAMM – Software Assurance Maturity Model | |
| + | Shakeel Tufail is the Federal Practice Manager at Fortify, an HP company. | ||
| + | |||
| + | <br> | ||
'''October 2010''' | '''October 2010''' | ||
| − | Rob Cheyne, CEO SafeLight Security Advisors | + | |
| − | Overview: | + | Rob Cheyne, CEO SafeLight Security Advisors Overview: In this highly interactive two-part workshop, Rob Cheyne of Safelight Security will show you the basics of conducting a real-world architecture & design review. This workshop draws from Safelight's Security Architecture Fundamentals training course, a two-day course frequently used to teach Fortune 500 companies how to look at their system architectures from both the hacker's and the designer’s point of view. |
| − | In this highly interactive two-part workshop, Rob Cheyne of Safelight Security will show you the basics of conducting a real-world architecture & design review. | ||
| − | This workshop draws from Safelight's Security Architecture Fundamentals training course, a two-day course frequently used to teach Fortune 500 companies how to look at their system architectures from both the hacker's and the designer’s point of view. | ||
'''July 2010''' | '''July 2010''' | ||
| − | |||
| − | |||
| − | Main Presentation - Drive-by Pharming with MonkeyFist | + | Lightning Talk – Rob Cheyne, CEO Safelight Security Advisors In this installment of the Safelight lightning talks series, Rob will present the basics of a Cross-site Request Forgery (CSRF). |
| + | |||
| + | Main Presentation - Drive-by Pharming with MonkeyFist | ||
| − | Joey Peloquin - | + | Joey Peloquin - Director of Application Security, Fishnet Security |
'''June 2010''' | '''June 2010''' | ||
| − | Rob Cheyne Lightning Talk - topic to be announced | + | Rob Cheyne Lightning Talk - topic to be announced |
| − | Main Presentation - Ryan Barnett | + | Main Presentation - Ryan Barnett The Web Hacking Incident Database (WHID) is a Web Application Security Consortium project dedicated to maintaining a list of web applications related security incidents. Ryan Barnett is director of application security research at Breach Security where he leads Breach Security Labs. |
| − | The Web Hacking Incident Database (WHID) is a Web Application Security Consortium project dedicated to maintaining a list of web applications related security incidents. | ||
| − | Ryan Barnett is director of application security research at Breach Security where he leads Breach Security Labs. | ||
'''May 2010''' | '''May 2010''' | ||
| − | Rob Cheyne Lightning Talk - SQL Injection | + | Rob Cheyne Lightning Talk - SQL Injection |
| − | Vinnie Liu - Data Exposure, New Approaches to Open Source Intelligence Techniques, and Incident Handling | + | Vinnie Liu - Data Exposure, New Approaches to Open Source Intelligence Techniques, and Incident Handling |
| + | <br> | ||
'''April 2010''' | '''April 2010''' | ||
| − | Dan Hestad | + | Dan Hestad Security Innovation Dan will be talking about his experiences with PCI and web applications, and answering questions about do's and don'ts of acceptable PCI practices in web applications. |
| − | Dan will be talking about his experiences with PCI and web applications, and answering questions about do's and don'ts of acceptable PCI practices in web applications. | ||
'''March 2010''' | '''March 2010''' | ||
| Line 150: | Line 166: | ||
Zack Lanier - Disclosure Samsara, or "the endless vulnerability disclosure debate" | Zack Lanier - Disclosure Samsara, or "the endless vulnerability disclosure debate" | ||
| − | http://n0where.org/talks/samsara_20100310.html | + | http://n0where.org/talks/samsara_20100310.html |
| − | |||
| − | |||
| + | http://n0where.org/talks/samsara_20100310.pdf (very large PDF) | ||
| + | <br> | ||
'''February 2010''' | '''February 2010''' | ||
| Line 160: | Line 176: | ||
Rob Cheyne of Safelight Security Advisors; New Technology, Same Old Vulnerabilities | Rob Cheyne of Safelight Security Advisors; New Technology, Same Old Vulnerabilities | ||
| + | <br> | ||
'''January 2010 at Microsoft NERD, Cambridge''' | '''January 2010 at Microsoft NERD, Cambridge''' | ||
