Difference between revisions of "Women In AppSec"

Women in AppSec

The OWASP Foundation, in recognition of value to both organizations and society, is working to support and enhance programs that increase the participation of women in the field of information and application security. The OWASP Foundation Women in AppSec Program provides merit-based funding for women to attend participating OWASP AppSec conferences. OWASP’s current program objective is to encourage female students at both the undergraduate and graduate levels, instructors, and professional working women who are dedicated to a career in information security and/or application development, to expand their skills and pursue application security. Interested applicants are encouraged to apply to the program running within their region of residence.

Current Program

The program us currently being re-launched for AppSec EU 2015
There is still work to be done - what can we do to Make it Happen?
During AppSec EU there will be a panel discussion and workshop supported by the Women in AppSec initiative. Through these sessions we hope to encourage women to pursue a career in AppSec and help them realize it is an option for them. These sessions will be open to all so we can help build support for the women around us.

Panel: "Women in AppSec - Making it Happen"

During this panel session we will discuss what can be done to Make it Happen for Women in AppSec going forward. What have those currently working in the field done to Make it Happen for themselves and other women; what tips and advice do they have to help you do to make a career for yourself or encourage those around you (sister, friend, daughter, etc…) to pursue a career in AppSec? What can we as professionals can do to help encourage girls to go for a career in AppSec?

Workshop

During the workshop we hope to introduce female attendees of the conference to what a career in App Sec can involve. We will teach them about application security and the many career paths available. We will be there to share our experiences and answer their questions to hopefully get them started on a career in AppSec. We hope to build relationships that may lead to a mentoring program for these women.

Past Eligibility Criteria

Below is the list of eligibility criteria used to select the winners in 2013.

• Has provided 2 responsive contacts as reference, and both references are familiar with the candidate, application security, and OWASP.
• Both references have provided letters of recommendation.
• Has relevant/appropriate achievement goals for attending the conference.
• Is the applicant from the region that the conference is taking place in.
• Has background in volunteering for OWASP or similar organizations.
• Has participated in one of OWASP's programs or activities?
• Is either studying, wishing to study, working in AppSec, or interested in working in AppSec.
• Has financial need.
• Is a paid OWASP member, and/or employer/school is an OWASP sponsor.
• Has an interest in exploring application security

We encourage you to create your own set of criteria that will fit the Women In AppSec that you are planning within your region. The criteria above is meant to be a guideline of what has been used in the past.

Winners

In the past, we have typically had two winners selected for the sponsorship award; however, the number of winners depends on how much you can afford to sponsor. We recommend that you raise $3000 USD for each winner, at least. In the past, we have given each winner a free conference pass, one free training, and free travel and accommodation to attend the event.

Pre-Conference

The majority of the planning involved in running the Women in AppSec Program occurs before the conference or regional event. Below, you will find a brief outline of the tasks your team will have to take on.

Planning & Selection Team

The first step you will need to take care of is the selection of your planning and selection team. These are the individuals that will be helping you manage the pre-event planning process and the selection of the sessions during the event. You will typically need a team of 5-6 people. The selection committee will then be broken down into several sub-teams of one to two people who will then work on sponsorship, marketing, the grading process, and the call for entries.

Sub-Team Roles

Sponsorship

Two people should be responsible for developing the materials and seeking out sponsorships for the program. They will be in charge of creating the sponsorship packages, flyers, and seeking out sponsorship from other chapters and organizations.

Marketing

At least two people should be responsible for marketing the event. Their job will consist of putting together press releases, keeping the event planners updated on progress, and communicating progress to the overall community. They will also be responsible for getting the message out when the team is ready to start accepting applicants.

Budget

As mentioned above, it is up to your team to decide what it is you wish to do during the event - that will determine the budget.

Sponsorship

It is very important to start reaching out to the overall OWASP community and their corporate contacts as potential sponsorship leads. Develop a Sponsorship Strategy and put together a sponsorship flyer outlining the program, what you are seeking, and the benefits of sponsorship. Give incentive for sponsorship and details about the program to get potential sponsors interested. Make sure to include the successes of past Women in AppSec conference events. Once you have your materials and sponsorship packages sorted, you can get started with sponsorship seeking activities. Below you will find an example of the Women in AppSec 2013 sponsorship flyer we sent out to potential sponsors.

