This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Dublin
OWASP Ireland
Welcome to the Ireland chapter homepage. 
Participation
OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
Sponsorship/Membership
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
become a Member or Annual Chapter Sponsor(s).
Becoming a chapter sponsor means that you get your organisation mentioned in meeting promotion (including on this page), recognition at the beginning of the meeting and promotional material at the meeting.
We currently have the following sponsorship options available:
€250 for an individual meeting sponsorship
€1500 for annual chapter sponsorship
Contact any of the board members below for more information.
OWASP Ireland Board
Should you have a question about the local chapter, would like to get more involved contact ANY of the following people below
- Chapter Lead Fiona Collins
- Board Member/Global Board Member Eoin Keary
- Board Member Fabio Cerullo +353877817468
- Board Member Owen Pendlebury
- Board Member Darren Fitzpatrick
- Advisor Rahim Jina
OWASP Ireland
23 The Chandler, Rahtborne Village
Ashtown, Dublin 15, Ireland
Tel: +353877817468 | Fax: +353877817468
<paypal>Ireland</paypal>
OWASP Dublin Chapter 2014
OWASP May Event
| Chapter Event - Eoin Kearyof BCC Risk Advisory and Matej Saksida of Realex | |
| When | Where |
| Thursday 1st May Registration: 18:30 Talk: 19:00 |
Venue Location: TCube Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland |
| DESCRIPTION | |
| There will be networking afterwards, with beer and pizza thanks to BCC Risk Advisory (http://www.bccriskadvisory.com/) Talk 1: *"Top 10 defensive Java developer controls"* Eoin Keary - BCC Risk Advisory - (http://ie.linkedin.com/in/eoinkeary) OWASP board member since 2009. Elected to position of global Vice Chair, September 2011. A long time member of OWASP. Based in Dublin and director of BCC Risk Advisory Ltd. Eoin Keary has been with OWASP since 2004. He is based in Ireland and runs a software security practice, bccriskadvisory.com. He is currently on the global board of the OWASP foundation, he was elected to the board in 2009. During this time Eoin assisted in founding the OWASP legal entity in Europe and has helped provide structure to OWASPs finances and strategy. Abstract: In this talk Eoin shall go through a list of developer controls in order to help prevent common security vulnerabilities such those focused in the OWASP Top 10 2013. From input validation to contextual output encoding to crypto-secure storage, Eoin shall call out what developers can do to help mitigate such issues. Many of the mitigations are simple and use established API's such that developer need not be security experts and just use core components to help improve their security posture. File:Top Ten Java Defenses.pdf
Talk 2: *"Social Engineering - The Art of Human Hacking".* Matej Saksida - Realex Payments - (http://ie.linkedin.com/pub/matej-saksida-cism/20/412/176) Abstract: Nowadays if you want to hack a corporation or damage a personal "enemy" fast, Social Engineering techniques work every time and more often than not it works the first time. In this talk Matej shall go through what is social engineering is, types of social engineering and related threats. Matej shall call out practical example how to use Facebook to ruin someone's life and what countermeasures can be used against social engineering attacks. | |
OWASP March Event
| Chapter Event - Rahim Jina of BCC Risk Advisory and Stephen Scott of Espion | |
| When | Where |
| Thursday 13th March Registration: 18:30 Talk: 19:00 |
Venue Location: TCube Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland |
| DESCRIPTION | |
| There will be networking afterwards, with beer and pizza thanks to Espion (http://www.espiongroup.com/)
Talk 1: Building a shield of security - Vulnerability Management by the numbers and dumb robots! Rahim Jina - BCC Risk Advisory Rahim has been an active member of OWASP since 2008 and has contributed to many projects such as the OWASP Security Code Review Guide and is an ex-board member of the Irish Chapter. Previously Rahim was a senior security consultant at a “big 4” professional services firm and more recently, the head of security for Fonality Inc, a VoIP service provider based in Los Angeles. Rahim is currently a director for BCC Risk Advisory (bccriskadvisory.com), based in Dublin, Ireland. He is also responsible for the security architecture of the edgescan.comvulnerability management solution. Abstract: This presentation discusses how builders, breakers and defenders should look at vulnerability management when attempting to keep hackers at bay. We discuss the most common vulnerabilities which are not detected by security tools nor automation but nevertheless are common and can be used to commit real fraud resulting in financial loss. We will see that Web Application Firewalls are ineffective against such attacks and why the only practical solution is to apply a layered approach across all aspects of the SDLC. File:BCC Risk Advisory - OWASP Dublin - Vulnerability Management by the numbers and dumb robots!.pdf Talk 2: "PCI's Changing Environment - What You Need to Know & Why You Need To Know It". Stephen Scott - Senior Consultant and PCI QSA in Espion's Information