| − | Josh Abraham, Rapid 7 Technologies | + | Josh Abraham, Rapid 7 Technologies |
'''December 2009''' | '''December 2009''' | ||
| − | Eric Bender, Cenzic | + | Eric Bender, Cenzic |
'''November 2009''' | '''November 2009''' | ||
| − | Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels - Web Application Vulnerability Scanners | + | Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels - Web Application Vulnerability Scanners |
Mush Hakhinian, Leader, Application Security Practice, IntraLinks - Secure coding with no money down using SONAR: unleashing the power of open-source code analysis tools | Mush Hakhinian, Leader, Application Security Practice, IntraLinks - Secure coding with no money down using SONAR: unleashing the power of open-source code analysis tools | ||
| + | <br> | ||
'''October 2009''' | '''October 2009''' | ||
| − | Paul Schofield, | + | Paul Schofield, Senior Security Engineer, Imperva - From Rivals to BFF: WAF & VA Unite |
| + | <br> | ||
'''September 2009 at CORE Technologies, Boston''' | '''September 2009 at CORE Technologies, Boston''' | ||
| − | Paul Asadoorian, Pauldotcom.com | + | Paul Asadoorian, Pauldotcom.com |
| − | Alex Horan, CORE Security | + | Alex Horan, CORE Security |
| + | <br> | ||
'''May 2009''' | '''May 2009''' | ||
| − | Joey Peloquin, Fishnet Security, Secure SDLC: The Good, the Bad and the Ugly | + | Joey Peloquin, Fishnet Security, Secure SDLC: The Good, the Bad and the Ugly [http://www.owasp.org/images/4/48/SecureSDLC-GoodBadUgly.pdf presentation pdf] |
| + | <br> | ||
'''March 2009''' | '''March 2009''' | ||
| − | Sabha Kazerooni, Security Compass - Exploit Me tools; Framework Level Threat Analysis | + | Sabha Kazerooni, Security Compass - Exploit Me tools; Framework Level Threat Analysis |
| − | [http://www.owasp.org/images/5/5a/Security_Compass_Exploilt_Me.pdf ExploitMe Document] | + | [http://www.owasp.org/images/5/5a/Security_Compass_Exploilt_Me.pdf ExploitMe Document] |
| − | [http://www.owasp.org/images/e/ef/Security_Compass_Framework-level_Threat_Analysis.pdf Framework Level Threat Analysis document] | + | [http://www.owasp.org/images/e/ef/Security_Compass_Framework-level_Threat_Analysis.pdf Framework Level Threat Analysis document] |
| − | Meeting Pizza Sponsor - Arcot | + | Meeting Pizza Sponsor - Arcot |
| − | Arcot is a leader in online fraud prevention, strong authentication and eDocument security. | + | Arcot is a leader in online fraud prevention, strong authentication and eDocument security. Arcot's solutions are easily deployed, low-cost and extremely scalable, allowing organizations to transparently protect their users from fraud without changing user behavior or requiring expensive hardware. |
Arcot can be contacted thru Michael Kreppein, [email protected], 617-467-5200 | Arcot can be contacted thru Michael Kreppein, [email protected], 617-467-5200 | ||
'''December 2008''' | '''December 2008''' | ||
| − | |||
| − | Tamper Proofing Web Applications | + | Brian Holyfield, Gothem Digital Science |
| + | |||
| + | Tamper Proofing Web Applications http://www.gdssecurity.com/l/b/2008/12/04/ | ||
'''June 2008''' | '''June 2008''' | ||
| + | |||
Jeremiah Grossman; Founder and CTO, Whitehat Security | Jeremiah Grossman; Founder and CTO, Whitehat Security | ||
Appetizer - Hacking Intranets from the Outside (Just when you thought your network was safe) Port scanning with JavaScript | Appetizer - Hacking Intranets from the Outside (Just when you thought your network was safe) Port scanning with JavaScript | ||
| − | Main Topic - Business Logic Flaws: How they put your Websites at Risk | + | Main Topic - Business Logic Flaws: How they put your Websites at Risk |
'''March 2008''' | '''March 2008''' | ||
| − | |||
| − | Description – Attacking crypto in web applications | + | Chris Eng; Senior Director, Security Research, Veracode |
| + | |||
| + | Description – Attacking crypto in web applications | ||
'''December 2007''' | '''December 2007''' | ||
| + | |||
Scott Matsumoto; Principal Consultant, Cigital | Scott Matsumoto; Principal Consultant, Cigital | ||
Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security | Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security | ||
| − | [https://www.owasp.org/images/5/5b/BostonOWASP200712-Cigital.pdf Cigital Presentation] | + | [https://www.owasp.org/images/5/5b/BostonOWASP200712-Cigital.pdf Cigital Presentation] |
'''November 2007''' | '''November 2007''' | ||
| + | |||
Tom Mulvehill Ounce Labs | Tom Mulvehill Ounce Labs | ||
| − | Description – Tom will share his knowledge and expertise on implementing security into the software | + | Description – Tom will share his knowledge and expertise on implementing security into the software development life cycle. This presentation will cover how to bring practicality into secure software development. Several integration models will be explored as well as solutions for potential obstacles |
| − | development life cycle. This presentation will cover how to bring practicality into secure software | ||
| − | development. Several integration models will be explored as well as solutions for potential obstacles | ||
| − | [https://www.owasp.org/images/f/f8/Ounce_OWASP_07NOV07ppt.zip Ounce presentation] | + | [https://www.owasp.org/images/f/f8/Ounce_OWASP_07NOV07ppt.zip Ounce presentation] |
| + | <br> | ||
'''October 2007''' | '''October 2007''' | ||
| − | George Johnson, Principal Software Engineer | + | George Johnson, Principal Software Engineer EMC; CISSP |
An Introduction to Threat Modeling. | An Introduction to Threat Modeling. | ||
| + | <br> | ||
'''September 2007''' | '''September 2007''' | ||
| − | Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century" | + | Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century" |
'''June 2007''' | '''June 2007''' | ||
| − | Tool Talk - Jim Weiler - | + | |
| + | Tool Talk - Jim Weiler - WebGoat and Crosssite Request Forgeries | ||
Danny Allan; Director, Security Research, Watchfire | Danny Allan; Director, Security Research, Watchfire | ||
| Line 260: | Line 287: | ||
'''March 2007''' | '''March 2007''' | ||
| − | |||
| + | Jeremiah Grossman, CTO Whitehat Security: Top 10 Web Application Hacks of 2006 | ||
| + | |||
| + | <br> | ||
'''January 2007''' | '''January 2007''' | ||
| − | |||
| + | Dave Low, RSA the Security Division of EMC: encryption case studies | ||
| + | |||
| + | <br> | ||
'''November 2006''' | '''November 2006''' | ||
| + | <br> | ||
'''September 2006''' | '''September 2006''' | ||
| − | |||
| + | Mike Gavin, Forrester Research: Web Application Firewalls | ||
| + | |||
| + | <br> | ||
'''June 2006''' | '''June 2006''' | ||
| − | Imperva - Application and Database Vulnerabilities and Intrusion Prevention | + | |
| + | Imperva - Application and Database Vulnerabilities and Intrusion Prevention | ||
Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool | Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool | ||
| + | <br> | ||
'''May 2006''' | '''May 2006''' | ||
| + | <br> | ||
'''April 2006''' | '''April 2006''' | ||
| − | Dennis Hurst; SPI Dynamics: A study of AJAX Hacking | + | Dennis Hurst; SPI Dynamics: A study of AJAX Hacking |
| − | Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. | + | Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints! |
| − | first meeting with all demos, no powerpoints! | ||
| + | <br> | ||
'''March 2006''' | '''March 2006''' | ||
| − | Mateo Meucci; OWASP Italy | + | Mateo Meucci; OWASP Italy [http://www.owasp.org/images/8/8c/Anatomy_of_2_Web_App_Testing.zip Anatomy of 2 web attacks] |
| − | [http://www.owasp.org/images/8/8c/Anatomy_of_2_Web_App_Testing.zip Anatomy of 2 web attacks] | ||
| − | Tom Stracener; Cenzic | + | Tom Stracener; Cenzic Web Application Vulnerabilities |
| − | Web Application Vulnerabilities | ||
| + | <br> | ||
'''February 2006''' | '''February 2006''' | ||
| − | Ron Ben Natan; Guardium CTO | + | Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source |
| − | Database Security: Protecting Identity Information at the Source | ||
| + | <br> | ||
'''January 2006''' | '''January 2006''' | ||
| − | David Low, Senior Field Engineer: RSA | + | David Low, Senior Field Engineer: RSA Practical Encryption |
| − | Practical Encryption | ||
