This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Austin
OWASP Austin
Welcome to the Austin chapter homepage. The chapter leadership includes: Kyle Smith, President, James Wickett, Conference Chair,Josh Sokol, Board Member
Participation
OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
Sponsorship/Membership
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
- Upcoming Events
- Record Hall of Meetings
- Presentation Archives
- Austin OWASP Chapter Leaders
- Sponsorship Opportunities
- Local News
OWASP Austin March Chapter Meeting - April 28th
When: Tuesday, April 28th @ 11:45 - 1PM
Title: Using OpenSAMM for Benchmarking and Software Security Improvement
We all know that behind every breach story in the press is an organization that probably should have done more to build secure software. Yet, organizations struggle mightily to focus resources on building software securely from the outset and, as a result, software security remains an after the fact “nice to do” and not a “have to do” activity in many organizations. How can organizations determine the right sets of activities or appropriate resource allocation levels that it should undertake to adequately address software risk? Organizations can make these determinations by benchmarking via OWASP’s Open Software Assurance Maturity Model (OpenSAMM) framework.
A coalition of leading application security industry vendors recently contributed benchmarking data in order to enhance OpenSAMM and its assessment framework. These efforts will enable organizations to step up their software security game and identify hurdles by using OpenSAMM as a powerful benchmarking tool. John will provide details on an ongoing industry effort to improve OpenSAMM by providing more comparative data to encourage broader use throughout industry.
Speaker: John Dickson
John Dickson is an internationally recognized security leader, entrepreneur and Principal at Denim Group, Ltd. He has nearly 20 years hands-on experience in intrusion detection, network security and application security in the commercial, public and military sectors. As a Denim Group Principal, he helps executives and Chief Security Officers (CSO’s) of Fortune 500 companies and government organizations launch and expand their critical application security initiatives. His leadership has been instrumental in Denim Group being honored by Inc. Magazine as one of the fastest growing companies in the industry for five years in a row.
A former U.S. Air Force officer, Dickson served in the Air Force Information Warfare Center (AFIWC) and was a member of the Air Force Computer Emergency Response Team (AFCERT). Since his transition to the commercial arena, he has played significant client-facing roles with companies such as Trident Data Systems, KPMG and SecureLogix Corporation.
Dickson is a popular speaker on security at industry venues including the RSA Security Conference, the SANS Institute, the Open Web Application Security Project (OWASP) and at other international security conferences. He is a sought-after security expert and regularly contributes to Dark Reading and other security publications. He also regularly contributes to the Denim Group blog where he writes about key security industry issues such as software security and cyber security policy. A Distinguished Fellow of the International Systems Security Association, he has been a Certified Information Systems Security Professional (CISSP) since 1998.
Dickson is currently the Chairman of the San Antonio Chamber of Commerce Cyber Security Committee where economic development, workforce and advocacy issues involving San Antonio’s growing cyber security industry are coordinated. Dickson is also a member of the prestigious Texas Business Leadership Council, the only statewide CEO-based public policy organization that serves as a united voice for the state’s senior executives to participate in the legislative and regulatory process. Most recently, he was the past Chairman of the Texas Lyceum, a leadership group that prepares leaders for the State of Texas and served as Chairman of the North San Antonio Chamber of Commerce. He also served as the local President of the Information Systems Security Association and was an honorary commander of the 67th Cyber Space Wing which organizes, trains and equips cyberspace forces to conduct network defense, attack and exploitation.
He holds a Bachelor of Science degree from Texas A&M University, a Master of Science degree from Trinity University and a Masters in Business Administration from the University of Texas in Austin. Dickson resides in San Antonio, Texas where he is married with two children.
Food: It will be a surprise! Please RSVP so we'll be sure to have enough for all!
Only those who RSVP will be eligible for any drawings/giveaways that may take place!
Location: National Instruments, 11500 N. Mopac.Building C
Or if you can not attend we should be broadcasting the meeting GoToMeeting --
RSVP:
Austin Security Professionals Happy Hour sponsored by iSEC Partners, May 14th
When: Thursday, May 14th, 5-7PM
Where: Sherlocks Street Pub and Grill 9012 Research Blvd
Sponsor: iSEC Partners
iSEC Partners is an expert full-service information security firm.
Our security assessments leverage our extensive knowledge of current security vulnerabilities, penetration techniques and software development best practices to enable customers to secure their applications against ever-present threats on the Internet. Primary emphasis is placed upon helping software developers build safe, reliable code.
iSEC Partners also provide extensive research in many information security areas such as; application attack & defense, web services, operating system security, privacy, storage network security and malicious application analysis.
iSEC Partners has been part of information assurance company, NCC Group plc, since October 2010.
RSVP: Eventbrite
Recent Meetings and Events
- April 9th, 2015 - 5:00pm to 7:00pm - Sherlocks @ 183 and Burnet - Austin Security Professionals Happy Hour sponsored by iSec Partners
- March 31st, 2015 - 11:30am to 1:00pm - National Instruments - OWASP Chapter Meeting - "Top 10 Web Hacking Techniques of 2014" by Matt Johansen
- March 11th, 2015 - 5:00pm to 7:00pm - Wyndam by Wingate - Austin Security Professionals Happy Hour sponsored by Alert Logic
- February 24th, 2015 - 11:30am to 1:00pm - National Instruments - OWASP Chapter Meeting - "Static Analysis: Beyond the Basics" by Andy Earle
- February 19th, 2015 - 5:00pm to 7:00pm - Sherlocks @ 183 and Burnet - Austin Security Professionals Happy Hour sponsored by Qualys
- January 27th, 2015 - 11:30am to 1:00pm - National Instruments - OWASP Chapter Meeting - 'CryptoParty!' with various speakers
- January 9th, 2015 - 5:00pm to 7:00pm - Sherlocks @ 183 and Burnet - Austin Security Professionals Happy Hour sponsored by Fishnet Security
- October 21st - 24th, 2014 - Lonestar Application Conference 2014
- September 30th, 2014 - 11:30am to 1:00pm - National Instruments - OWASP Chapter Meeting - 'Account Entrapment' by Ben Broussard
- September 11th, 2014 - 5:00pm to 7:00pm - Sherlocks @ 183 and Burnet - Austin Security Professionals Happy Hour sponsored by Set Solutions Inc.
- August 26th, 2014 - 11:30am to 1:00pm - National Instruments - OWASP Chapter Meeting - 'Identifying Web Attacks via Data Analysis' by Mike Sconzo
- August 14th, 2014 - 5:00pm to 7:00pm - Sherlocks @ 183 and Burnet - Austin Security Professionals Happy Hour sponsored by Trustwave
- July 29th, 2014 - 11:30am to 1:00pm - National Instruments - OWASP Chapter Meeting - 'Railsgoat' by Ken Johnson
- July 10th, 2014 - 5:00pm to 7:00pm - Sherlocks @ 183 and Burnet - Austin Security Professionals Happy Hour sponsored by iSEC Partners
Austin Security Professionals Happy Hour sponsored by iSEC Partners, April 9th
Sponsor: iSEC Partners
OWASP Austin March Chapter Meeting - March 31st
Title: Top 10 Web Hacking Techniques of 2014
Every year the security community produces a stunning number of new Web hacking techniques. Now in its 9th year, the Top 10 Web Hacking Techniques list encourages information and knowledge sharing and recognizes researchers who contribute excellent work. In this talk, we will do a technical deep dive and take you through the Top 10 Web Hacks of 2014, as picked by an expert panel of judges.
Speaker: Matt Johansen
Matt Johansen is a Senior Manager for the Threat Research Center at WhiteHat Security. He manages a team of Application Security Specialists, Engineers and Supervisors, to prevent website security attacks and protect companies' and their customers' data. He was previously a security consultant, where he was responsible for performing network and web application penetration tests. Johansen is also an instructor of Web Application Security at Adelphi University, where he received his Bachelor of Science in Computer Science, and San Jose State University. He has also been utilized by the SANS Institute as an industry expert for certification review.
Austin Security Professionals Happy Hour sponsored by Alert Logic, March 11th
Sponsor: Alert Logic
Alert Logic, the leading provider of Security-as-a-Service solutions for the cloud, provides security and compliance for cloud, hybrid, and on-premises data center infrastructure. Fully managed by a team of experts, Alert Logic’s Cloud Defender suite delivers the deep security insight and continuous protection needed to protect a company’s most sensitive data. Alert Logic provides network, system, and application protection for over 3,000 organizations worldwide. Built for cloud scale, the Alert Logic ActiveAnalytics platform manages over 5 petabytes of data, analyzes over 450 million events and identifies over 60,000 security incidents monthly that are managed by our security operations center.
OWASP Austin February Chapter Meeting - February 24th
Title: Static Analysis: Beyond the Basics
Static vulnerability analysis is the practice of testing non-running software for application vulnerabilities. It is often referred to as SAST, white box testing, or automated code review. In this session we will cover some of the hows and whys of static analysis and deep dive some of the common issues users of SAST technologies often encounter. Topics will include data flow analysis and taint propagation, scan noise, and partial code scanning, specifically around OWASP Top 10 issues. The material should provide value to anyone with an interest in application security, not just static analysis practitioners.
Speaker: Andy Earle
Andy Earle is a Security Solutions Architect for HP Enterprise Security Products (ESP). Andy has spent 5 years designing and delivering application security programs, technology, and services for US Federal and commercial customers, specifically around HP's Fortify appsec products. Andy was previously the product manager for a high assurance multi-level secure operating system at BAE Systems, and Presales Engineer for various web development and mobile security firms. Andy has spoken extensively on application security topics, most recently at OWASP's SnowFROC 2013, the RMISC conference, SANS AppSec 2013, and HP Protect. Early experience includes software engineering, mobile application development, and lifeguarding at his neighborhood pool. Andy is a CISSP and CSSLP, and has a B.S. in Systems Engineering from the University of Virginia.
Austin Security Professionals Happy Hour sponsored by Qualys, February 19th
Sponsor: Qualys
Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of cloud security and compliance solutions with over 6,700 customers in more than 100 countries, including a majority of each of the Forbes Global 100 and Fortune 100. The Qualys Cloud Platform and integrated suite of solutions help organizations simplify security operations and lower the cost of compliance by delivering critical security intelligence on demand and automating the full spectrum of auditing, compliance and protection for IT systems and web applications.
Qualys WAS (Web Application Scanning) Winner of Information Security™ magazine and SearchSecurity.com Readers' Choice Award in the “Best of Application Security 2014” category. Qualys WAS is a cloud service that provides automated crawling and testing of custom web applications to identify vulnerabilities. The automated service enables regular testing that produces consistent results, reduces false positives, and easily scales to secure thousands of web sites.
Qualys WAF (Web Application Firewall) Built on the world’s leading Cloud security and compliance platform, Qualys WAF complements the global scalability of Qualys Web Application Scanning (WAS). Together, they make identifying and mitigating web app risks seamless, whether you have a dozen apps or thousands. Qualys WAF can be deployed in minutes, supports SSL, and doesn’t require special expertise to use. It delivers a new level of web app security and compliance while freeing you from the substantial cost, resource and deployment issues associated with traditional products.
