Revision as of 19:27, 23 September 2009

Previous Presentations

Wednesday, September 16th, 2009 7:30PM

• The Rise of Threat Analysis and the Fall of Compliance, Policies, and Standards in mitigating Web Application Security Risks

On August 5th of 2009, Federal prosecutors on Monday charged Albert Gonzales with the largest case of credit and debit card data theft ever in the United States: 130 million credit cards numbers by hacking into the systems of Heartland Payment Systems, the New Jersey-based card processing company, as well as Hannaford Brothers, 7-Eleven and two unnamed national retailers. Using a SQL-injection attack, the hackers installed malware on Hannaford Brothers. Hannaford was PCI compliant at the time they were compromise that lets question the validity of regulatory compliance frameworks, and specifically PCI standards as an effective method to reduce data breaches, identity theft, and the proliferation of credit card fraud. This presentation will further analyze how status quo security standards, such as PCI-DSS, as well as other policies, standards, and guidelines truly affect security risk mitigation efforts against cybercrime based threats. These traditional efforts will be compared to threat modeling workflows in order to demonstrate how real risk is mitigated under each scenario.

Cases for financial fraud will be anonymously presented to create a business case for application threat modeling as a viable methodology to drive improved application design and security risk mitigation. Threat modeling concepts will be elaborated in order to prove how application architecture walkthroughs via threat modeling improve the mitigation of cybercrime threats. Attacker motives and goals will be presented and incorporated into attack trees and it will show how attack libraries can be used to effectively identify application vulnerabilities and devise countermeasures in web application.

From the risk analysis perspective, several attacks will be considered and highlighted, particularly attacks that represent a systemic impact to an organization or government (such as for example a distributed denial of service).

Through the presentation of threat modeling scenarios, analyses and correlations will be drawn from the represented model(s) to attack patterns, associated and discovered security vulnerabilities, data sources, application topologies, and possible roles and permissions associated with the application environment. The purpose of the presentation is to demonstrate how application threat modeling can be used as part of a nouveau age form of security risk mitigation and overall application security. Data flow diagrams and application walkthroughs will enable audience members to witness how application threat modeling is an evolved form of security process engineering for improved application design and overall application security. The presentation will also demonstrate how threat modeling is capable of delivering critical business functions as well as in mitigating current and future cyber attacks, such as distributed denial of service, botnet driven-malware, spear phishing techniques, and more attacks that ultimately lead to identity and credit card fraud.

From the point of view of current and future cybercrime risk mitigation, several different strategies for application threat modeling will be discussed as related to securing both the web application web and critical financial infrastructures, such as ATMs. Finally some emphasis will be given to countermeasures that provide for incident response, intelligence and forensics capabilities.

Presentation outline, defining all topics that will be covered:

• Status quo of regulatory compliance in mitigating risk
• Threat modeling techniques for cybercrime threats
• Attack tree analysis for attack tree vectors
• Threat modeling for multi-channel fraud threat scenarios
• Cyber crime threats and application countermeasures via threat modeling
• Example of mitigation strategies for cybercrime and application of defense in depth for web applications

Any supporting research/tools:

• Threat models and attack trees
• Threat model are produced using the Microsoft™ threat modeling tool
• Public available cybercrime data will be presented and correlated

Marco Morana serves as one of the leaders of OWASP (Open Web Application Security Project) organization where he is actively involved in evangelize on web application security through presentations at local chapter meetings in USA as well as internationally. Marco has recently been awarded a contract from Wiley Publishing to co-author a book on Application Threat Modeling.

Besides being the OWASP Cincinnati chapter lead, Marco is also active contributor to OWASP projects such as the application threat modeling methodology for secure coding guideline and the security testing guide (ver. 2 and 3). Besides contributing to OWASP, Marco works as Technology Information Security Officer for a large financial organization in North America with responsibilities in the definition of the organization web application security standards, management of application security assessments during the SDLC, threat-fraud analysis and training of software developers, project managers and architects on different topics related to application security.

In the past, Marco served as senior security consultant and independent consultant where his responsibilities included providing software security services for several clients in the financial and banking, telecommunications and commercial sector industry. Besides security consulting, Marco had a career as technologist in the security industry where he contributed to the design business critical security products currently being used by several FORTUNE 500 companies as well by the US Government.

Marco work on software security is referred in the 2007 State Of the Art report by the Information Assurance Technology Analysis Center (IATAC). Marco received the NASA’s Space Act Award in 1999 for the patenting the S/MIME SEP (Secure Email Plug-in) application.