| + | <br> | ||
'''December 2005''' | '''December 2005''' | ||
| − | Paul Galwas, Product Manager: nCipher | + | Paul Galwas, Product Manager: nCipher [http://www.owasp.org/docroot/owasp/misc/OWASP051207.ppt Enigma variations: Key Management controlled] |
| − | [http://www.owasp.org/docroot/owasp/misc/OWASP051207.ppt Enigma variations: Key Management controlled] | ||
| + | <br> | ||
'''November 2005''' | '''November 2005''' | ||
| − | Robert Hurlbut, Independent Consultant | + | Robert Hurlbut, Independent Consultant [http://www.owasp.org/docroot/owasp/misc/OWASP_Hurlbut_ThreatModelingforWebApplicaitons.zip Threat Modeling for web applications] |
| − | [http://www.owasp.org/docroot/owasp/misc/OWASP_Hurlbut_ThreatModelingforWebApplicaitons.zip Threat Modeling for web applications] | ||
| + | <br> | ||
'''October 2005''' | '''October 2005''' | ||
| − | Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp | + | Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - [http://www.owasp.org/docroot/owasp/misc/Federation-Introduction-Overview-01.ppt Identity Federation : Prospects and Challenges] |
| − | Chaiman of the OASIS Security Services (SAML) Technical Committee - | ||
| − | [http://www.owasp.org/docroot/owasp/misc/Federation-Introduction-Overview-01.ppt Identity Federation : Prospects and Challenges] | ||
| − | Ryan Shorter, Sr. System Engineer: Netcontinuum - | + | Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways |
| − | Application Security Gateways | ||
| + | <br> | ||
'''September 2005''' | '''September 2005''' | ||
| − | Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - | + | Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security |
| − | How to Break Software Security | ||
| + | <br> | ||
'''July 2005''' | '''July 2005''' | ||
| − | Mark O'Neill, CTO: Vordel - | + | Mark O'Neill, CTO: Vordel - [http://www.owasp.org/docroot/owasp/misc/MarkOneill.pdf Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security] |
| − | [http://www.owasp.org/docroot/owasp/misc/MarkOneill.pdf Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security] | ||
'''June 2005''' | '''June 2005''' | ||
| − | Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security | + | Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security [http://www.owasp.org/conferences/appsec2005dc/schedule.html Overview of Application Security Tools] |
| − | [http://www.owasp.org/conferences/appsec2005dc/schedule.html Overview of Application Security Tools] | ||
| + | <br> | ||
'''May 2005''' | '''May 2005''' | ||
| − | Patrick Hynds, CTO: Critical Sites - [http://www.owasp.org/docroot/owasp/misc/Passwords-Keys_to_the_Kingdom_Dev_V1.ppt Passwords - Keys to the Kingdom] | + | Patrick Hynds, CTO: Critical Sites - [http://www.owasp.org/docroot/owasp/misc/Passwords-Keys_to_the_Kingdom_Dev_V1.ppt Passwords - Keys to the Kingdom] |
| + | <br> | ||
'''April 2005''' | '''April 2005''' | ||
| − | Jonathan Levin - [http://www.owasp.org/docroot/owasp/misc/JLevinRandoms.pdf Of Random Numbers] | + | Jonathan Levin - [http://www.owasp.org/docroot/owasp/misc/JLevinRandoms.pdf Of Random Numbers] |
| − | Jothy Rosenberg, Founder and CTO: Service Integrity - [http://www.owasp.org/docroot/owasp/misc/JothyRWebSvcsSec.ppt Web Services Security] | + | Jothy Rosenberg, Founder and CTO: Service Integrity - [http://www.owasp.org/docroot/owasp/misc/JothyRWebSvcsSec.ppt Web Services Security] |
| + | <br> | ||
'''March 2005''' | '''March 2005''' | ||
| − | Joe Stagner: Microsoft | + | Joe Stagner: Microsoft Let's talk about Application Security |
| − | Let's talk about Application Security | ||
| + | <br> | ||
'''Feb 2005''' | '''Feb 2005''' | ||
| − | Application Security Inc. PowerPoint slides for the [http://www.owasp.org/docroot/owasp/misc/Anatomy+of+an+Attack.ppt Anatomy of a Database Attack.] | + | Application Security Inc. PowerPoint slides for the [http://www.owasp.org/docroot/owasp/misc/Anatomy+of+an+Attack.ppt Anatomy of a Database Attack.] |
| + | <br> | ||
| − | + | ==== Boston OWASP Chapter Leaders ==== | |
| − | ==== Boston OWASP Chapter Leaders ==== | ||
| − | |||
'''President''' | '''President''' | ||