OWASP Austin January Chapter Meeting - January 27th
Title: CryptoParty!!!!!!
Abstract: In 1996, John Perry Barlow, co-founder of the Electronic Frontier Foundation (EFF) wrote 'A Declaration of the Independence of Cyberspace' where he stated "We are creating a world that all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth. We are creating a world where anyone, anywhere may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity." The Internet of today is an amazing place of knowledge and opportunity, but it unfortunately falls short of Mr. Barlow's original vision.
In the 21st century we face problems of climate change, energy crisis, state censorship, mass surveillance, and on-going wars. We must be free to to communicate and associate without fear. To realize our right to privacy and anonymity online, we need peer-reviewed, crowd-sourced solutions. CryptoParties provide the opportunity to meet up and learn how to use these solutions to give us all the means with which to assert our right to privacy and anonymity online. Topics include technologies like TOR, full-disk encryption, GPG, and many more. CryptoParties are free to attend, public, and not commercially aligned.
At our January 27, 2015 OWASP Austin meeting, we will host our first ever CryptoParty with the goal of inviting others to join us in learning about the tools and technologies that enable an individual's right to privacy. We encourage you all to invite your family, friends, and peers to attend this event. Presentations will be laid out so that novice and experienced alike can take action based on the data presented. All tools presented will be free and open source. Our CryptoParty will end with the first-ever OWASP Austin Key Signing Party. Don't miss this meeting and be sure to invite your friends!
Speaker(s): Several amazing security professionals who like Crypto and want to Party with OWASP
Austin Security Professionals Happy Hour sponsored by FishNet Security, January 8th
Sponsor: FishNet Security
LASCON 2014 - October 23rd and 24th
The Lonestar Application Security Conference (LASCON) is an OWASP conference held annually in Austin, TX. It started in 2010 when James Wickett (@wickett) and Josh Sokol (@joshsokol) along with the OWASP Austin crew put together an amazing 1-day conference with a speaker lineup of some of the who’s-who of the infosec and appsec world. In 2011, the conference grew to over 250 attendees and in 2012 the OWASP Austin crew hosted AppSec USA LASCON Edition–which has been heralded as the best security conferences ever by long-time infosec luminary Gene Kim.
LASCON 2014, run by David Hughes(@Dav1dHugh3s) and the OWASP Austin crew, will be run in the same tradition as previous LASCON conferences featuring the best speakers, a close-knit community atmosphere and even our signature happy hour replete with a mechanical bull. Year over year, LASCON has been a gathering of thought leaders, web developers, security engineers, mobile developers and information security professionals. LASCON 2014 will have 2 days of pre-conference training and 2 full days of conference across 4 rooms.
OWASP Austin September Chapter Meeting - September 30th
When: September 30th, 11:30AM to 1PM
Title: Account Entrapment
Abstract: This talk covers two ways to force a victim into an attacker's account (Account Entrapment): Login Cross-Site Request Forgery and Cookie-based or Session Entrapment. This is a commonly overlooked vulnerability despite high-profile exploits including Youtube.com. Because it is often disregarded, this talk begins with an in-depth look at attack scenarios and what an attacker can actually gain. It then describes how the two attacks work and how to defend against them. Finally, though these attacks are prevalent across the internet, it will show why state agencies (with domains ending in .state.**.us) and large organizations with many subdomains face special problems when building defenses against these attacks.
Speaker: Ben Broussard
About: Ben Broussard has been involved in the Austin Appsec scene since 2008, helping to plan the first LASCON and running the OWASP study group for a time. After doing subcontracting work for a number of security shops and gaining a breadth of experience on both the threatscape and the security organizations that attempt to address it, he took a position with San Antonio based Denim Group (now with an Austin office). When not researching appsec, Ben is a hobbyist in Human Physiology, Acrobatics, Human Evolution, Brazilian Jiu Jitsu, and toddler wrangling. He also runs Hot Lava Obstacle Course located on Burnet road
(No Video) Link to slides at slideshare
Austin Security Professionals Happy Hour sponsored by Set Solutions Inc., September 11th
When: Thursday, September 11th, 5-7PM
Sponsor: Set Solutions Inc.
For over 20 years, Set Solutions, Inc.—a full service provider of network security, secure remote access and bandwidth management solutions—has been in the business of increasing business profitability and growth.
If you have network security challenges or just want to improve the health of your network, Set Solutions can help.
OWASP Austin August Chapter Meeting - August 26th
When: August 26th, 11:30AM to 1PM
Title: Identifying Web Attacks via Data Analysis
Abstract: This presentation will look at detection of SQL injection using Machine Learning as well as profiling web traffic to find misbehaving hosts. The goal is to get beyond "Top N" types of analysis and begin using multiple features to guide us towards interesting traffic. With these techniques multiple log types can be used, everything from web server logs to proxy logs.
Speaker: Mike Sconzo
Mike enjoys attempting to solve/solving interesting security problems with data analysis. He's spent most of his career on the defensive side, and is constantly looking for new ways to detect suspicious and malicious behavior. His background is heavy in network analysis and most of the explored techniques revolve around use cases involved with network forensics.
Video Archive: https://vimeo.com/channels/owaspaustin/104466721
Austin Security Professionals Happy Hour sponsored by Trustwave, August 14th
When: Thursday, August 14th, 5-7PM
Sponsor: Trustwave
The Trustwave suite of application security solutions, delivered by an expert team of application specialists, ensures that your application is tested and reviewed thoroughly. The application security team uses manual processes to test and review applications according to your needs. The result is specific guidance that can significantly improve the security of your applications and protect your business.
OWASP Austin July Chapter Meeting - July 29th
When: July 29th, 11:30AM to 1PM
Title: Railsgoat
While working to secure rails applications in a truly Agile development environment, it became clear that the Rails and Ruby ecosystem needed attention from the security community in the form of free and open training. RailsGoat is an attempt to bring attention to both the problems that most frequently occur in Rails as well as solutions for remediation. This talk will discuss Railsgoat, common issues, defensive measures, and engage the audience for feedback/improvements.
Speakers: Ken Johnson
Ken Johnson is the CTO of nVisium and leads the company's product development efforts. Ken is obsessed with code security and code in general but holds a special place in his heart for Ruby. Ken is passionate about the open source community, and genuinely loves to create. http://railsgoat.cktricky.com
Video Archive: https://vimeo.com/channels/owaspaustin/102133267
Austin Security Professionals Happy Hour sponsored by iSEC Partners, July 10th
When: Thursday, July 10th, 5-7PM
Sponsor: iSEC Partners
iSEC Partners is an information security firm specializing in the assessment of application and network security. Founded in 2004, with offices in San Francisco, New York, Seattle, and Austin, iSEC Partners provides tailored security services to many Fortune 500 clients. iSEC consultants are published authors in the information security field and regular speakers at events including the RSA Conference, Black Hat, FS-ISAC, CanSecWest, SOURCE, InfoSecurity Europe, and the FIRST annual conference. Details of presentations delivered by iSEC Partners in recent years are available from our website at https://www.isecpartners.com/research/white-papers.aspx.
OWASP Austin March Chapter Meeting - June 24th
When: June 24th, 11:30AM to 1PM
Title: Integrating process and architecture to yield robust systems
Abstract: When producing software products that meet the objectives of both the business unit and the security shop, the developers best friend is process and a secure architecture. Robust systems require a holistic view of security where attribution, reliability and confidentiality do not put a strain on the dev shop, but provide an environment that optimizes the use of infrastructure and standards to yield secure and robust systems. How do we do that and meet the budget and time constraints that we all face?
Speaker: Vern Williams
Vern Williams has over 30 years in Information Security starting with his responsibilities in the US Navy Submarine Force where he obtained a Masters Degree in Information Systems. Since retiring from the Navy, he has worked for several companies and has obtained certifications as a Certified Information Systems Security Professional (CISSP), a Certified Business Continuity Professional (CBCP), a Certified Secure Software Lifecycle Engineering Professional (ISSEP). He has been one of few instructors for the CSSLP preparation seminar by ISC2. Additionally, over the last few years, Mr. Williams has distinguished himself as an ISSA Distinguished Fellow and Senior Member of the IEEE, Fellow and served as Director of ISSA International, President of the Capitol of Texas ISSA Chapter, Chair of the Austin ASIS Chapter, President of the local USAFA Parents Association and the Disaster Relief Coordinator for the Austin Disaster Relief Network. He has been instrumental in establishing the Certified Information Systems Security Professional (CISSP) course at Austin Community College and is a key contributor to the Texas Regional Infrastructure Security Conference (TRISC).
Video Archive: Unfortunately, due to technical difficulties, a recording was not made.
Austin Security Professionals Happy Hour sponsored by Lumenate, June 12th
When: Thursday, June 12th, 5-7PM
Sponsor: Lumenate
Lumenate is a technical consulting firm that helps clients solve their most challenging business problems. We combine the brightest, experienced talent with proven and longstanding manufacturing partnerships to provide expert solutions across the following practice disciplines:
· Storage | Virtualization
· Security | Compliance
· Networking | Collaboration
· Managed Services
OWASP Austin March Chapter Meeting - May 27th
When: May 27th, 11:30AM to 1PM
Title: How to Use Crowd-Sourced Threat Intelligence
Abstract: This talk will include an overview and demo of the Open Threat Exchange (OTX) and describe some of its information sources, including anonymous sharing from Open Source Security Information Management (OSSIM.) Jaime will share some of his experiences using OTX as a security researcher. He will also provide his thoughts on how OWASP members can benefit from security research and threat intelligence to "build in" security rather than constantly reacting.
Speaker: Jaime Blasco
Jaime Blasco is a Security Researcher with broad experience in network security and malware analysis. At AlienVault, Jaime manages the Lab and runs the Vulnerability Research Team in charge of researching and integrating threat intelligence into detection mechanisms.
Video Archive: http://vimeo.com/channels/owaspaustin/96621807
Austin Security Professionals Happy Hour sponsored by The Broadleaf Group, May 8th
When: Thursday, May 8th, 5-7PM
Sponsor: The Broadleaf Group
Founded in 2005, The Broadleaf Group is a leading provider of IT solutions with specific emphasis on providing Systems, Security, Unified Communications, Managed IT, Banking and CIO level consulting for SMB to enterprise level customers throughout the US. The company’s extensive experience with IT performance, optimization processes and business enablement ensures customers are provided with the most comprehensive and competitive solutions for their environments. For more information, please visit www.broadleafgroup.com.
OWASP Austin March Chapter Meeting - April 29th
Title: Covert Hacking and Application Testing with Raspberry Pi
Abstract: The $35 Raspberry Pi is a wonder device on the cheap! But the security impact of this cheap and powerful equipment with its tiny footprint is equally interesting. In this session you will learn how the Pi can be used as a covert, field-friendly hacking platform for less than $100 total. The talk will address both attack and defense scenarios against the device. We will also discuss some of the applications for Pi around application security and penetration testing.
Speaker: Branden Williams is well known in the industry as a practitioner, consultant, and thought leader. He spent a number of years helping companies solve major security and compliance problems, including building PCI DSS compliance programs for some of the largest retailers around the globe. He recently sat on the PCI Board of Advisors and published the third edition of his book, PCI Compliance (Syngress, 2012) in August. Branden routinely speaks with organizations big and small with various levels of regulation to help them reduce their overall risk footprint and build safer and more efficient IT functions.
