This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Projects/Reports/2013-20-12

From OWASP
Revision as of 20:32, 20 December 2013 by Samantha Groves (talk | contribs)

Jump to: navigation, search
OWASP Project Header.jpg

Metrics

  • Active Projects: 155
  • Inactive Projects: 102
  • Incubator Projects: 122
  • Lab Projects:18
  • Flagship Projects: 15

New OWASP Projects

Projects Under Review


  • Projects: 2014 Goals
    • I am currently working on putting together a 2014 Project Goals document.
    • This will be the roadmap of goals and operational projects that I will focus on for 2014.
    • I plan to send this out to the Leaders for feedback when it is complete.
    • Below are my high level goals for the year.
    • Goal 1: Continue developing the Operational Projects Platform into a more self sufficient platform.
    • Goal 2: Bring more Project Leaders together: Summits, AppSecs.
    • Goal 3: Solidify the Projects Review Process: Pragmatic method of doing project reviews.
    • Goal 4: Design a more sustainable revenue stream for Projects.
    • I plan on having this document completed by the end of December.
  • Post Project Summit Report
    • I continue to gather information for the Post Project Summit Report.
    • I am using the 2011 Project Summit report as a rough outline to follow for the 2013 report.
    • This will be completed and shared to the community by the end of the month.
  • 2014 Project Summit
    • I continue to work on seeking out sponsorship opportunities for the 2014 Project Summit.
    • More to come after the holidays.
  • Daily Project based queries and requests
    • This has not changed much since I began the post: questions are very similar in nature.
    • Global AppSec questions.
    • Funding queries.
    • Travel availability.
    • Project based administrative help.
    • Project status information.
    • Several project donation questions.
    • Marketing questions.
    • Grant funding questions.
    • OWASP social media updates.
    • What's happening with projects, questions.

General Awards

  • OWASP OWTF Project: Brucon 5x5 Award
  1. Amount: €5,000.00 (Approx. $6,670.00)
  2. Status: Awarded. Congratulations, Abraham Aranguren and all involved in the project, for your award.

Proposals Awarded

  1. Amount: $25,000 USD
  2. Status: Awarded. The first payment has been allocated to our project budgets. The second invoice has now been sent to Georgia Tech and payment has been received.
  3. OWASP Development Guide Plan
  4. OWASP Testing Guide Plan
  5. OWASP Code Review Guide Plan
  • Google Grants Proposal
  1. Amount: $120,000 USD in Adwords Funds
  2. Status: Awarded.
  3. Note: There is no link to show the proposal for this grant. There was a form that was submitted to Google, and we did not receive a record of this form.
  • Google Summer of Code
  1. Amount: $5,500
  2. Status: Awarded
  • Projects breakdown:
    • 4 ZAP Projects: $2,000
    • 4 OWTF Projects: $2,000
    • 1 PHP Security Project: $500
    • 1 Hackademics Project: $500
    • 1 Modsecurity Project: $500
    • Note: Big thank you to Fabio Cerullo for coordinating and managing this award.
  1. Amount: $15,000 USD
  2. Status: Awarded.
  • Total Funds Awarded: $172,170 USD for 2013.

Proposals Denied

  • European Commission Grant Proposal
  1. Amount: €250,000
  2. Status: Denied.
  1. Amount: $112,000 USD
  2. Status: Denied
  1. Amount: $25,000 USD
  2. Status: Denied
  1. Amount: $30,000 USD
  2. Status: Denied
  1. Amount: $55,800 USD
  2. Status: Denied

Current Project Funds

Message from OWASP ESAPI Project Leaders, Kevin Wall & Chris Schmidt

ESAPI Hackathon / Bug Bash Contest

Our very own OWASP ESAPI Project Leaders, Chris Schmidt and Kevin Wall, are hosting the OWASP ESAPI Hackathon starting on Friday, December 20th 2013 and ending on Monday, January 20th 2014. The aim of the ESAPI Hackathon is to encourage contributors to Implement modular security controls, fix existing bugs, provide reference implementations, and improve user documentation.

Each participant will be evaluated by four judges, and prizes will be awarded to those who provide the most valuable contribution to the project. Here are the list of prizes:

  • First place: Apple iPad Mini and an ESAPI T-shirt
  • Second place: $30.00 (USD) Amazon Gift Card and an ESAPI T-shirt
  • Third place: $20.00 (USD) Amazon Gift Card and an ESAPI T-shirt
  • Fourth place: An ESAPI T-shirt

We encourage all those who can participate to contribute to the OWASP ESAPI Project. Please view the contributing guidelines wiki page for more detailed information on participant expectations. If you still require more assistance, please contact either, Kevin Wall ([email protected]) or Chris Schmidt ([email protected]).

Download a pdf version of the guidelines here.

Message from OWASP ZAP Project Leader, Simon Bennetts

I'm delighted to tell you that ZAP came top of the Toolswatch Best Security Tool of 2013: http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/

Also congrats to OWASP Xenotix and OWASP O-Saft who also made the top 10

Thank you to everyone who voted for ZAP and other OWASP projects!