Government practice Stephen Scott, Consultancy Team lead in Espion, is an experienced information security, risk and compliance consultant whose experience spans across many different areas including, PCI DSS, information security, risk management, group internal audit, IT service management and regulatory compliance. Stephen has extensive experience with information security, internal control testing, compliance programmes, information risk management, and process improvement. Stephen has worked across a wide range of industry verticals, including financial, industrial and insurance. Abstract: PCI DSS – The Payment Card Industry Data Security Standard sets common requirements for securing payment card information (credit, debit, some gift cards), and lays out a range of controls relating to auditing, scanning and assessment. This presentation discusses the ever evolving PCI environment, specifically focusing on the changes in the recent release of version 3 of the PCI DSS standard. Stephen will start off by giving a brief background to PCI, including motivators for merchant and service providers to adhere to the standard. In addition to this, the presentation will highlight what security considerations are relevant to application and information security practitioners. File:PCIs Changing Environment - What You Need to Know & Why You Need To Know It..ppt
| |
OWASP Ireland 2013 Agenda
OWASP July Event
| Chapter Event - Jeremiah Grossman - Another Year in Web Security | |
| When | Where |
| Thursday 4th July Registration: 17:30 Talk: 18:00 |
Venue Location: TCube Venue Address: 32 - 34 Castle Street, Dublin 2, Ireland |
| DESCRIPTION | |
| Jeremiah Grossman of WhiteHat Security will be in Dublin and will be talking at our next chapter event. His talk "Another Year In Web Security: What did 2012 teach us about survival in the coming years?" promises a great insight into the future of web security.
Jeremiah Grossman, founder and CTO of WhiteHat Security, is a world-renowned expert in web application security and a founding member of the Web Application Security Consortium (WASC). At WhiteHat, Mr. Grossman is responsible for web application security R&D and industry evangelism. He is a frequent speaker at industry events including the BlackHat Briefings, ISACA's Networks Security Conference, NASA, ISSA and Defcon. A trusted media resource, Mr. Grossman has been featured in USA Today, the Washington Post, Information Week, NBC Nightly News, and many others. Mr. Grossman is also a featured expert and frequent contributor on TechTarget'sSearchAppSecurity.com. | |
OWASP June Event
| CONFERENCE AND TRAINING | |
OWASP Europe Tour - Dublin 2013Tuesday 25th June (Training. Info about the training session) | |
| DESCRIPTION | |
OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.
|
OWASP May Event
| TRAINING & TALKS | |
OWASP Dublin - Realex Payments Application Security WorkshopThursday 30th May | |
| DESCRIPTION | |
| Training
Eoin Keary will be delivering free application security training between 2pm and 5pm on the 30th May. Eoin was the founder of OWASP Ireland and is currently the global vice chair for OWASP (amongst many other things! https://www.owasp.org/index.php/Eoin_Keary). He has delivered application security training to many developers and security professionals around the world and recently delivered a training course to over 400 people at the RSA Conference. The training will focus on secure application development and why we can't hack ourselves secure. It will be covering why penetration testing on its own does not work approaches to improvement including "knowing what you don't know" and how to measure change. It will be technical training covering XSS eradication, client side security and browser DOM curiosities. Talks The talks will be starting at 6pm in our office and OWASP have arranged two very interesting talks! Diarmaid McManus https://twitter.com/elephant_rb from Realex Payments will be expanding his award winning SecurityBSides London Rookie Track talk https://www.securityninja.co.uk/application-security/securitybsides-london-esp-security-plugin/ to include more details about static analysis approaches and his research and development work on ESP: Security Plugin https://github.com/diarmaid-mcmanus/ESPSecurityPlugin. Hugh Pearse https://twitter.com/hughpearse will be talking about Low Level Exploits and this looks like it will be a great talk: “In 2010 Mr Haroon Meer from thinkst.com presented a timeline of memory corruption vulnerabilities and their mitigation techniques dating from 1985 to 2010. In his 35 page publication he referenced almost 150 events in low level information security history. The scope of the presentation "Low Level Exploits" is to explain in detail some of the most significant attacks in from Haroon Meers research. The attacks covered in this presentation include buffer overflows on the stack, heap overflows, integer overflows, format strings, null pointers and ROP chains. This brings us to exploits in the present day where researchers are looking for the successor of the buffer overflow attack, next big exploit.” |
OWASP Ireland 2011 Agenda
Ireland/Training/OWASP projects and resources you can use TODAY
- Overview & Goal
- Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle.