Video Archive: https://vimeo.com/93323292
Austin Security Professionals Happy Hour sponsored by Digital Defense, April 10th
When: Thursday, April 10th, 5-7PM
Sponsor: Digital Defense
Founded in 1999, Digital Defense, Inc. (DDI) is a premier provider of managed security risk assessment solutions protecting billions in assets for small businesses to Fortune companies in over 65 countries. DDI’s dedicated team of experts helps organizations establish a culture of security through regular information security assessments, awareness education and decisive security intelligence. This proven method bolsters the capability to reduce risk and keep assets and reputations secure. The combination of DDI’s certified security analysts, patent-pending technology and proprietary cloud-based vulnerability management system, Frontline™ Solutions Platform, delivers one of the most powerful assessment results and remediation management solutions available.
OWASP Austin March Chapter Meeting - March 25th
Title: Hacking Exposed: Mobile Edition
Abstract: Mobile is living up to the hype as the next great technology shift, rivaling the Internet in its game-changing impact. Of course, with great change comes potential risk - is there a magic bullet to secure the adoption of mobile everywhere? Cigital presents the latest mobile app security trends based on our recent book, Hacking Exposed: Mobile.
Speaker: Joel Scambray, CISSP, is a Managing Principal at Cigital, a leading software security consulting firm established in 1992. He has assisted companies ranging from newly minted startups to members of the Fortune 500 address information security challenges and opportunities for nearly twenty years, in diverse roles including consultant, author and speaker, corporate leader, and entrepreneur. He is widely recognized as co-author of the best-selling Hacking Exposed book series, and has worked/consulted for companies including Microsoft, Amazon, Costco, Foundstone/McAfee, and Ernst & Young
Video Archive: https://vimeo.com/90822991
Austin Security Professionals Happy Hour sponsored by Sourcefire/Cisco - March 19th
When: Wednesday, March 19th 5pm-8pm
Where: Wingate by Wyndham 1209 N. Interstate Highway 35 Round Rock, TX 78664
Sponsor: Sourcefire/Cisco
OWASP Austin February Chapter Meeting - February 25th
Title: Magical Code Injection Rainbow
Abstract: There are many intentionally vulnerable web applications available for people to learn how to exploit various types of flaws. Unfortunately, many of them have only the most basic and easily exploited examples of flaws. In order to work with a more complex version of a flaw, it's usually necessary to write your own vulnerable application or modify an existing one. There is another option! The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerable applications. This presentation will demonstrate the use of the existing MCIR applications such as SQLol (for SQL injection) and XMLmao (for XML and XPath injection), teach advanced exploitation techniques in SQL injection; XPath injection; cross-site scripting; and shell command injection, discuss the exploitation of insecure cryptosystems and discuss how to use the MCIR framework to build your own configurable vulnerable application.
Speaker: Daniel Crowley(aka "unicornFurnace") is a Senior Security Consultant for Trustwave's SpiderLabs team. Daniel denies all allegations regarding unicorn smuggling and questions your character for even suggesting it. Daniel has developed configurable testbeds such as SQLol and XMLmao for training and research regarding specific vulnerabilities. Daniel enjoys climbing large rocks. Daniel has been working in the information security industry since 2004 and is a frequent speaker at conferences including Black Hat, DEF CON, Shmoocon, and SOURCE. Daniel does his own charcuterie. Daniel also holds the title of Baron in the micronation of Sealand.
Video Archive: https://vimeo.com/90822990
Austin Security Professionals Happy Hour sponsored by SafeNet - February 20th
When: Thursday, February 20th, 5pm-7pm
Where: Sherlocks Baker Street Pub and Grill, 183 & Burnet
Sponsor: SafeNet
Founded in 1983, SafeNet, Inc. is one of the largest information security companies in the world, and is trusted to protect the most sensitive data for market-leading organizations around the globe. SafeNet’s data-centric approach focuses on the protection of high-value information throughout its lifecycle, from the data center to the cloud. More than 25,000 customers across commercial enterprises and government agencies trust SafeNet to protect and control access to sensitive data, manage risk, ensure compliance, and secure virtual and cloud environments.
OWASP Austin January Chapter Meeting - January 28th
Chapter meeting canceled due to icy conditions.
Austin Security Professionals Happy Hour sponsored by F5 - January 9th
When: Thursday, January 9th, 5pm-7pm
Where: Sherlocks Baker Street Pub and Grill, 183 & Burnet
Sponsor: F5
OWASP Austin Chapter - December 2013
No Meeting, Happy Holidays!
Austin Security Professionals Happy Hour - December 2013
No Happy Hour, Happy Holidays!
OWASP Austin Chapter - November 2013
No Meeting
Austin Security Professionals Happy Hour - November 2013
No Happy Hour, Recovery from LASCON
LASCON 2013, October 24th & 25th
Did you miss it? http://www.lascon.org
OWASP Austin September Chapter Meeting- September 24th
Title: Bridging the gap between development cloud networks and our corporate identity management strategy. Oh and adding visibility/credibility to our IT shop.
Speakers: Jay Paz (Staff Security Engineer) and Justine Reneau (Senior Systems Administrator) from Bazaarvoice
Location: National Instruments, 11500 N. Mopac.Building C
When: Tuesday, September 24th from 11:30am to 1:00pm
RSVP:http://owaspaustinsept.eventbrite.com/?s=17712853
Austin Security Professionals Happy Hour, Sponsored by Sourcefire
When: Thursday, September 12th, 5pm-7pm
Where: Sherlocks Baker Street Pub and Grill, 183 & Burnet
Sponsor: Sourcefire
RSVP:http://sec-happyhr.eventbrite.com/?s=16936345
August OWASP Austin Chapter Meeting
When: Tuesday, August 27th, from 11:30am-1:00pm
Where: National Instruments, 11500 N. Mopac.Building C
Title: Static Code Analysis: Is it safe to go back in the water?
Speakers: Art Dahnert and Joel Scambray
RSVP: http://owaspaustinaug.eventbrite.com/?s=16906987
When: Thursday, August 15th, from 5:00pm - 7:00pm
Where: Sherlock's Baker Street Pub and Grill, 183 and Burnet.
Our Sponsor: Critical Start, Mobile Iron, and OpenDNS!
RSVP: http://augustsec.eventbrite.com/?s=16703579
When: Tuesday, July 30th, from 11:30am-1:30pm
Where: National Instruments, 11500 N. Mopac.Building C
Title: Testing at Cloud Speed: Security Gone Agile
Speaker:Matt Tesauro
When: Thursday, July 11th, from 5:00pm - 7:00pm
Where: Sherlock's Baker Street Pub and Grill, 183 and Burnet.
What: The Austin Security Professionals Happy Hour is a monthly event coordinated between the Austin ISSA and OWASP Chapters to provide security professionals an opportunity to network and have a good time!
Our Sponsor: Security Innovation
RSVP: http://julysecurity.eventbrite.com/?s=15640627
When: Thursday, June 13th, from 5-7 pm
What: Austin Security Professionals Happy Hour Sponsored by 21CT
Where: Sherlocks Baker Street Pub and Grill.
RSVP: http://junesecurity.eventbrite.com/?s=14912917
When:Thursday, May 28th, from 11:30a - 1:00pm
What:OWASP Austin Chapter Meeting
Who:Dustin Kirkland, Gazzang.com
RSVP:https://www3.gotomeeting.com/register/813351094
When: Thursday, May 9th, from 5-7 pm
What: Austin Security Professionals Happy Hour Sponsored by Trustwave Spiderlabs
Where: Sherlocks Baker Street Pub and Grill.
RSVP: http://aprilsecurity.eventbrite.com/?s=13502311
When:Tuesday, April 30th, from 11:30am - 1:00pm
What:OWASP Austin Chapter Meeting
Who:Neil Matatall, Twitter
RSVP:http://owaspaustinmarch.eventbrite.com/?s=13784243
When: Tuesday, April 11th, from 5-7 pm
What: Austin Security Professionals Happy Hour Sponsored by Trustwave Spiderlabs
Where: Sherlocks Baker Street Pub and Grill.
RSVP: http://aprilsecurity.eventbrite.com/?s=13502311
When:March 26th from 11:30am - 1:00pm
What:OWASP Austin Chapter Meeting
Topic:Why UPnP is Awesome and Terrifying
Who:Dan Crowley
RSVP: http://www.eventbrite.com/event/5856381595/eorgf
When: Tuesday, February 19th, from 5-7 pm
What: Austin Security Professionals Happy Hour Sponsored by Rapid 7
Where: Sherlocks Baker Street Pub and Grill.
RSVP: http://www.eventbrite.com/event/5855308385
When:February 26th from 11:30a - 1:00p
What:OWASP Austin Chapter Meeting
Topic: big data real-time security analytics
Who: Lars Ewe
RSVP:http://owasp-feb.eventbrite.com/
When:Thursday, February 21st, from 5-7pm
What:Austin Security Professionals Happy Hour Sponsored by SOS Security and Palo Alto Networks
Where: Sherlocks Baker Street Pub and Grill.
RSVP:http://infosecfeb.eventbrite.com/
When: January 29th from 11:30a - 1:00p
What: OWASP Austin Chapter Meeting
Topic: Data events, or why security is cloudier than you think.
Who: Wendy Nather
Cost: Free, of course
Food: Oh yeah, Taco Deli time!
Location: National Instruments, 11500 N. Mopac.Building C
RSVP: http://owaspjanuary.eventbrite.com/
When January 17th, 5:00pm - 7:00pm
What Austin Security Professionals Happy Hour, Sponsored by Trusteer
Where Sherlocks
When: September 25th, 11:30am - 1:00pm
Topic: Vulnerability Spidey Sense (Sponsored by SolarWinds)
Who: Daniel Crowley and Chris Vinecombe
Synopsis:This talk will cover scenarios which raise red flags for us, why, and how to develop your own sense of intuition.
Cost: Free
:RSVP: http://www.eventbrite.com/event/4319523812
When: September 13th, 5:00pm-7:00pm
What: Austin Security Professionals Happy Hour, Sponsored by Mandiant
Where: Sherlocks
When: August 28th, from 11:30a-1:00pm
Topic: OAUTH 2.0 Security
Who: Tom Brown develops user-centric identity software with Ruby, contributes to the opentransact protocol and participates at the Internet Identity Workshop. Tom has contributed code for federated and delegated identity to several open source projects as herestomwiththeweather on github. Prior, Tom developed network and security code for companies including VXtreme, Microsoft, Yodlee, WholeSecurity and BiometricAccess.
Cost: Free, of course
Food: Oh yeah, Taco Deli time!
Location: National Instruments, 11500 N. Mopac.Building C
RSVP: http://www.eventbrite.com/event/4064986484
When: August 9th, 5:00pm-7:00pm
What: Austin Security Professionals Happy Hour, Sponsored by Slait Consulting.