Message from OWASP Media Project Leader, Jonathan Marcil

TLDR; 11k views and 450 subscribers!

As you all know, we did a lot of work at last AppSecUSA in order to get 43 videos online for 32 hours for the talks, and also 6 videos from the Project Summit for 2.5 hours of content. All of that was online live for the summit and 24h after for the first talks, then the rest was published in one week the week just after the conference.

I managed to get the Project Summit recording by myself, but for the talks, it wouldn't have been possible without the support from AppSecUSA who used their resources to help us with that. To make it clear, we had a professional firm that recorded and uploaded the videos into YouTube. The only work I did on my side was to organize them into a playlist and publish them periodically.

AppSecUSA 2013 playlist https://www.youtube.com/playlist?list=PLpr-xdpM8wG8ODR2zWs06JkMmlRiLyBXU

OWASP Projects Summit 2013 playlist https://www.youtube.com/playlist?list=PLpr-xdpM8wG80aEXBZV9lk5nkEf3q-jaz

On the fail part, we missed some of the important talks, such as the keynote because it was at the very beginning and also Jeremiah's talk that was a hit, but we achieved 77% publishing within one week. One thing that actually wasn't real good in the short run was that the title didn't contains "OWASP" nor "AppSecUSA". That will probably hurt us in the long run and I might decide to change titles if we don't come out first in search results (as for now we don't https://www.youtube.com/results?search_query=appsecusa).

We actually plan to do the same thing for AppSecUSA 2014 and I'll be in touch with the team in order to prepare in advance. They want to have live streaming and be as fast.

One thing that is sure, is that we need more people in OWASP Media project. The good news is, unlike most other OWASP projects, you don't need to be an application security specialist to be really useful, you just need to be motivated to share knowledge with the world. I think that

Now for some stats, covering from Nov 17 2013 to Dec 19 2013.

We are at 11,289 views and 79,874 of estimated watched minutes.

Let me remind you that before that, we where at 245 views for 1,312 minutes, mainly from the OWASP Global Meetings live hangouts.

We are at 438 subscribers and we gained 442 of them with AppSecUSA efforts. We lost 4 hence the numbers.

The average view duration is 7:04 minutes, so 16% of the total times of videos. Since we have mostly one hour long videos, this is normal and in fact is probably a great number.

Notables popular videos are OWASP Zed Attack Proxy - Simon Bennetts 2,126 views 17,712 minutes watched 8:19 avg http://youtu.be/pYFtLA2yTR8

Top Ten Proactive Controls - Jim Manico 845 views 8,293 minutes watched 9:48 avg http://youtu.be/Cg5dN8Pyn_c

What You Didn't Know About XML External Entities Attacks - Timothy Morgan 790 views 5,857 minutes wathced 7:24 avg http://youtu.be/eHSNT8vWLfc

From what I saw, Simon's used his network to publish his videos and I helped him by putting it as the trailer for the channel for a while. Same with Jim but with less engagement from his network (less comments). Timothy's was published from an external news website and got some views trough that.

Finally, the following countries were the top viewership : United States 37% Canada 12% India 4.5% United Kingdom 4.0%

I must point out that we were watched in 114 countries. That's amazing and shows the power of OWASP worldwide.

With that big first step done, we will continue with our roadmap https://www.owasp.org/index.php/OWASP_Media_Project#tab=Roadmap and the next thing on the table is to present a Webinar on how to use Google Hangout and try to setup the next webinars within our YouTube channel. I also want to shake things with the Chapters by incite them to use Hangout and YouTube in order to get more into the Global Chapter Meetings Project. This has great potential but is not really used right now for helping smaller chapters to get contents.

And and last, but not least, we are officially on the www.owasp.org homepage and we can control what is shown trough that small playlist: https://www.youtube.com/playlist?list=PLpr-xdpM8wG9g8l21uzfgyx4xAJ9aY7e7

Thanks to all who contributed and helped with OWASP Media Project,

See you next year!


"OWASP 24/7" with Mark Miller is a series of recorded broadcasts, highlighting OWASP projects and people from around the world. With over 43,000 members in 100 countries, the OWASP 24/7 channel is available on demand, at anytime, anywhere on the planet. You are welcome to embed the broadcasts on your page, download them for your personal listening or keep up to date by subscribing to the iTunes channel. Please view the Podcast Project page for a list of current interviews.


View All Available Broadcasts or choose one of our new single episodes below:


Upcoming interviews

  • Kevin Wall (ESAPI)
  • Jim Manico (OWASP Podcast Series)
  • Larry Conklin (Code Review Project)
  • Andrew van der Stock (Pro-Active Controls)
  • Andrew van der Stock
  • Larry Conklin
  • Chetan Karande - Node.jsGoat
  • Mark Arnold - OWASP Boston Chapter Lead
  • Mike McCabe, Ben Johnson
  • Rafael Gil
  • Seba Deleersnyder
  • Josh Corman
  • Ryan Berg


Retrieved from "https://wiki.owasp.org/index.php?title=Projects/Reports/2013-20-12&oldid=165030"