Belgium Events 2011

These are the 2011 events of the OWASP Belgium Chapter.

Previous year: 2010. Next year: 2012.

Previous Meeting (16th of June 2011) in Brussels

WHEN

16th of June 2011 18h-21h00

WHERE

Deloitte sponsors the location:
Berkenlaan 8, 1831 diegem
Google Maps link

There will be access to the parking at building 7. The gate between building 7 and 8 will be open.

This gate will provide you access to building 8B, but the meeting room is at building 8C, you are asked to go directly to building 8C

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Sandwiches
  
• 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 18h45 - 19h45: The OWASP AppSensor Project (by Colin Watson, Watson Hall Ltd)
  

The OWASP AppSensor Project defines a conceptual framework and methodology that offers prescriptive guidance to implement attack detection and automated response into an existing application. The talk will provide an overview why conventional defences do not work, and how application-specific detection can be used to identify, and respond to, attackers before they are able to find a flaw to exploit. Implementations will be described that have been tested against security scanning tools, manual attackers and how the technique could be used to defend against an application worm.

Colin Watson is co-founder of Watson Hall Ltd, based in London, where his work involves the management of application risk, designing defensive measures, building security & privacy in to systems development and keeping abreast of relevant international legislation and standards. He holds a BSc in Chemical Engineering from Heriot-Watt University in Edinburgh, and an MSc in Computation from the University of Oxford. He contributes to a number of OWASP projects and is a member of the OWASP Global Industry Committee.

• 19h45 - 20h00: Break
  
• 20h00 - 21h00: How to become Twitter's admin: An introduction to Modern Web Service Attacks (by Andreas Falkenberg, RUB)
  

Web Services are the cornerstone of inter-application communication in today's IT infrastructure. They are used in distributed systems ranging from huge B2B applications to Cloud APIs (e.g. Amazon EC2). Despite their wide usage, even in critical infrastructures, Web Service security is not fully understood yet. In addition to "classic" web application attacks, such as SQLi and XSS, the use of Web Services opens a whole new realm of attack vectors not found anywhere else.

This talk will give an introduction to current attack techniques for Web Services that have been found in today's Web Services implementation stacks. As a hands on example, the attack technique of the "XML Signature Wrapping" attack is explained in detail. This attack enables an attacker to arbitrarily modify the content of a signed SOAP message with almost no effort.

Based on the XML Signature Wrapping attack, an attack scenario is shown that enables an attacker to become admin of the famous Twitter service, based on a real-life XML Signature Wrapping Attack performed by researchers at our university in 2010.

The last part of the talk gives an overview of other Web Service specific attacks and countermeasures, based on the information given at the WS-Attacks.org website.

Andreas is currently seeking a Master's degree in IT Security at the Ruhr University of Bochum, Germany. Besides being busy writing exams, Andreas works for the Chair for Network- and Data-Security having fun with Cloud- and Web Service-Security.

Previous Meeting (23th of May 2011) in Brussels

Read @xme's review of the meeting on /dev/random blog

WHEN

23th of May2011 18h-21h00

WHERE

LCM, Haachtsesteenweg 579 1031 Brussel

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Sandwiches
  
• 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 18h45 - 19h00: ISSA Update (by Clement Herssens)
  
• 19h00 - 19h45: Non-convential Attacks: Things your security scanners won't find (by Tom Van Der Mussele, Verizon)
  

This presentation will handle non-conventional attacks, such as:

• Attacking XML Streams
• Context escaping
• Session Time-outs

Tom Van der Mussele is a Lead Security Analyst for the Governance, Risk & Compliance Programs in EMEA for Verizon Business Security Solutions. Prior to joining the Governance, Risk & Compliance Programs, Tom worked as Penetration tester. In this role, he specialized in security audits, including penetration testing and web application vulnerability assessments for major financials and governmental organizations.

• 19h45 - 20h30: The Ghost of XSS Past, Present and Future – A Defensive Tale (by Jim Manico, Infrared Security)
  

This talk will discuss the past methods used for XSS defense that were only partially effective. Learning from these lessons, will will also discuss present day defensive methodologies that are effective, but place an undue burden on the developer. We will then finish with a discussion of future XSS defense mythologies that shift the burden of XSS defense from the developer to various frameworks. These include auto-escaping template technologies, browser-based defenses such as Content Security Policy, and Javascript sandboxes such as the Google CAJA project and JSReg.

Jim Manico is a managing partner of Infrared Security with over 15 years of professional web development experience. Jim is also the chair of the OWASP connections committee, one of the project managers of the OWASP ESAPI project, a participant and manager of the OWASP Cheatsheet series, the producer and host of the OWASP Podcast Series, the manager of the OWASP Java HTML Sanitizer project and the manager of the OWASP Java Encoder project. When not OWASP'ing, Jim lives on of island of Kauai with his lovely wife Tracey.

• 20h30 - 21h00: Discussion: How CERT.be & OWASP can improve web application security in Belgium (by Christian Van Heurck, CERT.be)
  

CERT.be presentation and group discussion

Previous Meeting (March 1st 2011) in Leuven

WHEN

March 1st 2011 18h-21h30

WHERE

Hosted by Distrinet Research Group (K.U.Leuven).

Address:
Department of Computer Science (auditorium 00.225)
Celestijnenlaan 200 A
3001 Heverlee

Routemap: http://distrinet.cs.kuleuven.be/about/route/

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Sandwiches
  
• 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 18h45 - 19h45: The Thinking Person's Guide to the Cloud. HOWTO: Keep your head in the clouds and your feet on the ground (by Gunnar Peterson, Arctec Group)
  

“Everything we think of as a computer today is really just a device that connects to the big computer that we are all collectively building"-Tim O'Reilly

My friend Chris Hoff asked this question in a recent podcast - "why is the OWASP Top Ten the same year after year? why don't these things gets fixed?"[1]. The reason is that software security and security architecture and design is nowhere near as a high priority as it needs to be.

If you look at the evolution of software over the years, you will see a history of more and more systems and data being connected together. Beginning with the Web through to component based application and then to Web services, at each step the common theme is more connectivity, more integration. Software is a rapidly changing universe

Unfortunately, Information Security has not kept up. Our field started out promisingly in the mid-90s with network firewalls and SSL for security mechanisms to defend websites, but that is about as far it got. In 1999 when SOAP emerged as a firewall-friendly protocol designed for the explicit reason to go through the firewall, that should have been a wake up call to Information Security that the "firewall + SSL" security architecture was past its prime, but here 10 years later we are still hitting the snooze button.

My view is that as technology is deployed we need security mechanisms that form fit to those new technologies, instead what we have is security technologies that form fit to auditor's excel spreadsheets.

Gunnar Peterson is a Managing Principal at Arctec Group. He is focused on distributed systems security for large mission critical financial, financial exchanges, healthcare, manufacturer, and insurance systems, as well as emerging start ups. Mr. Peterson is an internationally recognized software security expert, frequently published, an Associate Editor for IEEE Security & Privacy Journal on Building Security In, a contributor to the SEI and DHS Build Security In portal on software security, a Visiting Scientist at Carnegie Mellon Software Engineering Institute, and an in-demand speaker at security conferences. He maintains a popular informationsecurity blog at http://1raindrop.typepad.com.

• 19h45 - 20h00: Break
  
• 20h00 - 21h30: Threat modeling (by John Steven, Cigital)
  

How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management. Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.

John Steven is Senior Director of Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted adviser to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine and speaks with regularity at conferences and trade shows. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.

John leads the Virginia OWASP Northern Virginia (NoVA) chapter.