- This course aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.
- The course will be very practical where demonstration and hands-on exercises will be provided for the tools covered.
- If you are interested in participating in the hands on portion of the course, please bring a laptop.
- Dates
- March, 2011, 11
- Course Main Content and Registration
OWASP Ireland 2010
Click OWASP IRELAND 2010 for more information
OWASP Ireland 2010 Agenda
AUG 2010
OWASP August Event
When: 11/8/2010 6:00pm - 8:00pm
Where: Ernst & Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland
Sponsors: 
Title: OWASP ESAPI Swingset: Introduction & Demo by Cathal Courtney
Abstract: The ESAPI Swingset is a web application which demonstrates common security vulnerabilities and asks users to secure the application against these vulnerabilities using the ESAPI library. The application is intended for Java Developers. The goal of the application is to teach developers about the functionality of the ESAPI library and give users a practical understanding of how it can be used to protect web applications against common security vulnerabilities. During the talk, Cathal will demonstrate how to install and use ESAPI Swingset in your organization. A copy of the latest version will be also provided to the attendees.
Presenter: Cathal is an experienced developer working at AIB and is currently the ESAPI Swingset project leader. More information about this project could be found here: Esapi SwingSet
Download Presentation: Not available
Title: Security Implications for Web Applications based on SOA by John Marmelstein
Abstract: The main point of SOA (in this context) is combining systems and applications to make new applications, or a big 'overall' application.This higher inter-operability does (by default) lower security. For a start, a request originating from a web user might end up at several back end systems, which do not know who or what the request came from.
Each back end system might have no access to the customer data, have a different security models, and serve serveral front end. Each of the above systems could be under different ownership, thus the owners have different concerns and priorities. Also, the basic solution at a technical level include single sign on, or security as a service. This can be costly, give limited coverage and have a performance hit. But is pretty much the only way to do it. The other thing to do (probably in tandem) is strict management, and delegation of authority.
Presenter: John has about 13 years in IT. Most of this in distributed systems and 'Middleware' integration software. Including BEA (now owned by Oracle). Mainly working on Enterprise Java and more recently on Microsoft BizTalk. Various industries, incuding financials, public services, and a fish farm.
Download Presentation:
APPSEC IRELAND INFORMAL MEET-UP
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
When: TBD
Where: TBD
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
SEP 2010
APPSEC IRELAND 2010
Due to popular demand we are hosting the 2nd OWASP IRELAND event, OWASP Ireland 2010.
Continuing last years highly successful conference, with more than 150 attendees from across the globe OWASP is happy to repeat this positive experience.
Delegates from numerous industry verticals attended the 2009 event; from government to finance to telecoms. Share your thoughts at this open event with some of the most experienced individuals in the information security industry.
When: September 17th 2010
Where: Trinity College Dublin, The Hamilton Building
Sponsors: In case you want to sponsor this event, please contact Eoin Keary.
Subscribe to the OWASP Ireland mail list for the up-to-date information.
OCT 2010
APPSEC IRELAND INFORMAL MEET-UP
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
When: TBD
Where: TBD
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
NOV 2010
APPSEC IRELAND INFORMAL MEET-UP
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
When: TBD
Where: TBD
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
DEC 2010
APPSEC IRELAND INFORMAL MEET-UP
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
When: TBD
Where: TBD
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
2010 Chapter Plan
Special Project:Educational Outreach
Summary: Drive education awareness of OWASP among Irish Universities and Third Level Institutions.
Plan: <insert plan>
Next Milestone: Update the plan
Participants: Fabio Cerullo
Special Project:Industry Outreach
Summary: Raise awareness of OWASP among Irish industry.
Plan: <insert plan>
Next Milestone: Update the plan
Participants: Eoin Keary
Special Project:Membership Drive
Summary: Increase local chapter members individuals and corporate supporters
Plan: <insert>
Next Milestone: Update the plan
Project Participants: Rahim Jina
Special Project:Hands-On Training
Summary: Provide 1-day, 3-day and 5-day hands-on classroom / online training classes
Next Milestone: Organize Training Offerings
Project Participants: Fabio Cerullo
Call For Presentations for 2010 is now open - please contact fcerullo(@)owasp.org / +353877817468 if you would like to speak or can host a meeting.