Where: Sherlocks
When: July 31st, 11:30am - 1:00pm
Topic: Lighting Talks
Who: Doug Landoll,Matt Malone, Shared Secrets-David Hughes,The Magic of Symbiotic Security: Creating an Ecosystem of Security Systems - Josh Sokol (@joshsokol),WAF evasion with SSL - David Lister,Phil Beyer (@pjbeyer),#securityisms - The Real APT! - Brian Engle (@brainaengle),Re-integration: Don't fear closed systems - Michael Cote (@cote),Selling Security - Bill Kasper (aka The Hacker Vaccine) (@hackervaccine),Be mean to your code! - James Wickett (@wickett),Implementing Social Sign On(SSO+) in an Large Enterprise Single Sign On(SSO) Ecosystem - Jay Hook
Synopsis: A collection of 5 minute talks by various OWASP members. 20 slides, 15 seconds each.
Cost: Free, of course
Food: Oh yeah, Taco Deli time!
Location: National Instruments, 11500 N. Mopac.Building C
RSVP: http://www.eventbrite.com/event/3873941062
When: July 12th, 5:00pm-7:00pm
What: Austin Security Professionals Happy Hour, Sponsored by Security Innovation.
Where: Sherlocks
When: June 26th, from 11:30a-1:00pm
Topic: Measuring the Root Shell Index
Who:HD Moore
Synopis: Determining the realistic scope of a particular advisory or vulnerability using large scale reconnaissance with analytics.
Cost: Free, of course
Food: Oh yeah, Taco Deli time!
Location: National Instruments, 11500 N. Mopac.Building C
RSVP: http://www.eventbrite.com/event/3697966718
When: June 14th, 5:00pm-7:00pm
What: Austin Security Professionals Happy Hour, Sponsored by WhiteHat Security.
Where: Sherlocks
When: May 29th, 1:00pm-5:00pm
Topic:Secure Coding BootCamp
Who: Jim Manico
Synopsis:This bootcamp provides essential web application security training for web application software developers and architects. The class is a combination of lecture and code review. Participants will not only learn the most common threats against web applications, but more importantly they will learn how to also fix the problems via control-based defensive code samples and review. Topics such as Authentication, Access Control, Crypto, Cross Site Request Forgery, Cross Site Scripting, Injection Defense, Clickjacking Defense, Session Management and other topics will be addressed from a defensive point-of-view.
Cost: Free
Location: National Instruments, 11500 N. Mopac.Building
RSVP:http://www.eventbrite.com/event/3418744557
When: May 29th, 11:30am-1:00pm
Topic: Closing the window of opportunity"
Who: Jim Manico and Siri De Licori of WhiteHat Security
Synopsis:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.
Cost: Free, of course
Food: Oh yeah, Taco Deli time!
Location: National Instruments, 11500 N. Mopac.Building
RSVP: http://www.eventbrite.com/event/3418570035
When: May 10th, 5:00pm-7:00pm
What: Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.
Where: Sherlocks
When: April 24th, 11:30a-1:00pm
Topic: Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.
Who: Aaron Estes, Cigital
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.
Cost: Always Free
RSVP: http://www.eventbrite.com/event/3182987401
When: June 14th, 5:00pm-7:00pm
What: Austin Security Professionals Happy Hour, May 10th, Sponsored by WhiteHat Security.
Where: Sherlocks
When: May 29th, from 11:30a-1:00pm
Topic: Closing the window of opportunity"(Jim Manico and Siri De Licori of WhiteHat Security)
Abstract:Closing the window of opportunity” and will be discussing the state of web application security based on recent statistics drawn from WhiteHat’s database of thousands of sites under service and the characteristics of a program that can help organizations develop a strong web security posture and reduce or eliminate the opportunities attackers have to compromise their applications.
This will be a product agnostic presentation, of course, though we will be using WhiteHat data (along with Jim’s long experience) to present the problems we see and how we can go about solving them.
Who: Jim Manico and Siri De Licori of WhiteHat Security
Siri De Licori is a Product Manager for WhiteHat Security. He led the development of a pre production Dynamic Analysis Software Testing (DAST) service line, and is working to bring out product enhancements which take greater advantage of WhiteHat’s historical scanning and vulnerability data and integrates DAST and SAST results. He has also worked with Jeremiah to produce statistics for a number of his quarterly reports and whitepapers.
Siri comes from a background of 10 years of development. He worked with a small software company working on an early rapid application development tool that produced code from UML diagrams, a small nonprofit on a tool to permit English and Chinese speakers to study the bible in its original tongues without learning those ancient languages, and a couple Fortune 500 companies helping them process, utilize, and analyze their financial data. Before being recruited into product management he specialized in building database systems and data analytics.
Siri works at WhiteHat’s home office in Santa Clara and lives in San Francisco.
Jim Manico is the VP of Security Architecture for WhiteHat Security. Jim is part of the WhiteHat Static Analysis Software Testing (SAST) team, leading the data-driven, Web service portion of the SAST service. He also provides secure coding and developer awareness training for WhiteHat using his 7+ years of experience delivering developer-training courses for SANS, Aspect Security and others.
Jim brings 15 years of database-driven Web software development and analysis experience to WhiteHat. He has helped deliver Web-centric software systems for Sun Microsystem, Fox Media (MySpace), several Fortune 500's, and major NGO financial institutions. He holds expertise in a variety of areas, includingWeb-based J2EE development, thick-client and applet-based Java applications, hybrid Java, C++ and Flash applications, Web-based PHP applications, rich-media Web applications using advanced Ajax techniques, Python REST Webservice development, and Database technology using Oracle, MySQL and Postgres.
A host of the OWASP Podcast Series, Jim is the committee chair of the OWASP Connections Committee and is a significant contributor to various OWASP projects.
Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.
Cost: Free
RSVP: http://www.eventbrite.com/event/3418570035
When: May 10th, 5:00pm-7:00pm
What: Austin Security Professionals Happy Hour, May 10th, Sponsored by Rapid7.
Where: Sherlocks
When: April 24th, 11:30a-1:00pm
Topic: Anatomy of Advanced Email Attacks (Aaron Estes, Cigital)
Abstract: Email attacks comprise an overwhelming majority of the daily attacks on modern enterprise. The leading mitigation strategy is a combination of user awareness training and email filtering. This talk outlines a proposed solution that brings email risk and awareness information down to the client level in order to better equip end users in making secure decisions when using email.
Anti-spam capabilities have been incorporated into email client applications for some time now. These are usually in the form of junk boxes or email filters that attempt to identify spam or other unwanted email. Most anti-spam clients use bayesian filtering to determine whether an email is spam or not spam, typically using word combinations and statistical analysis to make a determination. Many experts also advise wary email users to examine the raw email headers in order to attempt to find evidence of an email attack. While this is not bad advise, it is however a highly technical process and one cannot expect the majority of email users to be able to carry out and act upon this advice. This is the problem that the proposed Advanced Email Risk Classification and Recipient Decision Assistance solution attempts to solve. The operating name for this solution is Phish Finder.
Who: Aaron Estes, Cigital
Aaron Estes came to Cigital from Lockheed Martin where he spend 10 years in the software engineering and security engineering fields. He began his information security career as a system security engineer on the F-35 program. Aaron has spent the last 5 years as a security engineer and penetration tester for Lockheed Martin Enterprise Business Services specializing in application penetration testing and user awareness/social engineering testing. Aaron is also a professor at Southern Methodist University in Dallas where he teaches senior and graduate level security courses. He has nearly completed his Doctor of Engineering in Software Engineering at Southern Methodist University, has a Masters in Software Engineering from Southern Methodist University and has a Bachelors in Computer Science from University of Texas. Aaron is a Certified Information System Security Professional.
Cost: Always Free
RSVP: http://www.eventbrite.com/event/3182987401
When:April 19th, from 5pm-7pm
What: Austin Security Professionals Happy Hour, April 19th, Sponsored by Robert Half International.
Where: Sherlocks
When: March 27th, 1:00pm-5:00pm
We will be writing Cucumber acceptance and security tests while we build an app as a group. In the lab, we will have several groups working together writing cucumber tests and code along the way. Even if you are not a developer or security expert, this event is for you.
Who: Mani Tadayon and Tin Zaw
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.
Cost: Free, but limited to 30 seats.
RSVP: http://www.eventbrite.com/event/3183041563
When: March 27th, 11:30a-1:00pm
Topic: Cucumber and friends: tools for security that matters
Behavior-Driven Development (BDD) helps focus software development on delivering prioritized, verifiable business value by providing a common vocabulary that spans the divide between Business and Technology. Cucumber is a widely used tool in Ruby community for implementing BDD and it executes plain-text functional descriptions as automated tests. In this talk, Mani and Tin will discuss how Cucumber and related tools can be used to define and verify security features that matter in software.
Who: Mani Tadayon and Tin Zaw
At AT&T Interactive, Mani is part of the team responsible for YP.com. Mani studied foreign languages at UC Berkeley, computer science at Cal State Hayward and is now a graduate student in Geography at Cal State Northridge. He has been developing web applications using open source tools for over 10 years. Currently, his focus is on behavior-driven development with Ruby.
Tin is currently the president of OWASP Los Angeles chapter. During day time, he works with Mani at AT&T Interactive as an application security architect. Before AT&T, he worked as a software engineer, manager and researcher at QUALCOMM, Inktomi (now Yahoo!), Symantec, MySpace and a Sequoia funded Internet infrastructure startup.Tin holds CISSP and CSSLP certifications from (ISC)2, MS in Computer Science from University of Southern California, and working on an MBA from USC.
Cost: Always Free
RSVP: http://www.eventbrite.com/event/3147433057
When: March 8, 2012, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Fireeye)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: February 28, 2012, 11:30am - 1:00pm
Topic: Testing From the Cloud: Is the Sky Falling?
More and more IT is being moved to the cloud, why shouldn't your testing move there too? This talk will cover what it takes to take your testing tools from your laptop to the cloud using new features of the OWASP Web Testing Environment (WTE). WTE allows you to create custom installations of application security tools in the cloud on demand. Has your IP been shunned? No problem, kill that cloud instance and startup another. Is your life as mobile as your phone? No problem, a laptop + Internet = access to all your favorite tools from anywhere. Multiple clients? No problem, start an an instance for each one. By the end of this talk, you'll know all you need to fire up an cloud instance with all of your favorite tools and start having fun.
Who: Matt Tesauro (Rackspace)
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications. Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.
Cost: Always Free
RSVP: http://www.eventbrite.com/event/2967474797
Topic: Half-Day Threat Modeling Seminar with John Steven of Cigital
How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.
Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.
Who: John Steven(Cigital)
John Steven is the Senior Director, Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted advisor to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.
