AppSecUSA 2012

AppSec USA 2012 — LASCON Edition, TX
Austin, TX at the Hyatt Regency Hotel Downtown
Training: October 23rd-24th — Conference Sessions: October 25th-26th

OWASP AppSec conferences bring together industry, government, security researchers, and practitioners to discuss the state of the art in application security.

For more information on CFP, CFT, Sponsorship, and registration, see the official AppSec USA website at http://www.appsecusa.org

AppSec USA 2012 Presentations and Talks

Thursday 25th Oct

10:00 am - 10:45 am (Thursday)

---

Building Predictable Systems using Behavioral Security Modeling: Functional Security Requirements John Benninghoff | Developer | Building Predictable Systems using Behavioral Security Modeling - PDF
Top Ten Web Defenses Jim Manico | Mobile | Top 10 Defenses for Website Security - PDF
Mobile Applications & Proxy Shenanigans Dan Amodio | Mobile | Presentation not available
Reverse Engineering “Secure” HTTP APIs With An SSL Proxy Alejandro Caceres | Reverse Engineering | Presentation not available
Gauntlt: Rugged by Example Jeremiah Shirk | Rugged devops | Presentation not available

11:00 am - 11:45 am (Thursday)

---

Building a Web Attacker Dashboard with ModSecurity and BeEF Ryan Barnett | Attack | Presentation not available
Secure Code Reviews Magic or Art? A Simplified Approach to Secure Code Reviews Sherif Koussa | Developer | Presentation not available
Cracking the Code of Mobile Application Sreenarayan Ashokkumar | Mobile | Cracking the Mobile Application Code - PDF
Hacking .NET Application: Reverse Engineering 101 Jon Mccoy | Reverse Engineering | Presentation not available
Doing the unstuck: How Rugged cultures drive Biz & AppSec Value Josh Corman | Rugged devops | Doing the unstuck: How Rugged cultures drive Biz & AppSec Value - PDF

2:00 pm - 2:45 pm (Thursday)

---

Hacking with WebSockets Vaagn Toukharian | Attack | Presentation not available
Bug Bounty Programs Michael Coates, Chris Evans, Jeremiah Grossman, Adam Mein, Alex Rice | Developer | Presentation Not available
How we tear into that little green man Mathew Rowley | Mobile | Presentation not available
AppSec Training, Securing the SDLC, WebGoat.NET and the Meaning of Life Jerry Hoff | Developer | Presentation not available
Put your robots to work: security automation at Twitter Justin Collins, Neil Matatall, Alex Smolen | Rugged devops | Presentation Not available

3:00 pm - 3:45 pm (Thursday)

---

Exploiting Internal Network Vulns via the Browser using BeEF Bind Michele Orru | Attack | Presentation not available
The Diviner - Digital Clairvoyance Breakthrough - Gaining Access to the Source Code & Server Side Memory Structure of ANY Application (OWASP ZAP extension) Shay Chen | Developer | Gaining Access to the Source Code & Server Side Memory Structure of ANY Application - PDF
Demystifying Security in the Cloud: AWS Scout Jonathan Chittenden | Cloud | Demystifying Security in the Cloud - PDF
I>S+D! - Interactive Application Security Testing (IAST), Beyond SAST/DAST Ofer Maor | Developer | Presentation not available
Rebooting (secure) software development with continuous deployment Nick Galbreath | Rugged devops | Presentation not available

4:00 pm - 4:45 pm (Thursday)

---

Cross Site Port Scanning Riyaz Walikar | Attack | Cross Site Port Scanning - PDF
Analyzing and Fixing Password Protection Schemes John Steven | Developer | Presentation not available
Static Analysis of Java Class Files for Quickly and Accurately Detecting Web-Language Encoding Methods Arshan Dabirsiaghi, Alex Emsellem, Matthew Paisner | Attack | Presentation not available
WTF - WAF Testing Framework Yaniv Azaria, Amichai Shulman | Architecture | WAF Testing Framework - PDF
DevOps Distilled: The DevOps Panel at AppSec USA Josh Corman, Nick Galbreath, Gene Kim, David Mortman, James Wickett | Rugged devops | DevOps Distilled - PDF