*Note meeting hosts are provided with annual chapter sponsorship and free seats in training classes. The OWASP Foundation, Ireland chapter focuses on implementation of efforts defined by the Global Committee as well as new concepts and ideas defined locally. Below are a list of ACTIVE projects assigned to individual active members and teams within the local chapter. If you would like to help out on ANY of these efforts, contact them directly to get involved
FEB 2010
OWASP Ireland Event - What is the O2 Platform?
When: 19/2/2010 3:00pm - 5:00pm
Where: Ernst & Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland
Sponsors:
Title: OWASP O2 Platform - Open Platform for automating application security knowledge and workflows
Abstract: In this talk Dinis Cruz will show the OWASP O2 Platform which is an open source toolkit specifically designed for developers and security consultants to be able to perform quick, effective and thorough 'source-code-driven' application security reviews. The OWASP O2 Platform (http://www.owasp.org/index.php/OWASP_O2_Platform) consumes results from the scanning engines from Ounce Labs, Microsoft's CAT.NET tool, FindBugs, CodeCrawler and AppScan DE, and also provides limited support for Fortify and OWASP WebScarab dumps. In the past, there has been a very healthy skepticism on the usability of Source Code analysis engines to find commonly found vulnerablities in real world applications. This presentation will show that with some creative and powerful tools, it IS possible to use O2 to discover those issues. This presentation will also show O2's advanced support for Struts and Spring MVC.
Presenter: Dinis Cruz is a Security Consultant based in London (UK) and specialized in: ASP.NET/J2EE Application Security, Application Security audits and .NET Security Curriculum Development. For the past years Dinis has focused on the field of Static Source Code analysis, from May 2007 to Dec 2009 he worked as a independent consultant for Ounce Labs (bought by IBM in July 2009) where during active security engagements using Ounce's technology he developed the Open Source codebase which now is the foundation of the OWASP O2 Platform. Dinis is currently focused on making the O2 Platform the industry standard for consuming, instrumenting and data-sharing between the multiple WebAppSec tools, the Security consultants and the final developers. Dinis is a also active trainer on .Net security having written and delivered courses for IOActive, Foundstone, Intense School and KPMG (at multiple locations including BlackHat), and has delivered a number of presentations and keynote speeches at multiple OWASP and Security related conferences. At OWASP, Dinis is the leader of the OWASP O2 Platform project, member of the OWASP Global Projects Committee, chair of the OWASP Connections Committee and member of the OWASP Board.
Download Presentation: http://www.o2-ounceopen.com/files-binaries-source-and-demo/old-documents-and-presentations/OWASP_O2_Platform_-_AppSec_Ireland_Sep_2009.pdf
IISF/OWASP – February Chapter Meeting
When: 25/2/2010 2:00pm - 4:00pm
Where: Georgian Suite, Buswells Hotel, Molesworth St., Dublin 2
Title: An overview of Web Application Security threats and technologies. Practical advice and techniques for improving Application Security, presented by OWASP.
2:00 - Introduction by IISF Chairman
2:05 - Presentation : “Practical advice for improving Application Security” - Introduction to OWASP and OWASP Top Ten - Demonstration video of typical web based attacks with high level explanation - Live SQL injection demo using WebGoat & WebScarab - Live Cross Site Scripting demo using WebGoat & WebScarab
Download Presentation: File:IISF 250210 part1.ppt
3:00 - Coffee
3:20 – Presentation continues - Application Security: "The problems we are faced with" - The Application Security Verification Standard - SDLC & Security Assurance Maturity Model - Code Review versus traditional Runtime Testing. - Q&A
Download Presentation: File:IISF 250210 part2.pptx
4:00 - Close of Meeting
4:05 - Traditional networking in Buswells Bar
MAR 2010
APPSEC IRELAND INFORMAL MEET-UP - 26/3/2010
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
When: TBD
Where: TBD
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
APR 2010
OWASP Live CD - An open environment for Web Application Security
When: 16/4/2010 2:30pm - 5:00pm
Where: Ernst & Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland
Sponsors:
Title: OWASP Live CD - An open environment for Web Application Security
Abstract: This CD collects some of the best open source security projects in a single environment. Web developers, testers and security professionals can boot from this Live CD and have access to a full security testing suite. This presentation aims to provide a showcase for the great OWASP tools and documentation materials available in the CD, tips and tricks, and also some introductory stuff regarding code review and penetration testing.
Training is aimed at introductory /intermediate level in terms of pen testing, code review and tools.