Where: Microsoft Technology Center, Quarry Oaks 2, 10900 Stonelake Blvd
When: February 9th, from 1:00pm to 4:30pm
Cost:
The cost is free, but seating is limited, so register soon at the below link!
http://austinthreatmodel2012.eventbrite.com/
When: February 9th, 2012, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Cigital)
Where: Weirdos
When: October 28, 2011, 8:00am - 5:00pm
Topic: Lonestar Application Security Conference (LASCON)
Who Should Attend LASCON 2011:
- Application Developers
- Application Testers and Quality Assurance
- Application Project Management and Staff
- Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff
- Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance
- Security Managers and Staff
- Executives, Managers, and Staff Responsible for IT Security Governance
- IT Professionals Interested in Improving IT Security
Where: Norris Conference Center, Austin, TX
When: September 29, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by HP/Fortify)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: September 27, 2011, 11:30am - 1:00pm
Topic: STAAF: A FLOSS Framework for Scalable and Sharable Android App Analysis
With no end of Android malware anywhere in sight, it’s no wonder that so many Android analysis tools have been released lately. While each of these powerful tools makes great strides in finding artifacts in an individual application, they’re typically not designed to scale beyond a few thousand selected samples at most. In order to effective insight into android applications researchers need to be be able to analyze a substantial subset of the 300k+ applications in the official store, all of the applications across the disparate unofficial Android stores and repositories, as well as ad-hoc manually-submitted applications. This was the motivation for STAAF, a Scalable Tailored Application Analysis Framework. STAAF was designed to allow an analyst to easily add/remove/configure various analysis modules, then process large numbers of applications at once or over time, then share the raw data, processed data, and results with other organizations. In this presentation I’ll cover the STAAF Architecture, the current status and available implementation, and if circumstances permit, show a quick demo with a handful of applications.
Who: Ryan Smith (Praetorian)
At Praetorian, Ryan's current focus is on the development of technology and systems in support of computer network defense, attack, and exploitation. Prior to joining Praetorian, Ryan Smith was an Associate Staff member of the Information Systems Technology Group at MIT Lincoln Laboratory. His previous work at Lincoln Labs was in the code analysis group, in which he focused on the development of a prototype tool to automate the malware analysis process using information flow and virtual machine introspection. Prior to Lincoln Laboratory, Mr. Smith worked at 21st Century Technologies and Applied Research Labs in Austin, TX, and PricewaterhouseCoopers in Dallas, TX. Previous work has included graph-based network attack correlation, steganography, netflow traffic analysis, vulnerability and risk analysis, and identity management.
Ryan has been an active member of the Honeynet Project since 2002, in which he participated in the testing and development of various honeynet technologies, and was invited to give several talks on the usefulness of honeynets for strengthening network security as well as research. While at the University of Texas, Ryan was the head of the local information security group on campus, and the organizer of the local cyber "capture the flag" exercise. As a result of this position, he was invited to a NFS funded workshop to determine the efficacy of a National Collegiate Cyber Defense Exercise, and subsequently assisted in the organization of the inaugural Collegiate Cyber Defense Competition, which now hosts over 50 Universities in 8 regional qualifiers and a finalist round in San Antonio. While at the University of Texas, Ryan also led a team of graduate students to design and implement a prototype of an automated polymorphic shellcode analyzer to extract the system calls and parameters of arbitrarily obfuscated Windows shellcode.
Industry designations include the Certified Information Systems Security Professional (CISSP). Ryan received a B.S in Electrical Engineering from The University of Texas in Austin, where he focused on information assurance and network communications. Ryan received a M.S. in Security informatics from Johns Hopkins, where he focused on network and systems security as well as privacy and technical public policy.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
When: August 30, 2011, 11:30am - 1:00pm
Topic: Protecting Your Applications from Backdoors: How to Secure Your Business Critical Applications from Time Bombs, Backdoors & Data Exfiltration
With the increasing practice of outsourcing and using 3rd party libraries, it is nearly impossible for an enterprise to identify the pedigree and security of the software running its business critical applications. As a result backdoors and malicious code are increasingly becoming the prevalent attack vector used by hackers. Whether you manage internal development activities, work with third party developers or are developing a COTS application for enterprise, your mandate is clear- safeguard your code and make applications security a priority for internal and external development teams.
In this session we will cover:
- Prevalence of backdoors and malicious code in third party attacks
- Definitions and classifications of backdoors and their impact on your applications
- Methods to identify, track and remediate these vulnerabilities
Who: Joe Brady (Veracode)
Joe Brady is a Senior Solutions Architect at Veracode with over 25 years of experience in software application development and security. His professional experience includes advising customers on data at rest encryption solutions at Credant Technology, IT risk and portfolio management at Prosight (now Oracle), and application software development as a consultant and software development manager for various companies. Joe began programming as a physics undergrad and developed early microprocessor based instrumentation at Cornell, where he received a Master of Science degree in Applied and Engineering Physics. He has had an interest in software security, and backdoors in particular, since reading “Reflections on Trusting Trust” by Ken Thompson where he describes planting what we now call a backdoor in the UNIX compiler.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
When: August 18, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Set Solutions)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: July 14, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by BlueCoat)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: June 28, 2011, 11:30am - 1:00pm
Topic: Introduction to the OWASP Secure Coding Practices Quick Reference Guide
The OWASP Secure Coding Practices Quick Reference Guide is a technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development life-cycle. At only 17 pages long, it is easy to read and digest.
The focus is on secure coding requirements, rather than on vulnerabilities and exploits. In this respect it is targeted more precisely for the development community, as opposed to the security community.
This presentation will introduce this OWASP project and discuss some of the core concepts and principles of the requirements.
Who: Keith Turpin CISSP, CSSLP, CRISC (Boeing)
Keith leads Boeing’s enterprise application security assessment team. He previously served as the lead IT security advisor for all of Boeing’s international operations.
Keith represents Boeing on the International Committee for Information Technology Standard's cyber security technical committee and serves as a U.S. delegate to the International Standards Organization's sub-committee on cyber security.
Keith is the project leader for the OWASP Secure Coding Practices Quick Reference Guide and is a member of the OWASP Global Projects Committee. He also spent four years as the Director of Communication for the Seattle chapter of the Information Systems Security Association.
He is a frequent speaker at conferences, professional organizations and corporations on a variety of security topics.
Keith holds a BS in Mechanical Engineering and MS in Computer Systems.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
When: June 17, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Rapid7)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: June 17, 2011, 1:30pm - 5:00pm
Topic: Penetration Testing with Metasploit Half-Day Seminar
Who: Raphael Mudge
Where: Microsoft Technology Center (Quarry Oaks 2, 10900 Stonelake Blvd, Suite 225, Austin, TX 78759)
NOTE: This training is SOLD OUT, but you can put your name on the waiting list at http://metasploit.eventbrite.com
When: May 31, 2011, 11:30am - 1:00pm
Topic: Why Hackers.org Doesn't Get Hacked
Ha.ckers.org has suffered nearly every attack a website can. These attacks include robots, sophisticated web-based attacks, brute force, denial of service, and network based attacks. This speech will explain the other side of protecting high risk websites - the configurations, operating system, and network.
Who: James Flom (SecTheory)
Mr. Flom has been working in the computer industry for the past sixteen years and has spent the last twelve heavily involved in computer and network security. As lead operations engineer of Pilot Network Services' security department he researched network and computer threats on a daily basis protecting some of the largest companies and organizations in the world. He designed and implemented what was believed to be at the time, the largest network intrusion detection system in the world, protecting over half a million computers.
Mr. Flom later joined Digital Island (acquired by Cable & Wireless and merged with Exodus), where he created new product offerings for the Security Operations Center he was brought on to build. After the merger with Exodus James joined the Cyber Attack Tiger Team and assisted with the detection and recovery of several global network security compromises. Mr. Flom later became the director of consulting services for Kliosystems before co-founding SecTheory. He is a member of IACSP.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: May 5, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by FireEye)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: April 26, 2011, 11:30am - 1:00pm
Topic: Rugged Dev: Building Reliability and Security Into Software
Complex systems fail over time and the larger they are, the more likely they are to fail in unforeseen ways. Come hear about the best practices we used and lessons learned when we built very large scale cloud-based products. Once exposed to the Internet, complex multi-tenant Web systems encounter a wide range of input from a variety of sources but still have to be long running and behave resiliently in the face of failures. We will examine 3 implementations of Rugged best practices to design and test your software for ruggedness.
Who: James Wickett (National Instruments)
James graduated from the University of Oklahoma in 2004 with a BBA in MIS, where he also ran a Web startup company. He joined the IT division of National Instruments, where he helped run the NI Web site, ni.com, for several years. In 2007 he moved on to lead the Web division of a rapidly growing local publisher, Community Impact. In 2010, he came back to NI, this time to the LabVIEW R&D group, where he leads up security and operations for several cloud-based SaaS products. Over the last several years, James has been involved in the Austin chapter of OWASP as the Chapter President (2007-2009) and as the Chapter VP (2010-present). With his involvement in OWASP, he also co-chaired the Lonestar Application Security Conference (LASCON) which was the first OWASP conference in Austin.
He is a security expert, bearing CISSP, GCFW, GWAS, and CCSK certifications.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: April 14, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Veracode)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: March 29, 2011, 11:30am - 1:00pm
Topic: OWASP ROI: Optimize Security Spending Using OWASP
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.
Who: Matt Tesauro (Praetorian)
Matt has been involved in the Information Technology industry for more than 10 years. Prior to joining Praetorian, Matt was a Security Consultant at Trustwave's Spider Labs. Matt's focus has been in application security including testing, code reviews, design reviews and training. His background in web application development and system administration helped bring a holistic focus to Secure SDLC efforts he's driven. He has taught both graduate level university courses and for large financial institutions. Matt has presented and provided training a various industry events including DHS Software Assurance Workshop, AppSec EU, AppSec US, AppSec Academia, and AppSec Brazil.
Matt is currently on the board of the OWASP Foundation and highly involved in many OWASP projects and committees. Matt is the project leader of the OWASP WTE (Web Testing Environment) which is the source of the OWASP Live CD Project and Virtual Machines pre-configured with tools and documentation for testing web applications.
Industry designations include the Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH). Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: March 10, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Infoblox)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: February 22, 2011, 11:30am - 1:00pm
Topic: Supercharged Password Cracking Techniques
In the past 2-3 years there have been many important discoveries/releases in the world of password cracking. Between massive password leaks (like RockYou, Gawker, etc) and the release of many free tools that take advantage of the processing power of GPU cards, there are many new techniques/tools/tricks that security professionals should be taking advantage of while cracking passwords. But, by default tools you download (Like John the Ripper) do not take advantage of this.
Over the past 12 years, Rick has been collecting password hashes from various large corporations (during authorized penetration tests). For years now, he has been cracking these passwords, and discovering more and more patterns that users are using. But the majority of password cracking tools out there (Such as John the Ripper, L0phtCrack, etc) do not take advantage of these "human weaknesses" in password creation. So far Rick has cracked almost 4 million hashes from inside corporate America, and an additional 5+ million from sources over the Internet.
During this talk Rick will talk about the current state of password cracking by walking the attendees through a PWDUMP output file containing 49000+ real "complex" NTLM passwords) how the default rule-set provided by John the Ripper can be improved to crack tens of thousands of additional passwords. Wordlists/Dictionaries will be shared that can help you better crack passwords (these wordlists were created based on what users are _actually_ doing in Fortune 500 environments). New "rules" will be given out that were created to specifically attack the patterns that users are choosing.