| − | + | - [mailto:[email protected] Jim Weiler] 781 356 0067 | |
'''Program Committee''' | '''Program Committee''' | ||
| − | - Mark Arnold | + | - Mark Arnold |
'''Communications Director''' | '''Communications Director''' | ||
| − | - Yolanda Liu | + | - Yolanda Liu |
| − | |||
| + | <br> | ||
| − | __NOTOC__ | + | __NOTOC__ <headertabs /> |
| − | <headertabs/> | ||
| − | [[Category: | + | [[Category:Boston]] [[Category:OWASP_Chapter]] [[Category:Massachusetts]] |
| − | [[Category: | ||
| − | [[Category: | ||
Revision as of 20:40, 31 May 2011
OWASP Boston
Welcome to the Boston chapter homepage. The chapter leader is Jim Weiler
Participation
OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
Sponsorship/Membership
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
Local News
<paypal>Boston</paypal>
To find out more about the Boston chapter, just join the OWASP Boston mailing list.
Boston Application Security Conference 2010 --- FREE
Boston Application Security Conference
Boston Application Security Conference - Call For Papers
Listing Of All Pages Related To The Boston Application Security Conference
Local Chapter Information --- Our Seventh Year
The chapter shipping/mailing address is:
OWASP Boston 35 Wachusett Dr Lexington, MA. 02421
Reviews
Chapter Meetings
We usually meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm.
Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.
Information for meeting updates about this and other Boston area user groups can also be found at BostonUserGroups.
Location
The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month (Unless a speaker can only present another night), 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA.
From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C.
Upcoming Meetings
Thursday June 2
Location - Microsoft NERD - http://microsoftcambridge.com/About/Directions/tabid/89/Default.aspx
Topic - Bringing Sexy Back: Defensive Measures That Actually Work
Presenter - Paul Asadoorian, Founder & CEO, PaulDotCom Enterprises
There is a plethora of information available on how to break into systems, steal information, and compromise users. As a penetration tester, I have performed testing on a regular basis that reveals severe security weaknesses in several organizations, and many of my peers have reported on the same. However, once you "own" the network and report on how you accomplished your goals, now what? Sure, we make defensive recommendations, but consistently it has been proven that security can be bypassed. Not enough focus is given to what works defensively. We have a lot of technology at our disposal: firewalls, intrusion detection, log correlation, but it provides little protection from today's threats and is often not implemented effectively. This talk will focus on taking an offensive look at defense. Applying techniques that are simple, yet break the mold of traditional defensive measures. We will explore setting up "traps" for attackers, slowing them down with simple scripts, using honeypots, planting bugs, and most importantly tying these methods to "enterprise security". This talk will also include real-world examples of the techniques in action from a live, heavily attacked site. Topics will include:
- Using wireless “attacks” on the attackers
- Implementing the Metasploit Decloak engine to find the attackers
- Setting traps to detect web application attacks
- Integrating results into your enterprise log management tool
The goal of this talk is to make defense “sexy”…
Presenter Bio
Paul Asadoorian is currently the "Product Evangelist" for Tenable Network Security, where he showcases vulnerability scanning and management through blogs, podcasts and videos. Paul is also the founder of PaulDotCom, an organization centered around the award winning "PaulDotCom Security Weekly" podcast that brings listeners the latest in security news, vulnerabilities, research and interviews with the security industry's finest. Paul has a background in penetration testing, intrusion detection, and is the co-author of "WRT54G Ultimate Hacking", a book dedicated to hacking Linksys routers.