Presenters:
Rahim Jina
Rahim Jina currently works as a senior consultant for Ernst & Young's Risk Advisory Services in Dublin. He has worked there for nearly four years primarily delivering penetration testing services to clients globally, focusing on web applications and secure code review. He has been involved with OWASP for the past two years, being involved in the Summer of Code 2008 as lead reviewer for the Code Review Guide 2009. He has also made contributions to the SAMM project (OpenSAMM). He holds an MSC in Security and Forensic Computing from DCU and a degree in computer science from Trinity college.
Eoin Keary
Eoin is a long time member of OWASP and have contributed year on year to OWASP projects and the OWASP mission of fighting the causes of software insecurity. He is based in Dublin, Ireland and run the Ernst & Young application security team across Europe. His OWASP contributions to date include the OWASP Code Review Guide, OWASP Testing Guide, OWASP SAMM, and OWASP ASVS. He is a member of the OWASP Global Industry Committee, chair of the OWASP Conferences Committee and member of the OWASP Global Board. Eoin founded the OWASP Ireland chapter back in 2004 and currently serves as Vice President of the OWASP Ireland Board.
Pictures from the event:
Download Presentation: [[Image:|Download.png]]
APPSEC IRELAND INFORMAL MEET-UP
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
Where: Odeon Pub
When: After OWASP Live CD training
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
MAY 2010
OWASP Event: Trials & Tribulations of WAF Implementation
When: 20/5/2010 6:30pm - 7:30pm
Where: Ernst & Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland
Sponsors:
Title: Trials & Tribulations of WAF Implementation
Abstract: A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-site Scripting (XSS) and SQL Injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
Mark will be presenting on his experience in implementing a Web Application Firewall solution through all phases from research to implementation.
Presenters:
Mark Hillick - Application Networking Team, Citrix Systems
Mark Hillick has 10 years experience in relation to Internet, networking, systems administration and security engineering.
Mark graduated from Queen's University, where he studied Mathematics.
Mark joined AIB from Queen's where he joined the Internet Infrastructure team, where he was responsible for designing, building and securing the Internet service in and out of AIB. He is a prominent member of the IT Security community in Ireland and has presented at several local security forums such as IISF and Owasp. Mark is one of the founding members of IRISS CERT, where he is also a Volunteer Incident Handler. He helped organise IRISSCon 2009, where he also designed and built HackEire 2009, the first Ethical Hacking 'Capture The Flag' contest in Ireland.
Pictures from the event:
Download Presentation: [[Image:|Download.png]]
APPSEC IRELAND INFORMAL MEET-UP
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
Where: Odeon Pub
When: After WAF presentation
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
JUN 2010
OWASP Event: Define Security Requirements - A practical approach
When: 20/5/2010 6:30pm - 7:30pm
Where: Ernst & Young, Harcourt Street, Dublin 2, Opposite the Odeon Pub, Dublin, Ireland
Sponsors:
Title: Define Security Requirements - A practical approach
Abstract: The Data Protection Act states that "appropriate security measures" must be taken to protect personal data. How do you specify the appropriate security measures for a website which processes personal data? It is an important step in a development project, but is often neglected. In this talk, Alexis will descibe his own experiences of assessing web application, and will also look in more detail at what the Data Protection Commissioner says. He will then take a fictional website and look at a practical approach to specifying the security requirements that the fictional application should meet. This will use the kind of risk-based techniques outlined by OWASP or the Microsoft Secure Development Lifecycle (SDL). Issues discussed will include encryption, authentication, access control, audit, etc. The result will be a list of security requirements that can be carried into the design and development phases. Attendees should be able to apply the ideas to their own development projects.
Presenters:
Alexis Fitzgerald - Rits Information Security Group
For the last six years Alexis has worked for Rits Information Security Group, where he performs application penetration testing assignments as well as advising clients on application security issues. Before that, he spent many years as a developer (mainly in the financial sector), and he continues to be involved in development. Alexis holds an MSc in Information Security from the University of London, Royal Holloway.
Pictures from the event:
Download Presentation: File:OWASP Ireland June10.pdf
APPSEC IRELAND INFORMAL MEET-UP
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
When: After Alexis presentation
Where: Odeon Pub
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
JUL 2010
APPSEC IRELAND INFORMAL MEET-UP
This is a informal gathering to meet others in information security and have a pint ;) all are welcome
When: TBD
Where: TBD
Sponsors: In case you want to sponsor this event, please contact Fabio Cerullo.