Marco research work on application and software security is widely published on several magazines such as In-secure magazine, Secure Enterprise, ISSA Journal and the C/C++ Users journal. Marco’s ideas and strategies for writing secure software are posted on his blog: http://securesoftware.blogspot.com.

Tony UcedaVelez has more than 10 years of hands-on security and technology experience and is a vocal advocate of security process engineering – a terminology that describes the design and development of secure processes and controls working symbiotically to a unique business workflow. Tony currenlty serves as Managing Director for an Atlanta based risk advisory firm that focuses on security strategy and delivering effective means for risk mitigation and security process engineering. He has worked and consulted for the Fortune 500, as well as federal agencies in the U.S on the topic of application security and security process engineering. His diverse background in software development, security architecture, and network security, coupled with his expertise in process engineering and security risk management has allowed Tony to be a recognized leader in developing strategic security solutions that are multi-faceted in their approach to addressing enterprise risk.

In the realm of application security, Tony is a threat modeling evangelist and has provided numerous talks domestically and globally on its many benefits and application. He has served as a guest mentor to teams participating in Kennesaw State University’s annual Cybercrime capture the flag event as well as a Cybercrime speaker for Southern Polytechnic University in Atlanta. He has also served as a guest speaker on the subject of application threat modeling during ISACA’s annual Geek Week event and has also served as a keynote speaker on the subject for ISACA’s Global Symposium web cast series. Additional articles include articles related to CoBIT and the ValIT model (ISACA’s Journal), application threat modeling within the SDLC (InSecureMagazine), and security process engineering for a ROSI (return on security investment) (Journal of Finance). He is currently finalizing a Wiley publishing book on Application Threat Modeling with Marco Morana.

Prior to VerSprite, Tony served as Sr. Director of Security Risk Management to a Fortune 50 organization where he led security assessments against global application environments. His work encompassed web application security testing, security architecture reviews, and analysis for business logic exploits. He applied effective ways to introduce the subject of application risk to information owners by effectively mapping them to causal factors for business. Previous to this role, he spent more than 5 years in the field of application security across other Fortune 500 organizations within the banking, telecom, and information service industry segments.

Tony currently leads the OWASP Atlanta Chapter, where he manages monthly workshops and events for the Atlanta web application security community. He also has developed a case study program for the Atlanta chapter in order to develop case studies with local Atlanta companies who are seeking to apply application threat modeling techniques within the SDLC and/ or incorporate the many OWASP produced tools and frameworks. Tony can be reached at [email protected] or [email protected].

Tuesday, August 25th, 2009 3:00PM

• OWASP Live CD Demo and Q&A with Matt Tessauro

Matt Tesauro will be in visiting our LA chapter and providing a quick demo of OWASP Live CD

Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP Live CD.

Thursday, August 20th, 2009 7:30PM

• The Software Assurance Maturity Model (SAMM)

The Software Assurance Maturity Model (SAMM) is a flexible and prescriptive framework for building security into a software development organization. Covering more than typical SDLC-based models for security, SAMM enables organizations to self-assess their security assurance program and then use recommended roadmaps to improve in a way that's aligned to the specific risks facing the organization. Beyond that, SAMM enables creation of scorecards for an organization's effectiveness at secure software development throughout the typical governance, development, and deployment business functions. Scorecards also enable management within an organization to demonstrate quantitative improvements through iterations of building a security assurance program. This workshop will introduce the SAMM framework and walk through useful activities such as assessing an assurance program, mapping an existing organization to a recommended roadmap, and iteratively building an assurance program. Time allowing, additional case studies will also be discussed. SAMM is an open and free project and has recently been added under the Open Web Application Security Project (OWASP) Foundation.

Pravir Chandra is Director of Strategic Services at Fortify Software and works with clients on software security assurance programs. Pravir is recognized for his expertise in software security, code analysis, and his ability to strategically apply technical knowledge. Prior to Fortify, he was a Principal Consultant affiliated with Cigital and led large software security programs at Fortune 500 companies. Pravir Co-Founded Secure Software, Inc. and was Chief Security Architect prior to its acquisition by Fortify. He recently created and led the Open Software Assurance Maturity Model (OpenSAMM) project with the OWASP Foundation, leads the OWASP CLASP project, and also serves as member of the OWASP Global Projects Committee. Pravir is author of the book Network Security with OpenSSL.

Tuesday, July 21st, 2009 7:30PM

• Lock picks, BumpKeys, and Hackers oh my! How secure is your application?