Thursday May 26
Location - Microsoft Waltham (201 Jones Rd., Sixth Floor Waltham, MA)
Topic - OWASP Top 10 issue #4 – Insecure Direct Object Reference
Presenter - Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels and President of OWASP Boston
Jim Weiler will discuss threat models, risks and various remediations of issue #4 in the 2010 OWASP Top 10 – Insecure Direct Object References.
Topic - A Web-Application Architecture for Regulatory Compliant Cloud Computing
Presenter - Arshad Noor, StrongAuth
The emergence of cloud-computing as an alternative deployment strategy for IT systems presents many opportunities, yet challenges traditional notions of data-security. The fact that data-security regulations are developing teeth, leaves information technology professionals perplexed on how to take advantage of cloud-computing while proving compliance to regulations for protecting sensitive information.
This presentation presents an architecture for building the next generation of web-applications. This architecture allows you to leverage emerging technologies such as cloud-computing, cloud-storage and enterprise key-management (EKM) to derive benefits such as lower costs, faster time-to-market and immense scalability with smaller investments - while proving compliance to PCI-DSS, HIPAA/HITECH and similar data-security regulations.
Presenter Bio
Arshad Noor is the CTO of StrongAuth, Inc, a Silicon Vally-based company that specializes in enterprise key management. He is the designer and lead-developer of StrongKey, the industry's first open-source Symmetric Key Management System, and the KeyAppliance - the industry's first appliance combining encryption, tokenization, key-management and a cryptographic hardware module at an unprecedented value. He has written many papers and spoken at many forums on the subject of encryption and key-management over the years.
CANCELLED
Topic – Secure Application design and Coding -- CANCELLED
Presenter - Josh Abraham, Rapid 7
Speaker Bio
Past Meeting Notes
April 2011
Ed Adams Security Innovation -- the new OWASP Exams Project and the work being done by the OWASP Academies Working Group
March 2011
Josh Abraham, Rapid 7
Owning the world, one mobile app at a time, and web services pen testing.
Febrary 2011
Rob Cheyne, CEO of Safelight Security -
Security Leadership series: Delivering a successful security presentation
December 2010
Application Architecture Security Assessment - Second session
Rob Cheyne, CEO SafeLight Security Advisors
November 2010
Open SAMM – Software Assurance Maturity Model
Shakeel Tufail is the Federal Practice Manager at Fortify, an HP company.
October 2010
Rob Cheyne, CEO SafeLight Security Advisors Overview: In this highly interactive two-part workshop, Rob Cheyne of Safelight Security will show you the basics of conducting a real-world architecture & design review. This workshop draws from Safelight's Security Architecture Fundamentals training course, a two-day course frequently used to teach Fortune 500 companies how to look at their system architectures from both the hacker's and the designer’s point of view.
July 2010
Lightning Talk – Rob Cheyne, CEO Safelight Security Advisors In this installment of the Safelight lightning talks series, Rob will present the basics of a Cross-site Request Forgery (CSRF).
Main Presentation - Drive-by Pharming with MonkeyFist
Joey Peloquin - Director of Application Security, Fishnet Security
June 2010
Rob Cheyne Lightning Talk - topic to be announced
Main Presentation - Ryan Barnett The Web Hacking Incident Database (WHID) is a Web Application Security Consortium project dedicated to maintaining a list of web applications related security incidents. Ryan Barnett is director of application security research at Breach Security where he leads Breach Security Labs.
May 2010
Rob Cheyne Lightning Talk - SQL Injection
Vinnie Liu - Data Exposure, New Approaches to Open Source Intelligence Techniques, and Incident Handling
April 2010
Dan Hestad Security Innovation Dan will be talking about his experiences with PCI and web applications, and answering questions about do's and don'ts of acceptable PCI practices in web applications.