Sample of 2013 Sponsorship Flyer

During the conference

Be sure the engage the women attending the conference in the sessions you have organized: encourage them to not only attend but to be active participants. It's not all about the women try and encourage some men to get involved and attend also, for this initiative to be successful it must be inclusive.

Post-Conference

After the conference, it is very important to gather feedback from the participants to make sure they enjoyed the experience. Ask them for a brief description about their experience, with a picture attached for the website. Then write up a review and lessons learned page to document the experience with the program. Make sure to include what can be improved upon in the future.

We want to be sure to engage the women there in the sessions organized, encourage them to not only attend but to be active participants. Its not all about the women so try and encourage some men to participate too, for this initiative to be successful it must be inclusive.

Panel: "Women in AppSec - Making it Happen"

During this panel session we will discuss what can be done to Make it Happen for Women in AppSec going forward. What have those currently working in the field done to Make it Happen for themselves and other women; what tips and advice do they have to help you do to make a career for yourself or encourage those around you (sister, friend, daughter, etc…) to pursue a career in AppSec? What can we as professionals can do to help encourage girls to go for a career in AppSec?

Workshop

During the workshop we hope to introduce female attendees of the conference to what a career in App Sec can involve. We will teach them about application security and the many career paths available. We will be there to share our experiences and answer their questions to hopefully get them started on a career in AppSec. We hope to build relationships that may lead to a mentoring program for these women.

Previous Women in AppSec Winners

Following their experience at AppSec, winners are encouraged to write a short piece about their experience at the conference and their participation in the Women in AppSec program. Here, they outline their experience with the Women in AppSec Program in their own words.

Carrie Schaper, 2013 Winner

"OWASP Appsec proved to be a great experience for me, uniting and interacting with friends, professionals, and colleagues from the Information Security space from across the US and Internationally whom were in attendance. The huge space and well organized functions such as the: trainings, expert talks, panels, bug-bounty, lock-picking village and social events all enhanced the conference experience. Participating on the Women in IT panel was a wonderful experience, as many women were in attendance and participated in collaborative discussions. OWASP Appsec held in NY this year, was a premier NY conference not to be missed. Thank you to OWASP, its attendees and organizers."

Nancy Lornston, 2013 Winner

"AppSec 2013 was an awesome experience! Nowhere in the world can you find the top security experts all in one place at one time (and participate in a marriage proposal!). The conference presentations were well organized and the speakers were prepared to share pros, cons, successes and failures of their work in order to advance the application security domain. The variety of vendors was terrific as well. The Women in AppSec panel was an opportunity to advance women's position in the community. Each speaker shared some very candid remarks about their personal experiences and by the end, it was clear that while more work needs to be done, there is a sincere interest by companies, universities and the industry in general to work on doing the things needed to attract more women to the profession. The training course I attended (Open source tools) lived up to it's billing and I came away with several invaluable tips and strategies to improve our program. A huge thank you to the Women in App Sec Panel and OWASP in general for this opportunity to attend the premier Application Security Conference in the world."

Tara Wilson, 2011 Winner

“Being fortunate enough to receive the Women in AppSec sponsorhsip is a unique and valuable experience. It is a great opportunity for women to have a chance to bolster their skills and dive deep into the world of application security. I found that attending the conference was not only a great way to experience what the OWASP community has to offer, but it also gives students a chance to network with a great group of people who are passionate about their field and willing to share a wealth of information.”

Chandni Bhowmik, 2011 Winner

Chandni Bhowmik is currently completing an M.S. in Computer Security and Information Assurance at the Rochester Institute of Technology (RIT). Her first introduction to OWASP was through the project WebScarab during an application security lab last spring at RIT and her interest in OWASP grew ever since. Over the summer, she started programming open source web applications using built-in security features of Django and Python. She is interested in becoming an information security researcher, and hopes to leverage learning at OWASP AppSec USA 2011 in ad-hoc architecture, mobile platforms and over-all concepts of web application security. Besides secure programming, Chandni enjoys her current research involving digital image forensics and machine learning. In addition to attending school, she has interned in IT security and compliance at Paychex, a Rochester based payroll processing company, and gained industrial experience working an assistant systems engineer for Tata Consultancy Services, a global IT firm.

Contact Us

If you are interested in another piece of OWASP design for your event or project, please let us know by using the OWASP Contact Us form.