This talk will focus on physical security controls, weaknesses, and counter measures. I will present on what lock picking is, how bump keys work, and ways to subverting electronic locks. We will also go into what are good controls, and what is often overlooked when designing secure environments. Many of the topics covered apply to application security, as the methods for securing these devices is by using obscurity. In the application world with automated tools and scripts, this does not hold water for very long.

David M. N. Bryan, NetSPI has 10 years of computer security experience, including consulting, engineering, and administration. He has performed security assessment projects in the healthcare, nuclear, manufacturing, pharmaceutical, banking and educational sectors.
As an active participant in the information security community, he volunteers at DEFCON, where he designs and implements the firewall and network for what is said to be the most hostile network environment in the world. This network allows speakers, press, vendors, and others to gain access to the Internet, without being hacked. In his spare time he and his wife run the local DEFCON group, DC612 and participate in the Minneapolis OWASP chapter.

June 24th, 2009 7:30PM

• Information Warfare: Past, Present and Future

Information warfare is the composite use of psychological operations (PYOPS), military deception (MILDEC), operational security (OPSEC), computer network operations (CNO), and electronic warfare (EW) to control and disrupt information flow. Recently, interest in information war technologies, techniques and policy issues have increased, especially in the domain of CNO. Increased scrutiny over network operations is both legitimate and valid, as global commerce and military powers are integrated and dependent on the Internet for critical operations. This presentation will describe the five domains of information warfare, the past use of information warfare in the Gulf war and recent Cyber attacks on the Eastern European countries of Georgia and Estonia. Information will be presented on possible new directions of information warfare.

Mikhael Felker, CISSP-ISSEP has worked in a variety of roles including instructor, engineer, and researcher. He is currently employed by The Aerospace Corporation in the Information Assurance Technology Department, supporting Information Assurance (IA) for satellite systems. He is also an Instructor within the Computer & Information Systems Division at UCLA Extension, teaching a course in networking. Actively involved in the Los Angeles security community, he is the Education Director for Los Angeles Chapter of Information Systems Security Association (ISSA), member and speaker of Information Systems Audit and Control Association (ISACA), and former Defense Sector Coordinator for InfraGard. Mikhael has published articles in IEEE Security & Privacy, the ISSA Journal, Information Systems Control Journal, and SecurityFocus. He is a recipient of the Scholarship for Service Program (SFS) Fellowship, sponsored by the National Science Foundation and Department of Homeland Security (DHS). Mikhael completed his graduate work at Carnegie Mellon University with a Master's in Information Security Policy & Management and Bachelor's at UCLA in Computer Science. He holds over 10 certifications in IT and Security.

May 20th, 2009

• Top Ten Web Hacking Techniques of 2008: "What's possible, not probable"

The polls are closed, votes are in, and we have the winners making up the Top Ten Web Hacking Techniques of 2008! The competition was fierce with the newest and most innovative web hacking techniques to the test. This session will review the top ten hacks from 2008 - what they indicate about the security of the web, what they mean for businesses, and what might be used against us soon down the road.

Jeremiah Grossman is the founder and CTO of WhiteHat Security. He is considered a world-renowned expert in Web security, is a co- founder of the Web Application Security Consortium, and was named to InfoWorld's Top 25 CTOs for 2007. Grossman is a frequent speaker at industry events including the Black Hat Briefings, RSA, CSI, HiTB, OWASP, ISSA, and a number of large universities. He has authored dozens of articles and white papers; is credited with the discovery of many cutting-edge attack and defensive techniques and is a co-author of XSS Attacks. Grossman is often quoted in the the business and technical press. Prior to WhiteHat, Grossman was an information security officer at Yahoo!

April 15th, 2009

• Cross Site Scripting, Exploits and Defenses
  
  

For a long time, the impact of XSS vulnerabilities has been grossly underestimated. Recent compromises, such as the pro-Hillary defacement of Barack Obama's website, and a Viral XSS in Twitter demonstrated the impact of XSS vulnerabilities to the masses.

During this presentation, David Campbell will demonstrate exactly how effective XSS vulns can be, and show you what you can do to protect yourself and your sites.

This presentation was originally delivered to OWASP Colorado in May of 2008, and has been updated for this session.

Slide deck from May '08 talk

David Campbell is an infosec veteran, with experience ranging from penetration testing for Fortune 100's to architecting security solutions for large multinational financials to consulting for government agencies. DC is presently chapter leader of OWASP Denver and is Principal Consultant at Electric Alchemy.

March 12th, 2009

• NETWORK SECURITY DINNER WITH ISSA - CISO'S Security Dashboard Panel!!
  
  

This month will be joining forces with ISSA to create the biggest netowork event for security professionals in Los Angeles for this year.