This is relevant to OWASP, because the applications we are developing/securing almost always have logins and passwords that protect them. But, unlike Operating Systems, our web applications do not usually have strict password requirements that users have to meet in order to create an account. We do this as to not scare away users; but we are placing our OWN systems at risk.
Even now, sites like Google/Twitter/Facebook only warn the users about poor passwords, or have a list of 500 passwords that are not allowed. This will _not_ be the case in 10 years. Lets address this problem now.
The only way to address the problem, is to first become aware of how bad our users are at choosing passwords , and what we can do (as developers or security professionals) to help protect our users from themselves.
Who: Rick Redman (Korelogic)
During his 12 years as a security practitioner, Rick has delivered numerous application and network penetration tests for a wide range of Fortune 500 and government clients. He serves as KoreLogic's subject matter expert in advanced password cracking systems and coordinated the "Crack Me if You Can" Contest at DefCon 2010. Additionally, Rick presents at a variety of security forums such as the Techno-Security Conference, ISSA Chapters and AHA (Austin Hackers Anonymous). Rick also provides technical security training on topics such as web application security. Rick also delivers web application security training to management, developers and security staff. Rick has served as a member of a penetration testing tiger team supporting Sandia National Laboratories. Mr. Redman is a graduate of Purdue University with a degree in Computer Science from the COAST/CERIAS program under Eugene Spafford. Rick started performing application layer security tests of applications in 2000, before inline web-proxies existed.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: February 10, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Cisco)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: January 25, 2011, 11:30am - 1:00pm
Topic: Smart Phones with Dumb Apps
Enterprises are targeting both internal users and customers with smartphone applications for platforms such as Apple iPhone and Google Android. Many of these applications are constructed without fully considering the associated security implications of their deployment. Breaches can impact both users as well as the enterprise distributing the application as attackers take advantage of expanded access to sensitive data and network services. This talk discusses emerging threats associated with deploying smartphone applications and provides an overview of the threat modeling process. The presentation then walks example applications from an attacker’s perspective demonstrating the sort of information they are able to extract allowing for more advanced attacks.
Who: Dan Cornell (Principal, Denim Group)
Dan Cornell has over twelve years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization's technology team overseeing methodology development and project execution for Denim Group's customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. In addition, Dan Cornell performed as the CTO of BrandDefense, architecting and developing their cutting-edge intellectual property protection technologies. Over a one year period of development he brought their web-based intellectual property protection technologies through three major versions, surpassing the applications of well funded and entrenched competitors. Previously he was the Vice President, Global Competency Leader for Rare Medium's Java and Unix competency center, based in San Antonio, Texas with development centers in New York, San Francisco, Atlanta and Sydney, Australia. He directed the development of best practices and policy for the cornerstone of Rare Medium's technical development arm, specializing in server-side Java application development. Prior to its acquisition by Rare Medium, Cornell was a founder and Vice President of Engineering for Atension, Inc. where he led the technical development team and served as the architect for the company's internal engineering practices. In March 1999, Texas Monthly magazine named Cornell and his partners, Sheridan Chambers and Tyson Weihs, to its list of 30 "Multimedia Whizzes Under Thirty" doing business in Texas.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: January 13, 2011, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Rapid7)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: October 29, 2010, 8:00am - 5:00pm
Topic: Lonestar Application Security Conference (LASCON)
Who Should Attend LASCON 2010:
- Application Developers
- Application Testers and Quality Assurance
- Application Project Management and Staff
- Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff
- Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance
- Security Managers and Staff
- Executives, Managers, and Staff Responsible for IT Security Governance
- IT Professionals Interested in Improving IT Security
Where: Norris Conference Center
Cost: $100 for OWASP members, $150 for non-members (includes 1 year OWASP membership)
You can register for the conference here
When: September 28, 2010, 11:30am - 1:00pm
Topic: Technology and Business Risk Management: How Application Security Fits In
This presentation demonstrates how important application security is to the overall stability and security of the infrastructure and the ultimately, the business. Presented from the Information Security Officer/Risk Manager point of view, it shows how a strong information security program reduces levels of reputational, operational, legal, and strategic risk by limiting vulnerabilities, increasing stability, and maintaining customer confidence and trust. It focuses on the top concerns of risk managers and how application security fits into the overall risk management process. The audience will be given recommendations on how to improve cost effectiveness and efficiency to achieve business, security, audit, and compliance objectives relative to applications.
Who: Peter Perfetti (Impact Security LLC)
Mr. Perfetti has been working in information security for fifteen years. He has been involved in IT Security for the financial services industry for ten years where he has worked as an Information Security Officer as well as having been responsible for vulnerability and threat management, and security engineering. Mr. Perfetti worked for Viacom and MTV as the Manager of Systems Administration and was the Director of IT Risk Management for the National Basketball Association. He has a broad range of experience in both operations and security. Mr. Perfetti provided governance and guidance over risk and compliance issues for the Americas region of ABN AMRO as the Local Information Security Officer for New York. His responsibilities were primarily to manage the risk for infrastructure related technology and operations. Other duties included audit, business continuity, investigations, and security operations oversight. Most recently, he was head of IT Security & Governance at Tygris Commercial Finance. He was formerly the VP of the NY/NJ Metro Chapter of OWASP and is currently a board member of the local chapter. He has served on the IT Security Advisory Board for the Technology Manager’s Forum. Mr. Perfetti’s accomplishments have been discussed in two books on achieving high performing, stable, and secure infrastructure. Currently Mr. Perfetti operates IMPACT Security LLC, a private security contractor firm, that specializes in Incident & Audit Response, Prevention, and Recovery; as well as developing, enhancing, and implementing Security and Risk Management programs.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: James Wickett (512) 964-6227.
RSVP on the Austin OWASP Ning Site
When: September 16, 2010, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by F5 and Accuvant)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: August 31, 2010, 11:30am - 1:00pm
Topic: Application Assessments Reloaded
Trying to integrate Business Software Assurance into Enterprise Risk Management and Information Security Management programs has had issues over the years. Penetration-testing was announced dead over a year ago, but it's still the number one choice of application security professionals when starting out. Can the activities from penetration-testing be re-used and turned into something innovative?
Tools (especially application scanners and secure static analysis tools) have error rates so high, they are useless in the hands of newcomers (even for peripheral security testing). Some organizations have built entire applications around or on top of existing appsec tools. Others are looking to use other kinds of tools, such as process/methodology/workflow tools, to enhance their classic penetration-testing tools.
Even the testing/inspection methodologies themselves are outdated and we're finding that they are challenging or repetitive in many environments. How do current appsec tools and testing/inspection methods work in the cloud? If we re-run the same kinds of tests during dev-test, software quality, and application security cycles, aren't we wasting valuable time and effort?
This presentation will provide discussion around how to solve many of these and other challenges in application security. The focus will be on web applications that use common technologies (HTTP, SQL, Classic XML/HTML, Javascript, Flash) but also updated to today's standards (RESTful transactions, NoSQL, HTML5, Ajax/Json, Flex2).
Who: Andre Gironda
Andre got his start on Unix-TCP/IP hacking before the September that never ended. Bored of embedded platform research by the time the dot-Bomb happened, he joined the largest online auction company, worked as an appsec consultant for many years, and recently joined a large online gaming company. He is known for his quirky mailing-list posts and blog comments -- and at one time wrote for tssci-security.com.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: August 12, 2010, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by WhiteHat Security)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: July 27, 2010, 11:30am - 1:00pm
Topic: Data Attack Anatomy: Stopping Bad Guys & Satisfying Auditors with Pragmatic Database Security
Corporate databases and their contents are under siege. From outside the organization, criminals can exploit web applications to steal confidential information for financial gain. From the inside, databases can be compromised by employees and contractors with malicious intent. SQL Injection, platform vulnerabilities, buffer overflows ... databases are vulnerable to a myriad of threats and attack vectors.
In this session John Marler, a Senior Security Engineer with Imperva, will discuss the challenges of data security requirements imposed by today’s regulations, how organizations are achieving success and why organizations should do more than comply.
Who: John Marler (Imperva)
John is a Senior Security Engineer with Imperva and has a decade of experience in designing, deploying and managing large infrastructure and network security solutions for Fortune 500 enterprises. After seven years with Dell IT, John moved into a network security consulting role for an IBM partner and went on to evangelize network security consolidation and simplification with Crossbeam Systems. Currently he is a senior security engineer with Imperva and specializes in web application and database security.
John is a graduate of Texas A&M University with a BBA in Information and Operations Management and holds multiple industry certs including Cisco networking & design specializations, CheckPoint firewall, and TippingPoint IPS.
Where: National Instruments, 11500 N Mopac, Building B which is the 5-story building on campus. There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: James Wickett (512) 964-6227.
RSVP on the Austin OWASP Ning Site
When: July 15, 2010, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Praetorian)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: June 29, 2010, 11:30am - 1:00pm
Topic: AJAX Security
We will discuss what AJAX is, and how the different technologies combine to make it up. We will discuss some of the unique features, toolkits, and coding considerations, as well as security pitfalls, and ways to protect and detect them.
- Introduction to AJAX
- Security Issues with architecture
- Toolkits
- Toolkit Security Concerns
- Bridges and Issues
- Attacking AJAX
- Defending AJAX
- Securing the Code
- Best Practices
- Other Issues and Concerns
- Q and A
Who: Brad Causey
Brad Causey is an active member of the security and forensics community worldwide. Brad tends to focus his time on Web Application security as it applies to global and enterprise arenas. He is currently employed at a major international financial institution as a security analyst. Brad is the President of the OWASP Alabama chapter, a member of the OWASP Global Projects Committee and a contributor to the OWASP Live CD. He is also the President of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer with hundreds of publications and several books. Brad currently holds certifications in the following arenas: MCSA, MCDBA, MCSE, MCT, MCP, GBLC, GGSC100, C|EH, CIFI, CCNA,IT Project Management+, Security+, A+, Network+, CISSP, CGSP.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: June 17, 2010, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Set Solutions)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: May 25, 2010, 11:30am - 1:00pm
Topic: Javascript Hijacking
This attack is an offshoot of Cross-Site Request Forgery (CSRF) and is common when AJAX is involved. It was well publicized in 2007 when the gmail contact list was found by Jeremiah Grossman to be vulnerable to it. This presentation will include a technical explanation of the attack, a demonstration, and a discussion.
Who: Ben Broussard (UT Austin)
Ben Broussard is a developer for the University of Texas at Austin with an academic background in mathematics, specifically cryptography. At UT he has translated and prioritized web application attacks in relation to the environment that the developers are working in. Ben is currently leading a web application security focused team of developers from different departments around campus.
Topic: Attacking Intranets from the Web Using DNS Rebinding
DNS Rebinding works by implementing code that circumvents the web browser's same-origin policy and penetrates your private network. The exploit was popularized by RSnake in 2009. This presentation will explore how DNS Rebinding works, a walk-thru of a running demo, and what it means to your organization.
