This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "LatamTour2017"
From OWASP
m (→03 de Abril) |
m (small update to the Costa Rica agenda) |
||
| Line 550: | Line 550: | ||
This talk will assume that a basic understanding of data flow diagramming, pen testing, security architecture, and threat analytics is understood by the audience. This talk also centers around the idea of modeling threats for applications based upon a higher propensity of threat intelligence, how to harvest and correlate threat patterns to your threat model and also how to correlate a threat model to defining preemptive controls and countermeasures to include in the overall design. | This talk will assume that a basic understanding of data flow diagramming, pen testing, security architecture, and threat analytics is understood by the audience. This talk also centers around the idea of modeling threats for applications based upon a higher propensity of threat intelligence, how to harvest and correlate threat patterns to your threat model and also how to correlate a threat model to defining preemptive controls and countermeasures to include in the overall design. | ||
| − | This talk will focus on walking attendees through the PASTA threat modeling methodology over 3 different deployment models for technology: IoT, E-Commerce, and Mobile. The talk will place specific emphasis on phases II (Technology Enumeration), phase III (Application Decomposition), and phase IV (threat analysis). Although all 7 phases of the PASTA threat modeling methodology will be exemplified, discussions around what tools and techniques around phases II, III, and IV will be discussed in detail since many industry professionals find it challenging to know the various application components that make up the various tiers of an application model. I will be exemplifying some tools to enumerate technical components across various application levels (ex: fingerprinting service PIDs on different apps or systems across IoT, Mobile, eCommerce) as each of these types of system environments are different. Another emphasis on the talk will be around defining trust boundaries while data flow diagramming and identifying what possible countermeasures to introduce from an architectural level. We'll review security architectural best practices from SABSA and TOGAF and how it can fortify secure design patterns. Stage/ Phase IV (Threat Analysis) will also be a key focus as we speak on practical ways in which threat data can be harvested as well as collected from external threat sources. We'll be integrating STIX and TAXII considerations on how to have infrastructure that can feed relevant data points to your threat model. The actual threat modeling methodology can be found here: www.versprite.com/PASTA-abstract.pdf | + | This talk will focus on walking attendees through the PASTA threat modeling methodology over 3 different deployment models for technology: IoT, E-Commerce, and Mobile. The talk will place specific emphasis on phases II (Technology Enumeration), phase III (Application Decomposition), and phase IV (threat analysis). Although all 7 phases of the PASTA threat modeling methodology will be exemplified, discussions around what tools and techniques around phases II, III, and IV will be discussed in detail since many industry professionals find it challenging to know the various application components that make up the various tiers of an application model. I will be exemplifying some tools to enumerate technical components across various application levels (ex: fingerprinting service PIDs on different apps or systems across IoT, Mobile, eCommerce) as each of these types of system environments are different. Another emphasis on the talk will be around defining trust boundaries while data flow diagramming and identifying what possible countermeasures to introduce from an architectural level. We'll review security architectural best practices from SABSA and TOGAF and how it can fortify secure design patterns. Stage/ Phase IV (Threat Analysis) will also be a key focus as we speak on practical ways in which threat data can be harvested as well as collected from external threat sources. We'll be integrating STIX and TAXII considerations on how to have infrastructure that can feed relevant data points to your threat model. The actual threat modeling methodology can be found here: https://www.versprite.com/PASTA-abstract.pdf |
| Salón #1 | | Salón #1 | ||
|- | |- | ||
| Line 562: | Line 562: | ||
|- | |- | ||
| 9:20 - 10:15 | | 9:20 - 10:15 | ||
| − | | | + | | DevOps: Primeros Pasos |
| Martin Flores González Costa Rica | | Martin Flores González Costa Rica | ||
| Bugs are the main source of vulnerabilities in software; being able to quickly and seamlessly deploy fixes all the way to production should be one of the main goals of any development team; practices allowing towards that goal; by means of removing silos and barriers, need to be embraced by organizations of all sizes. DevOps movement has gain momentum, learning about its spirit, main practices and the overall journey; could enable software development organizations to find what is needed so they could start their journey too. Join us for this presentation were we will cover some of the history of DevOps, its practices and process and finally a short demo of an application embracing these practices. | | Bugs are the main source of vulnerabilities in software; being able to quickly and seamlessly deploy fixes all the way to production should be one of the main goals of any development team; practices allowing towards that goal; by means of removing silos and barriers, need to be embraced by organizations of all sizes. DevOps movement has gain momentum, learning about its spirit, main practices and the overall journey; could enable software development organizations to find what is needed so they could start their journey too. Join us for this presentation were we will cover some of the history of DevOps, its practices and process and finally a short demo of an application embracing these practices. | ||
Revision as of 02:25, 4 April 2017
Agenda
- April, 3: Manizales, Colombia
- April, 3: Bogotá, Colombia - REGISTRATE AQUÍ
- April, 5-6: Montevideo, Uruguay - REGISTRATE AQUÍ
- April, 6-7: República Dominicana - REGÍSTRATE AQUÍ
- April, 8: Quito, Ecuador -REGISTRARSE AQUI
- April, 19: Córdoba, Argentina
- April, 21: Patagonia, Argentina - REGISTRARSE AQUI
- April, 21: San José, Costa Rica
- April, 21: Lima, Perú
- April, 21-22: Santa Cruz, Bolivia -REGISTRARSE AQUI
- April, 22: Cancun, Mexico
- April, 22: São Paulo, Brazil
- April, 25: San Salvador, El Salvador - Registrarse aquí
- April, 26-27: Santiago de Chile
- April, 27: Caracas, Venezuela -REGISTRARSE AQUI
- April, 28: Buenos Aires, Argentina - REGISTRARSE AQUI
Latam Tour Objective
The OWASP Latam Tour objective is to raise awareness about application security in the Latin America region, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.
We are proposing a chapters conference driven model in which the sessions are free for everybody and the costs are supported by a mix of funding i.e. OWASP Foundation, local chapter budget, external sponsorship, etc. 1-day training sessions are also offered in some tour stops. These sessions’ fees are $ 200USD for OWASP members and $ 250 USD for non-members (group discounts may apply).
Who Should Attend the Latam Tour?
- Application Developers
- Application Testers and Quality Assurance
- Application Project Management and Staff
- Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff
- Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance
- Security Managers and Staff
- Executives, Managers, and Staff Responsible for IT Security Governance
- IT Professionals Interesting in Improving IT Security
- Anyone interested in learning about or promoting Web Application Security
Special offer - Become an OWASP Member
As part of the OWASP Latam Tour, you could become an OWASP Member by paying 20 U$D. Show your support and become an OWASP member today!
QUESTIONS
- If you have any questions about the Latam Tour, please send an email to laura.grau@owasp.org
#Latamtour hashtag for your tweets for Latam Tour (What are hashtags?)
@AppSecLatam Twitter Feed (follow us on Twitter!) <twitter>34534108</twitter>
Sponsors
Community Supporters
Lunch & Coffee Break Sponsor
Educational Supporters
