ESAPI Summit

Summit 2011

Summit Overview

The ESAPI Summit will be held on September 21, 2011 at OWASP AppSec USA 2011 in Minneapolis, Minnesota.

Agenda

Start	End	Topic	Description	Deliverables
0900	0930	Mission Briefing	Brief summary of where we've been, administrative changes, and outlining the goals and purpose of the Summit	n/a
0930	1030	The ESAPI Specification 1.0	Review the high level API and determine what methods should remain as core API's and what should be moved upstream to higher level API's (ie ESAPI-Web, ESAPI-Mobile, etc)	ESAPI Specification Overview
1030	1045	Coffee Break
1045	1200	The ESAPI Specification 1.0	Continuation of the API Specification
1200	1300	Lunch Break and Open Conversation (Provided by OWASP/ESAPI)
1300	1400	The ESAPI Roadmap	Take a look at the existing Roadmap, create the roadmap for the next several release cycles.	ESAPI Roadmap
1400	1500	ESAPI Policies	Formally define how to processes for contributers, community, sponsors, submitting issues, reporting security vulnerabilities	ESAPI How To Contribute ESAPI Community Contributions ESAPI Sponsoring ESAPI Submitting Issues ESAPI Vulnerability Reporting
1500	1630	ESTAPI Framework	How do we test and ensure that implementations meet the specifications defined in the API in a cross-platform and demonstratible manner?	ESAPI Testing Framework
1630	1645	Coffee Break
1645	1745	Documentation	Identify a Roadmap for ESAPI Documentation. Elect someone to champion this cause and find resources to address the documentation needs. Determine funding levels and budget needed for documentation to happen.	ESAPI Documentation Roadmap ESAPI Documentation Sub-Project ESAPI Documentation Sub-Project Budget
1745	1800	Mission De-Briefing	We have accomplished a lot in the last 3 years as a team. This will be a quick wrap-up by Chris on the 2nd ESAPI Summit Day.	n/a
1800	????	ESAPI 2.0GA Release Celebration	Celebrate the release of ESAPI 2.0GA (and beyond) with beers with the ESAPI Team (Sponsors: TBA)	n/a

Attending the ESAPI Summit

If you are planning to attend this summit, please list your name below so that we can ensure that we have adequate space and materials for everyone.

• Chris Schmidt - Meeting Leader
• Jim Manico - ESAPI Project Manager
• jOHN Steven - Cigital Principal, ESAPI Malcontent

Summit 2008

Summit Overview

The first OWASP ESAPI Summit was held December 9-11, 2008. It was hosted by Aspect Security in their Columbia, MD office.

The following were the attendees of the Summit:

• Jeff Williams, Aspect Security - ESAPI Project Lead
• Dave Wichers, Aspect Security - ESAPI Java Committer
• Ron Monzillo, Sun Microsystems - Java EE Security Architect
• Arshan Dabirsiaghi, Aspect Security - OWASP Intrisic Security Working Group Chair
• Jerry Hoff, Aspect Security
• Mike Fauzy, Aspect Security
• Kevin Fealey, Aspect Security - ESAPI Swingset Lead
• Jim Manico, Aspect Security - ESAPI Java Committer
• Steve Lavenhar, Booz Allen Hamilton
• Lian Jin, Booz Allen Hamilton
• John Steven, Cigital, Technical Director
• Joel Winstead, Cigital
• Alex Smolen, Foundstone - ESAPI .NET Lead
• Andy Miller, Lockheed Martin
• John Munsch, Lockheed Martin
• Steve Christey, MITRE - CVE/CWE Project Lead

The following pages contain our thoughts/results from the summit.

Summary: TODO

Links

• ESAPI Charter
• ESAPI Roadmap
• ESAPI Adoption Strategy
• ESAPI Framework Strategy
• ESAPI Assurance
• ESAPI Documentation
• ESAPI Marketing
• ESAPI Tooling
• ESAPI Static Analysis Support
• ESAPI Performance
• ESAPI Internationalization
• ESAPI Installation

Design

• ESAPI API

Features

• ESAPI Validation
• ESAPI Canonicalization
• ESAPI Encoding
• ESAPI Authentication
• ESAPI Session Management
• ESAPI Access Control
• ESAPI Encryption
• ESAPI Randomizer
• ESAPI Error Handling
• ESAPI Logging
• ESAPI Intrusion Detection
• ESAPI HTTP Protection
• ESAPI Utilities
• ESAPI Filters