March 2010
Zack Lanier - Disclosure Samsara, or "the endless vulnerability disclosure debate"
http://n0where.org/talks/samsara_20100310.html
http://n0where.org/talks/samsara_20100310.pdf (very large PDF)
February 2010
Rob Cheyne of Safelight Security Advisors; New Technology, Same Old Vulnerabilities
January 2010 at Microsoft NERD, Cambridge
Josh Abraham, Rapid 7 Technologies
December 2009
Eric Bender, Cenzic
November 2009
Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels - Web Application Vulnerability Scanners
Mush Hakhinian, Leader, Application Security Practice, IntraLinks - Secure coding with no money down using SONAR: unleashing the power of open-source code analysis tools
October 2009
Paul Schofield, Senior Security Engineer, Imperva - From Rivals to BFF: WAF & VA Unite
September 2009 at CORE Technologies, Boston
Paul Asadoorian, Pauldotcom.com
Alex Horan, CORE Security
May 2009
Joey Peloquin, Fishnet Security, Secure SDLC: The Good, the Bad and the Ugly presentation pdf
March 2009
Sabha Kazerooni, Security Compass - Exploit Me tools; Framework Level Threat Analysis
Framework Level Threat Analysis document
Meeting Pizza Sponsor - Arcot
Arcot is a leader in online fraud prevention, strong authentication and eDocument security. Arcot's solutions are easily deployed, low-cost and extremely scalable, allowing organizations to transparently protect their users from fraud without changing user behavior or requiring expensive hardware.
Arcot can be contacted thru Michael Kreppein, [email protected], 617-467-5200
December 2008
Brian Holyfield, Gothem Digital Science
Tamper Proofing Web Applications http://www.gdssecurity.com/l/b/2008/12/04/
June 2008
Jeremiah Grossman; Founder and CTO, Whitehat Security
Appetizer - Hacking Intranets from the Outside (Just when you thought your network was safe) Port scanning with JavaScript
Main Topic - Business Logic Flaws: How they put your Websites at Risk
March 2008
Chris Eng; Senior Director, Security Research, Veracode
Description – Attacking crypto in web applications
December 2007
Scott Matsumoto; Principal Consultant, Cigital
Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security
November 2007
Tom Mulvehill Ounce Labs
Description – Tom will share his knowledge and expertise on implementing security into the software development life cycle. This presentation will cover how to bring practicality into secure software development. Several integration models will be explored as well as solutions for potential obstacles
October 2007
George Johnson, Principal Software Engineer EMC; CISSP
An Introduction to Threat Modeling.
September 2007
Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century"
June 2007
Tool Talk - Jim Weiler - WebGoat and Crosssite Request Forgeries
Danny Allan; Director, Security Research, Watchfire
Topic: Exploitation of the OWASP Top 10: Attacks and Strategies
March 2007
Jeremiah Grossman, CTO Whitehat Security: Top 10 Web Application Hacks of 2006
January 2007
Dave Low, RSA the Security Division of EMC: encryption case studies
November 2006
September 2006
Mike Gavin, Forrester Research: Web Application Firewalls
June 2006
Imperva - Application and Database Vulnerabilities and Intrusion Prevention
Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool
May 2006
April 2006
Dennis Hurst; SPI Dynamics: A study of AJAX Hacking
Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!
March 2006
Mateo Meucci; OWASP Italy Anatomy of 2 web attacks
Tom Stracener; Cenzic Web Application Vulnerabilities
February 2006
Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source
January 2006
David Low, Senior Field Engineer: RSA Practical Encryption
December 2005
Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled
November 2005
Robert Hurlbut, Independent Consultant Threat Modeling for web applications
October 2005
Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges
Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways
September 2005
Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security
July 2005
Mark O'Neill, CTO: Vordel - Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security
June 2005
Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools
May 2005
Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom
April 2005
Jonathan Levin - Of Random Numbers
Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security
March 2005
Joe Stagner: Microsoft Let's talk about Application Security
Feb 2005
Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.
Boston OWASP Chapter Leaders
President
- Jim Weiler 781 356 0067
Program Committee
- Mark Arnold
Communications Director
- Yolanda Liu