Who: James Wickett (National Instruments)
James is the current Vice President of the Austin OWASP chapter and the former President. He works for National Instruments as a Web Systems Engineer in the R&D department. Current certifications: CISSP, GCFW, GWAS
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: May 20, 2010, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by BlueCoat)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: April 27, 2010, 11:30am - 1:00pm
Topic: Automated vs. Manual Security: You can't filter The Stupid
Everyone wants to stretch their security budget, and automated application security tools are an appealing choice for doing so. However, manual security testing isn’t going anywhere until the HAL application scanner comes online. This presentation will use often humorous, real-world examples to illustrate the relative strengths and weaknesses of automated solutions and manual techniques.
Automated tools have some strengths, namely low incremental cost, detecting simple vulnerabilities, and performing highly repetitive tasks. However, automated solutions are far from perfect. There are entire classes of vulnerabilities that are theoretically impossible for automated software to detect. Examples include complex information leakage, race conditions, logic flaws, design flaws, and multistage process attacks. Beyond that, there are many vulnerabilities that are too complicated or obscure to practically detect with an automated tool.
Who: Charles Henderson (Trustwave)
Charles Henderson has been in the security industry for over 15 years and manages the Application Security Practice at Trustwave. He has specialized in application security testing and application security assessment throughout his career but has also worked in physical security testing and network security testing.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: April 22, 2010, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Fortify)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: March 30, 2010, 11:30am - 1:00pm
Topic: Enterprise Application Security Practices: Real-world Tips and Techniques
How can you re-energize your company’s or institution’s commitment to secure development practices as part of the SDLC, while keeping costs in check? Dell's Security Consulting team created an application security practice with the help of several internal teams in legal, enterprise architecture, vendor management, privacy, compliance, and network engineering. Team members Addison Lawrence, Chad Barker, and Mike Craigue will discuss some of the challenges and opportunities they have faced over the last three years, ramping from 27 project engagements in 2007, to 726 project engagements in 2009. In this session, we will discuss the creation of policies/standards, deploying a Security Development Lifecycle as an overlay to the SDLC, overcoming concerns of developers and business partners, and addressing global standardization issues. Also included: awareness/education/training, application security user groups, security consulting staff development, risk assessments, security reviews, threat modeling, source code scans, deployment scans, penetration testing, exception management, and executive escalations. Tell us what we might do to improve our program and increase our effectiveness; discuss how you could adapt parts of this approach to your own program.
Who: Addison Lawrence, Chad Barker, and Mike Craigue (Dell, Inc.)
Addison Lawrence has 10 years of experience at Dell with leadership responsibilities in database and data warehouse security, PCI, SOX, and Dell Services security. He is a part of the Cloud Security Alliance team developing their Controls Matrix. Previously he worked for 13 years at Mobil Oil (now ExxonMobil) as a software developer and DBA. He holds an MBA from Texas A&M University and a BS in Computer Science from Texas A&M-Corpus Christi, and is a certified CISSP.
Chad has worked at Dell for 10 years primarily in software development. Chad has led global development standardization initiatives including release management automation and static source code analysis. He holds a BS in Information Systems from the University of Texas at Arlington.
Before joining Dell’s information security team 5 years ago, Mike worked as a database and web application developer at Dell and elsewhere in central Texas. He’s responsible for Dell’s application security strategy globally, and focuses primarily on Dell’s ecommerce site. He holds a PhD in Higher Education Administration / Finance from the University of Texas-Austin, and has the CISSP and CSSLP certifications.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: March 18, 2010, 5:00pm - 7:00pm
What: Austin Security Professionals Happy Hour (Sponsored by Denim Group)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: February 23, 2010, 11:30am - 1:00pm
Topic: Advanced Persistent Threat - What Does it Mean for Application Security?
Targeted attacks, slow moving malware, foreign intelligence/government sponsored hackers, corporate/industrial espionage – all fun and games? Not really. These vectors are occurring today, and the threat vector has bled into the application space. What do you have to contend with once it passes through the firewall.
Who: Matt Pour (Blue Coat Systems)
Matt is a Systems Engineer for Blue Coat Systems. Utilizing over ten years of information security experience, Matt provides subject matter expertise of ensuring security effectiveness while addressing business controls and requirements to a multitude of industries regardless of size and scope. Previous to Blue Coat Systems, Matt Pour was a Security Solutions Architect and X-Force Field Engineer for IBM ISS.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: February 11, 2010, 5:00pm - 7:00pm
What: Austin Security Executives Happy Hour (Sponsored by WhiteHat Security)
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: January 26, 2010, 11:30am - 1:00pm
Topic: Reducing Your Data Security Risk Through Tokenization
The first Austin OWASP meeting of the year is on a really interesting topic that many of you have probably never thought about: Tokenization. The concept is simple...use tokens to represent your data instead of passing around the data itself. For example, why would you give a customer account representative a full credit card number when all they need to do their job is the last four digits? Using tokenization, we are able to reduce the data security risk by limiting the number of systems that actually store the data. This extremely simplifies audits for regulations like SOX, HIPAA, and PCI DSS. This presentation will cover the business drivers for data protection, what tokenization is, and how to implement it. If your organization has data to protect, then you're going to want to check out this presentation.
Who: Josh Sokol (National Instruments)
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the Web Admin Blog.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Josh Sokol (512) 619-6716.
RSVP on the Austin OWASP Ning Site
When: January 14, 2010, 5:00pm - 7:00pm
What: Austin Security Executives Happy Hour
Where: Sherlock's (9012 Research Blvd, Austin, TX 78757)
When: November 17, 2009, 11:30am - 1:00pm
Topic: Tracking the progress of an SDL program: lessons from the gym
Forcing muscle growth is a long process which requires high intensity weight training and high mental concentration. While the ultimate goal is often clear, one of the greatest mistakes bodybuilders consistently make is to overlook the importance of tracking their weight lifting progress.
Like a successful bodybuilding workout, a security development lifecycle program must consistently log simple to obtain, yet meaningful metrics throughout the entire process. Good metrics must lack subjectivity and clearly aid decision makers to determine areas that need improvement. In this presentation we’ll discuss metrics used to classify and appropriately compare security vulnerabilities found in different phases of the SDL by different teams working in different locations and in different products. We’ll also discuss how to easily provide decision makers different views of the same data and verify whether the process is indeed catching critical vulnerabilities internally.
Who: Cassio Goldschmidt (Symantec)
Cassio Goldschmidt is senior manager of the product security team under the Office of the CTO at Symantec Corporation. In this role he leads efforts across the company to ensure the secure development of software products. His responsibilities include managing Symantec’s internal secure software development process, training, threat modeling and penetration testing. Cassio’s background includes over 12 years of technical and managerial experience in the software industry. During the six years he has been with Symantec, he has helped to architect, design and develop several top selling product releases, conducted numerous security classes, and coordinated various penetration tests.
Cassio represents Symantec on the SAFECode technical committee and (ISC)2 in the development of the CSSLP certification. He holds a bachelor degree in computer science from Pontificia Universidade Catolica do Rio Grande Do Sul, a masters degree in software engineering from Santa Clara University, and a masters of business administration from the University of Southern California.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: James Wickett 512-964-6227.
RSVP on the Austin OWASP Ning Site
When: October 27, 2009, 11:30am - 1:00pm
Topic: Vulnerability Management In An Application Security World
Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities.
This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.
Who: Dan Cornell (Denim Group)
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies.
Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: James Wickett 512-964-6227.
RSVP on the Austin OWASP Ning Site
When: September 29, 2009, 11:30am - 1:00pm
Topic: OWASP ROI: Optimize Security Spending using OWASP
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budget-friendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a not-for-profit entity and provides unbiased, practical, cost-effective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study the company realized annual reduction in spending of several hundred thousand dollars.
Who: Matt Tesauro
Matt Tesauro has worked in web application development and security since 2000. He has worn many different hats, from developer to DBA to System Administrator to Penetration Tester. Matt also taught graduate and undergraduate classes on web application development and XML at the Texas A&M Mays Business School. Currently, he's focused on web application security, developing a Secure SDLC and launching a two-year application security program for Texas Education Agency (TEA). Outside work, he is the project lead for the OWASP Live CD, a member of the OWASP Global Tools and Projects Committee, part of the local OWASP chapters leadership and the membership directory of ISSA of Austin, Tx. Matt Tesauro has a B.S. in Economics and a M.S in Management Information Systems from Texas A&M University. He is also has the CISSP, CEH (Certified Ethical Hacker), RHCE (Red Hat Certified Engineer), and Linux+ certifications.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: James Wickett 512-964-6227.
When: August 25, 2009, 11:30am - 1:00pm
Topic: Threat Modeling
In this talk, Michael will discuss Microsoft SDL Threat Modeling, how to apply it to design more secure applications and finally, will show a demo and hold a short lab exercise.
Who: Michael Howard, PRINCIPAL Security Program Manager, Microsoft's Security Engineering Team
Michael Howard is a principal security program manager on the Trustworthy Computing (TwC) Group’s Security Engineering team at Microsoft, where he is responsible for managing secure design, programming, and testing techniques across the company. Howard is an architect of the Security Development Lifecycle (SDL), a process for improving the security of Microsoft’s software.
Howard began his career with Microsoft in 1992 at the company’s New Zealand office, working for the first two years with Windows and compilers on the Product Support Services team, and then with Microsoft Consulting Services, where he provided security infrastructure support to customers and assisted in the design of custom solutions and development of software. In 1997, Howard moved to the United States to work for the Windows division on Internet Information Services, Microsoft’s next-generation web server, before moving to his current role in 2000.
Howard is an editor of IEEE Security & Privacy, a frequent speaker at security-related conferences and he regularly publishes articles on secure coding and design, Howard is the co-author of six security books, including the award-winning Writing Secure Code, 19 Deadly Sins of Software Security, The Security Development Lifecycle and his most recent release, Writing Secure Code for Windows Vista
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: James Wickett 512-964-6227.
When: July 28, 2009, 3:30pm - 5:00pm
Topic: Slowloris: A DOS tool for Apache
Slowloris was designed and developed as a low bandwidth denial of service tool to take advantage of an architectural design flaw in Apache web servers. It was quickly picked up and used by Iranian government protesters. This speech will cover the technical issues around the design flaw, and the events prior to, during and since the release of the tool.
Who: RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: James Wickett 512-964-6227.
When: June 25, 2009, 5:00pm - 8:00pm
Topic: OWASP/ISSA/ISACA June Happy Hour Sponsored by VMWare!!!
Where: Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info
When: June 30, 2009, 3:30pm - 5:00pm
Topic: Web 2.0 Cryptology - A Study in Failure
Who: Travis
Travis's Bio: Travis H. is an jack-of-all-trades and independent security enthusiast. He has worked in the AFCERT looking for intrusions into Air Force computers, and handled application security and cryptography issues for Paypal. He is currently a programmer for Giganews in Austin. He is also the author of an online book on security called "Security Concepts", located here:
http://www.subspacefield.org/security/security_concepts.html
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Scott Foster 512-637-9824.
When: May 26, 2009, 11:30am - 1:00pm
Topic: Clickjack This!
This speech will cover clickjacking - one of the most obscure client side hacking techniques. After the speech at the world OWASP conference was canceled due to Adobe asking for more time to construct a patch, Robert Hansen never ended up doing a complete speech on the topic. This presentation will cover some of the history of how this exploit came to be, how it works, and how it eventually turned into real world weaponized code.
