Revision as of 18:17, 10 July 2019

For the fourth year in a row, the Portland OWASP chapter is proud to host our information security training day! This is be an excellent opportunity for the local Portland security community to receive top quality information security and application security training for prices far lower than normally offered. It's also a great chance to network with other local infosec and appsec enthusiasts and meet those who share your interests.

The 4th annual OWASP Portland 2019 Training Day date will be on September 25, 2019. See Details for more info.

General registration date will be announced soon.

Want to get news and information on our 2019 Training Day? Subscribe to the [1] Portland OWASP mailing list or follow @PortlandOWASP on Twitter!

Courses

Courses will be held in two tracks: four in the morning session, and four in the afternoon session. Each participant can register for one morning course, one afternoon course, or one of each.

All Day Session

OWASP Top 10 / Juice Shop Hack Session (all day)

This course is subject to change from a full day course to either a morning or afternoon session - TBD

Instructor: David Quisenberry (ALL DAY SESSION)

Abstract: This session is meant for those new to OWASP Top Ten. We will go over the OWASP Top Ten - where it came from, what it’s good for, what are the top ten, etc. And illustrate the concepts in the OWASP Top Ten through another OWASP Flagship Project - The OWASP Juice Shop. This will be a hands on class so everyone can follow along in the Juice Shop to explore the concepts. There will be time at the end for everyone to continue on their vulnerability hunting and a friendly Juice Shop CTF.

Bio: David Quisenberry (@dmqpdx16) is a backend developer and security champion with Daylight Studio, a local Portland boutique web agency. He serves on the Portland OWASP board as Outreach/Events coordinator and does what he can to up the involvement of established and emerging software developers in security conversations.

Prerequisites: Laptop capable of running docker and burpsuite.

Morning Session 8:30 AM - Noon

Android Apps Hands-On

Instructor: Alexei Kojenov

Abstract: Mobile apps are released and updated with the speed of light (or faster??), and there is an app for every purpose. Naturally, one may wonder if these apps are secure, and if not, what can be done to improve them. But first, one must understand the common mobile app security considerations and vulnerabilities, and how an attacker would discover and exploit them. In this workshop, we’ll talk about the most common Android application vulnerabilities, and learn the ways to reverse engineer and pentest Android apps. Note: We’ll focus primarily on applications rather than the platform, and won’t go into debates like “Android vs. iOS” :) Also, you do not need to own an Android device in order to participate, as we’ll be using software emulation for our exercises.

Bio: Alexei Kojenov (@kojenov) is a Senior Product Security Engineer with years of prior software development experience. During his programming days at a large technology company, he gradually moved from writing code to breaking code, which he enjoyed a lot! Alexei then decided to go work for an application security consulting company, helping big and small businesses identify and fix security vulnerabilities and design secure applications. Currently, he is part of Salesforce’s product security team, helping to deliver on Salesforce's #1 value: Trust.

Prerequisites: A laptop with Windows, MacOS, or Linux, and virtualization support.

AWS API Threat Modeling and Automated Testing

Instructor: Kendra Ash

Abstract: If you are a software, DevOps, QA or security engineer and want to learn how to threat model API's in AWS this course is for you. This course will cover the what, why, when, and how of threat modeling applications in your organization. The bulk of this course will be based on the book Threat Modeling by Adam Shostack and will leverage a variant of the Escalation of Privileges card game. Also, I will dive into the approach I have used to gain adoption from engineering teams as a security engineer. After gaining an understanding of threat modeling, we will dive into how we can automate security checks for an AWS environment — leveraging the AWS CLI tool to provide quick engineering feedback on ways to improve the security of their infrastructure.

Bio: Kendra Ash (@securelykash) is an information security engineer at Vacasa, actively building a security team and program by leveraging guidance from her network and industry standards.

Prerequisites: TBD

Afternoon Session: 1:30 PM - 5:00 PM

Advanced Application Security Testing

Instructor: Timothy Morgan

Abstract: This course takes students beyond the most basic web application exploitation scenarios, focusing on advanced SQL injection, XML eXternal Entities (XXE) and server-side request forgery (SSRF) attacks. The course also covers out-of-band detection and exfiltration using the DNS, which has recently become a popular technique used by penetration testers.

Prerequisites: Students should be familiar with popular web application testing proxies such as Burp Proxy or OWASP ZAP. Some experience with basic SQL injection attacks is recommended.

Container Security

Instructor: Alex Ivkin

Abstract: "When it comes to container security there are two prevailing schools of thought - either containers are secure by default, so you should not care much, or containers can not be secure in principle, so you should avoid them at all costs. In this training you will go through the real world examples of configuring and running containers in a secure manner. You will get insights into the security of both Windows and Linux containers, container infrastructure, such as container registries and orchestration platforms - docker swarm and kubernetes. We will examine real world vulnerabilities unique to different architectures of containers and how to address them.

Takeaways:

1. Building and running docker containers securely
2. Avoiding common pitfalls in docker infrastructure setup (dockerd, docker registry)
3. Navigating security in the container orchestration platforms (docker swarm, kubernetes)"

Bio: Alex Ivkin (@alerxes) is a Director of Solutions at Eclypsium, a local Portland company, specializing in firmware, hardware and supply chain security. Alex has deep implementation experience in a long list of security domains, including cloud, application security and IAM. He co-authored the ISACA CSX Professional certification and is an alpine climber.

Prerequisites:

• Mid to advanced level technical experience
• Basic experience with running docker containers
• Laptop with docker for windows setup and tested

2019 Sponsors

Interested in becoming a sponsor? Here is a document outlining the opportunities: Sponsorship-Doc. Reach out to [email protected] to let us know.

2018 Sponsors

Mixer Sponsors

Training Session Sponsors

Morning Coffee Sponsors

General Sponsors

Details

OWASP Portland 2019 Training Day will be on September 25, 2019.

This year for the 2nd time, we'll be located at:

World Trade Center Portland
121 SW Salmon St.
Portland, OR 97204. 

Later in the evening, a social mixer will also be held at Rock Bottom Restaurant & Brewery, just a short walk away:

206 SW Morrison St
Portland, OR 97204

Schedule

Interested in teaching a training at Training Day 2019? Contact Portland OWASP via the mailing list or Twitter!

Lunch Ideas

Here are some lunch ideas:

• Farmhouse Cafe, 101 SW Main St.
• The Good Earth Cafe, 1136 SW 3rd Ave.
• Chipotle Mexican Grill, 240 SW Yamhill St.
• Luc Lac Vietnamese Kitchen, 835 SW 2nd Ave.
• Rock Bottom Restaurant & Brewery, 206 SW Morrison St.
• Buffalo Wild Wings, 327 SW Morrison St.
• Cafe Yumm, 301 SW Morrison St.
• Killer Burger, 510 SW 3rd Ave.
• House of Ramen, 223 SW Columbia St.
• There are some food carts north of the World Trade Center on SW 3rd Ave. and SW Stark St.

How to Register

Registration will again be via EventBrite

Thank you to the OWASP Foundation and the many sponsors, trainers, volunteers and trainers that have helped make Training Day a success and allow us to continue!