Agenda

• 5:30 p.m., Networking and tours of the antivirus facility
• 6:30 p.m., Dinner
• 7:30 p.m., CISO Panel

Panelists

• Robert J. Brown, CISSP, CISO WestCorp Credit Union
• Steve Haydostian, CISSP, Former CISO, Healthnet
• David Lam, CISSP, CISO, Stephen S. Wise
• Edward G. Pagett II, CISSP, CISO, Lender Processing Services, Inc.
• Mike O. Villegas, CISA, CISSP, Director of Information Security, Newegg.com

Dinner Fees:

• ISSA-LA members & OWASP members - Pre-Register and Pay online: $25
• ISSA-LA members & OWASP members - Pay at the door: $30
• Non-members - Pre-Register and Pay online: $30
• Non-members - Pay at the door: $35

Thanks to David Lam and Stan Stahl for agreeing to have OWASP joining this ISSA LA event!

February 18th 2009

Cloud Computing and Security
The Cloud Computing and Software as a Service models are driving many companies to build innovative, scalable and cost effective alternatives to the traditional IT computing model. Even with the potential cost and scalability benefits of cloud computing, its use by more traditional enterprises has been retarded by the concerns of their professional security and audit staffs. In our experience these concerns are legitimate, and although surveys have shown that security is the #1 factor preventing adoption of cloud computing, there has been very little reliable discussion of the technical security risks inherent in the model and how engineers, sys-admins and architects can deal with these risks.

In this session, we will explore the widely differing security models of the leading cloud computing providers, including Amazon, Google and Salesforce. We will also reveal the significant differences in operational and application security practices necessary to deal with a cloud computing environment.

Alex Stamos is a co-founder and Partner at iSEC Partners Inc., a strategic digital security organization. Alex is an experienced security engineer specializing in solving difficult problems in application security and is a leading researcher in the field of web application and mobile security. He has been a featured speaker at top industry conferences such as Black Hat, Web 2.0 Expo, CanSecWest, DefCon, SyScan, SD Best Practices, Microsoft BlueHat and OWASP App Sec. Alex is a contributing author to "Hacking Exposed: Web 2.0" and an author of the upcoming book "Mobile Application Security", both from McGraw-Hill. He holds a BSEE from the University of California, Berkeley.

January 28th 2009

Building Security into the Test Organization
The common approach to detecting web security issues is still the regular application of a post-release pen-test or tool based scan. These last minute examinations rarely live up to broader organizational goals; they can be difficult to repeat, measure, or optimize over time. Most of all they're expensive: they find bugs late in the lifecycle. This talk recommends moving security testing responsibility within the test team itself. The approach discussed will work with-or-without the existence of explicit security requirements. See how security testing has been applied at other organizations and how it might be customized for yours.

Ben Walther firmly believes testers have a wonderfully devious mindset, and has been promoting the idea of "security testing" at Cigital's clients, at OWASP events, and to any friends and relatives who will listen. To this end, with the aid of O'Reilly media, Ben Walther and Paco Hope recently published a book entitled the "Web Security Testing Cookbook."

December 10th 2008

The MySpace Worm

The most virulent worm in the history of the series of tubes known as the Internet. One of the most highly accessed websites ever [see comScore]. One of the most ostentatious hackers alive. Over one million victims. Less than 24 hours. Fueled only by Chipotle burritos. The MySpace Worm.

Samy will be recapping the story of the development, release and eventual future of the MySpace worm. The 24 hours that led up to over one million friends. The eventual downfall of the MySpace site for several hours. The non-malicious intent and humorous progression of the worm. The t-shirts. The copycats. The behind-the-scenes story of the Secret Service raid at Samy's home and office. The demise of Samy's legal use of computers, community service, restitution, high-risk offender probation, and rehabilitation. And where Samy is today.

Samy Kamkar, software engineer and self-proclaimed playboy, is a meddler in the security and software realms. He is currently the Director of Engineering and co-founder of Fonality, Inc., an IP PBX startup located in Culver City. Previously, Samy led the development of all core top-level domain name server software and systems for Global Domains International (.ws). Prior to that, Samy worked with Penn State University developing psychometric personality assessment software with attention to artificial intelligence and bioinformatics. When not strapped behind the Matrix, Samy can be found performing parkour (free running), practicing urban escape artist maneuvers, or is found getting involved in local community service projects. In the past 10 years, Samy has focused on evolutionary and genetic algorithmic software development, Voice over IP software development, automated security and vulnerability research in the areas of network security, reverse engineering, and network gaming, and continues his focus in staying out of jail.