Friday 26th Oct

10:00 am - 10:45 am (Friday)

---

Effective approaches to web application security Zane Lackey | Developer | Effective approaches to web application security - PDF
Why Web Security Is Fundamentally Broken Jeremiah Grossman | Developer | Why Web Security Is Fundamentally Broken - PDF
Payback on Web Attackers: Web Honeypots Simon Roses Femerling | Architecture | Presentation not available
Spin the bottle: Coupling technology and SE for one awesome hack David Kennedy | Attack | Presentation not available
Incident Response: Security After Compromise Richard Bejtlich | Case Studies | Presentation not available

11:00 am - 11:45 am (Friday)

---

The Same-Origin Saga Brendan Eich | Developer | The Same-Origin Saga - PDF
Hack your way to a degree: a new direction in teaching application security at universities Konstantinos Papapanagiotou | Developer | Hack your way to a degree - PDF
The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems Dan Cornell, Josh Sokol | Architecture | Presentation not available
Blended Threats and JavaScript: A Plan for Permanent Network Compromise Phil Purviance | Attack | Presentation not available
Unbreakable Oracle ERPs? Attacks on Siebel & JD Edwards Juan Perez-Etchegoyen, Jordan Santarsieri | Case Studies | Presentation not available

1:00 pm - 1:45 pm (Friday)

---

Builders Vs. Breakers Brett Hardin, Matt Konda, Jon Rose | Developer | Builders-vs-Breakers - PDF
Real World Cloud Application Security Jason Chan | Cloud | Presentation not available
NoSQL, no security? Will Urbanski | Architecture | Presentation not available
SQL Server Exploitation, Escalation, and Pilfering Antti Rantasaari, Scott Sutherland | Attack | Presentation not available
Iran's real life cyberwar Phillip Hallam-Baker | Case Studies | Iran’s Real Life Cyberwar - PDF

2:00 pm - 2:45 pm (Friday)

---

Get off your AMF and don’t REST on JSON Dan Kuykendall | Developer | Get off your AMF and don’t REST on JSON - PDF
Unraveling Some of the Mysteries around DOM-Based XSS Dave Wichers | Developer | Unraveling some Mysteries around DOM-based XSS - PDF
Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs Tobias Gondrom | Architecture | Securing the SSL channel against man-in-the-middle attacks - PDF
XSS & CSRF with HTML5 - Attack, Exploit and Defense Shreeraj Shah | Attack | Presentation not available
The Application Security Ponzi Scheme: Stop paying for security failure Jarret Raim, Matt Tesauro | Case Studies | Presentation not available

3:00 pm - 3:45 pm (Friday)

---

Using Interactive Static Analysis for Early Detection of Software Vulnerabilities Bill Chu | Developer | Static Analysis for Early Detection of Software Vulnerabilities - PDF
Origin(al) Sins Alex Russell | Developer | Presentation not available
The 7 Qualities of Highly Secure Software Mano 'dash4rk' Paul | Architecture | 7 Qualities of Highly Secure Software - PDF
Web Framework Vulnerabilities Abraham Kang | Attack | Web App Framework Based Vulnerabilies - PDF
Web App Crypto - A Study in Failure Travis H | Case Studies | Web App Cryptology A Study in Failure - PDF

4:00 pm - 4:45 pm (Friday)

---

Security at Scale Yvan Boily | Developer | Presentation not available
Four Axes of Evil HD Moore | Developer | Four Axes of Evil - PDF
Pining For the Fjords: The Role of RBAC in Today's Applications Wendy Nather | Architecture | Presentation not available
Counterintelligence Attack Theory Fred Donovan | Attack | Presentation not available
Top Strategies to Capture Security Intelligence for Applications John Dickson | Case Studies | Top Strategies to Capture Security Intelligence for Applications - PDF