November 19th 2008

A new web attack vector: Script Fragmentation

This presentation will introduce a new web-based attack vector which utilizes client-side scripting to fragment malicious web content.

This involves distributing web exploits in a asynchronous manner to evade signature detection. Similar to TCP fragmentation attacks, which are still an issue in current IDS/IPS products, This attack vector involves sending any web exploit in fragments and uses the already existing components within the web browser to reassemble and execute the exploit.

Our presentation will discuss this attack vector used to evade both gateway and client side detection. We will show several proof of concepts containing common readily available web exploits.

Stephan Chenette is a Senior Security Researcher who helps lead Websense Security Labs working on malcode detection techniques. Mr. Chenette specializes in research tools ranging from kernel-land sandboxes, to static analysis scanners. He has released public analyses on various vulnerabilities and malware. Prior to joining Websense, Stephan was a security software engineer for 4 years working in research and product development at eEye Digital Security.

October 29th 2008

Entitlements Management: Security and policies for SOA using XML appliances

Loosely coupled Web Services can be insecure as, by their very nature, are exposed to application consumers. Security built into XML appliances alleviates the developer with the burden of coding security and policies into their application, freeing the developer to concentrate on conding business processes. This evenings meeting will discuss SOA security challenges and introduce the Layer7 XML appliance that allows for dynamic policies to be configured on the fly using an intuitive user interface.

Jonathan Gershater’s career started at 3Com, managing servers and networks. His initial foray into Enterprise Software began in 1999 at enCommerce, which was later acquired by Entrust. He worked at Sun Microsystems from 2005 to 2008 architecting and deploying identity solutions for customers using Sun Java System Identity products. He recently joined Layer 7 Technologies as a senior solution architect. He can be reached at [email protected].

September 17th 2008

The web hacking incident database (WHID) 2007 Report is a Web Application Security Consortium project dedicated to maintaining a list of web applications related security incidents. The database classifies each reported attack by, among other criteria, the method used, the outcome of the attack and the industry and the country of the attacked organization. Based on the database Breach Labs which sponsors WHID issues a periodical report on trends in Web Application Security.

By providing answers to questions such as:

• The drivers behind Web hacking.
• The technology hackers use.
• The types of organizations attacked most often.
• The common outcomes

The presentation will discuss WHID statistics, focusing on rising trends in Web Attacks in the 1st half of 2008. As the WHID enables research into the business model behind hacking, the presentation goes beyond discussing the technical aspects of attacks such as SQL injection crawlers and Web Site herding, to discussing the business model common to all of the attacks: Economy of scale.

Ryan C. Barnett is a recognized security thought leader and evangelist who frequently speaks with the media and industry groups.

He is the director of application security at Breach Security. He is also a faculty member for the SANS Institute, where his duties include instructor/courseware developer for Apache Security/Building a Web Application Firewall Workshop, Top 20 Vulnerabilities Team Member and Local Mentor for the SANS Track 4, "Hacker Techniques, Exploits and Incident Handling" course. He holds six SANS Global Information Assurance Certifications (GIAC): Intrusion Analyst (GCIA), Systems and Network Auditor (GSNA), Forensic Analyst (GCFA), Incident Handler (GCIH), Unix Security Administrator (GCUX) and Security Essentials (GSEC).

Mr. Barnett also serves as the team lead for the Center for Internet Security Apache Benchmark Project and is a member of the Web Application Security Consortium. His web security book, "Preventing Web Attacks with Apache,” was published by Addison/Wesley in 2006.

August 19th 2008

"Don't Write Your Own Security Code" – Application security is arguably the most difficult IT challenge facing organizations today. There are over 600 different categories of vulnerabilities to avoid and they are all tricky. Most of these problems are related to the design, implementation, and use of a relatively small set of security controls. To solve this problem for developers, Jeff created the OWASP ESAPI project – a clean intuitive toolbox of the core security building blocks that every web developer needs. In this talk, Jeff will show you how to create an ESAPI for your organization that will solve the OWASP Top Ten vulnerabilities, increase assurance, and dramatically cut costs all at the same time.

Jeff Williams is the founder and CEO of Aspect Security, specializing in application security services. Jeff also serves as the volunteer Chair of the Open Web Application Security Project (OWASP). Jeff has made extensive contributions to the application security community through OWASP, including the Top Ten, WebGoat, Stinger, Secure Software Contract Annex, Enterprise Security API, and the local chapters program. Jeff holds advanced degrees in psychology, computer science, and human factors, and graduated cum laude from Georgetown Law.