Who: RSnake, Robert Hansen, CEO of SecTheory, ha.ckers.org
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: James Wickett 512-964-6227.
When: April 28, 2009, 11:30am - 1:00pm
Topic: Architecting Secure Web Systems
For this month's presentation, we diverge from the typical OWASP topics of writing secure code, testing to make sure your code is secure, and other code related topics and delve into the process of actually architecting a secure web application from the ground up. We'll start with some basic n-tier architecture (web vs app vs DB), throw in some firewall and DMZ concepts, then talk about server hardening with client firewalls (iptables), disabling services, and other techniques. Whether you're a code monkey wondering how the rest of the world works, a security guy trying to figure out what you're missing, or an auditor just trying to understand how the pieces fit together, this presentation is for you.
Who: Josh Sokol
Josh's Bio: Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the Web Admin Blog and recently presented at the TRISC 2009 Conference.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Scott Foster 512-637-9824.
When: April 23rd, 2009, 5:00pm - 7:00pm
Topic: OWASP April Happy Hour
Where: Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info
When: March 31, 2009, 11:30am - 1:00pm
Topic: PCI Compliance and Web App Security
The purpose of this presentation is to give an objective view of PCI Compliance including the good, the bad and the ugly.
Topics covered include:
What do an ASV really do.
What does a QSA really do.
What does an ASV scan really pick up.
Are you really secure when you are compliant.
A product neutral look at how to get the most out of your compliance push.
Who: Fritz has more than five years of experience in offensive and defensive security practices and strategies. Since 2006 Fritz has been dedicated to managing PCI Data Security Standards (PCI DSS) for ControlScan as well as helping to develop products and services that are designed to make it easier for small merchants to complete and maintain compliance and long term security best practices. Fritz also authors regular security briefings on www.pcicomplianceguide.org <http://www.pcicomplianceguide.org/> and addresses the "Ask the Expert" questions on the site.
Fritz a member of the Application Security Group of the SPSP (The Society of Payment Security Professionals), a participant on the PCI Knowledge Base's Panel of Experts and is a Certified Information Systems Security Professional (CISSP).
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Scott Foster 512-637-9824.
When: February 24, 2009, 11:30am - 1:00pm
Topic: Web Application Security in the Airline Industry: Stealing the Airlines’ Online Data
In this session, attendees will learn about the types of airline data that is at risk of being stolen by online data thieves. In addition, the following topics will be further explored:
1. Important attack scenarios and Web-based vulnerabilities accompanied by examples of how these attacks can be mitigated by deploying comprehensive defense solutions;
2. Protection strategies and tools, such as Web application scanners and Web application firewalls, which help equalize the gap between the advanced Web hacker and the security professional; and
3. Compliance and Software development life cycle approaches.
Following the September 11 attacks, the airline industry recognized its need to ‘webify’ online ticket reservation systems, crew scheduling, and passenger profiles in order to enhance operational efficiency. This ultimately served to decrease the airlines’ operating costs, thereby increasing their operating profits. However, the following questions remain: At what costs? What are the information systems and customer data security risks associated with the airline ‘webification’ process?
Please join in this presentation, which will outline some of the challenges that members of the airlines industry may face when attempting to protect their online services. Additionally, attendees will discover methodologies that airlines may utilize to identify, assess, and protect against the various risks associated with Web-based application attacks.
Who: Quincy Jackson
Quincy Jackson, a CISSP and Certified Ethical Hacker, has more than 15 years of experience in the Information Technology (“IT”) profession, which include 8 years in Information Security. In addition, Quincy has 15 years in the aviation industry. His career in the aviation industry began in the United States Army as an Avionics System Specialist. Quincy began to explore his passion for IT Security as Sr. Manager - Information Security for Continental Airlines. Over his 8-year tenure at Continental Airlines, Quincy was instrumental in the development of the Company’s first Information Security Program. Quincy currently serves as the IT Security Manager for Universal Weather and Aviation, Inc. (“UWA”). UWA provides business aviation operators various aviation support services, including flight coordination, ground handling, fuel arrangement and coordination, online services, and weather briefings. Quincy enjoys both learning about and sharing his knowledge of Web application security with others, including ISSA and OWASP members.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Scott Foster 512-637-9824.
When: March 26th, 2009, 5:00pm - 7:00pm
Topic: OWASP March Happy Hour
Where: Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info
When: February 5th, 2009, 5:00pm - 7:00pm
Topic: OWASP Live CD Release Party
Where: Sherlock's in Austin (183 and Burnet area near Furniture Row) - See http://austinowasp.ning.com/ for more info
When: January 27, 2009, 11:30am - 1:00pm
Topic: Cross-Site Request Forgery attacks and mitigation in domain vulnerable to Cross-Site Scripting.
The presentation will include the following topics in addition to a hands-on demonstration for each portion of the talk:
1. The statelessness of the internet
2. How the naive attack works
3. A mitigation strategy against this naive attack
4. An combined CSRF/XSS attack that defeats this mitigation strategy
5. And finally suggestions for mitigation of the combined attack
Who: Ben L Broussard
I am new in the world of Web App security; my passion started when I took a continuing education class related to Web App security. My background is in Number Theory with an emphasis in Cryptography and especially Cryptanalysis. I am an avid puzzler, taking 2nd place (along with my teammates) at UT in this year's Microsoft College Puzzle Challenge. I am currently a developer (database and web apps) for the Accounting department of The University of Texas at Austin.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
When: October 28, 2008, 11:30am - 1:00pm
Who: Josh Sokol
Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the Web Admin Blog.
Topic: Using Proxies to Secure Applications and More
The last Austin OWASP presentation of the year is a must see for anyone responsible for the security of a web application. It is a demonstration of the various types of proxy software and their uses. We've all heard about WebScarab, BurpSuite, RatProxy, or Paros but how familiar are you with actually using them to inspect for web security issues? Did you know that you can use RatProxy for W3C compliance validation? By the time you leave this presentation, you will be able to go back to your office and wow your co-workers with the amazing new proxy skills that you've acquired.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Scott Foster 512-637-9824.
When: September 30, 2008, 11:30am - 1:00pm
Who: Josh Sokol
Josh's Bio: Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as a Web Systems Administrator at National Instruments. In his current role, Josh provides expertise in topics such as web application availability, performance, and security. Josh is also a frequent contributor on the Web Admin Blog.
Topic: OWASP AppSec NYC Conference 2008
Where: Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store.
See directions to Whole Foods.
Cost: Always Free
Questions or help with Directions... call: Scott Foster 512-637-9824.
When: August 26th, 2008, 11:30am - 1:00pm
Who: Matt Tesauro
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the topic of this talk: OWASP Live CD 2008.
Topic: OWASP Live CD 2008 - An OWASP Summer of Code Project
The OWASP Live CD 2008 project is an OWASP SoC project to update the previously created OWASP 2007 Live CD. As the project lead, I'll show you the latest version of the Live CD and discuss where its been and where its going. Some of the design goals include:
- easy for the users to keep the tools updated
- easy for the project lead to keep the tools updated
- easy to produce releases (I'm thinking quarterly releases)
- focused on just web application testing - not general Pen Testing
OWASP Project Page: http://www.owasp.org/index.php/Category:OWASP_Live_CD_2008_Project
Project Wiki: http://mtesauro.com/livecd/
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
Cost: Always Free
Questions or help with Directions... call: Scott Foster 512-637-9824.
When: July 29th, 2008, 11:30am - 1:00pm
Who: Whurley and Mando
William Hurley is the Chief Architect of Open Source Strategy at BMC Software, Inc. Also known as "whurley", he is responsible for creating BMC's open source agenda and overseeing the company's participation in various free and open source software communities to advance the adoption and integration of BSM solutions. A technology visionary and holder of 11 important patents, whurley brings 16 years of experience in developing groundbreaking technology. He is the Chairman of the Open Management Consortium, a non-profit organization advancing the adoption, development, and integration of open source systems management. Named an IBM Master Inventor, whurley has received numerous awards including an IBM Pervasive Computing Award and Apple Computer Design Award.
Mando Escamilla is the Chief Software Architect at Symbiot, Inc. He is responsible for the technical vision and architecture for the Symbiot product line as well as the technical direction for the openSIMS project. He stands (mostly firmly) on the shoulders of giants at Symbiot and he hopes to not embarrass himself.
Topic: The rebirth of openSIMS http://opensims.sourceforge.net Correlation, visualization, and remediation with a network effect
OpenSIMS has a sordid history. The project was originally a way for tying together the open source tools used for security management into a common infrastructure. Then the team added a real-time RIA for a new kind of analysis and visualization of enterprise network security (winning them an Apple Design Award in 2004). Then out of nowhere the project went dark. Now, Mando Escamilla (Symbiot/openSIMS) and whurley give you a look at the future of openSIMS as a services layer and explain why community centric security is valuable to your enterprise.
Where: Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store.
See directions to Whole Foods.
Cost: Always Free
Questions or help with Directions... call: Scott Foster 512-637-9824.
When: June 24th, 2008, 11:30am - 1:00pm
Who: Matt Tesauro (presenting) and A.J. Scotka, Texas Education Agency
Matt's Bio: Matt Tesauro has worked in web application development and security since 2000. He's worn many different hats, from developer to DBA to sys admin to university lecturer to pen tester. Currently, he's focused on web application security and developing a Secure SDLC for TEA. Outside work, he is the project lead for the OWASP SoC Live CD project: https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Applications#OWASP_Live_CD_2008_Project
A.J.'s Bio: A. J. Scotka Senior Software Quality Engineer, Texas Education Agency As an ASQ Certified Software Quality Engineer (CSQE), A. J. is currently responsible for quality reviews on design and code, software configuration management process, build engineering process, release engineering process, verification and validation throughout the life cycle and over all quality improvement across all areas of enterprise code manufacturing.
Topic: Securely Handling Sensitive Configuration Data.
One of the age old problems with web applications was keeping sensitive data available on a need to know basis. The classic case of this is database credentials. The application needs them to connect to the database but developers shouldn't have direct access to the DB - particularly the production DB. The presentation will discuss how we took on this specific problem, our determination that this was a specific case of a more general problem and how we solved that general problem. In our solution, sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs). We will then cover our implementation of that solution in a .Net 2.0 environment and discuss some options for J2EE environments. So far, we used our .Net solution successfully for database credentials and private encryption keys used in XML-DSig. Sensitive data is only available to the application and trusted 3rd parties (e.g. DBAs).
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
When: May 27th, 2008, 11:30am - 1:00pm
Who: Nathan Sportsman and Praveen Kalamegham, Web Services Security
Topic: Web Services Security The concept of web services has become ubiquitous over the last few years. Frameworks are now available across many platforms and languages to greatly ease and expedite the development of web services, often with a vast amount of existing code reuse. Software companies are taking advantage of this by integrating this technology into their products giving increased power and interoperability to their customers. However, the power web services enables also introduces new risks to an environment. As with web applications, development has outpaced the understanding and mitigation of vulnerabilities that arise from this emerging technology. This presentation will first aim to identify the risks associated with web services. We will describe the existing security standards and technologies which target web services (i.e., WS-Security) including its history, pros and cons, and current status. Finally we will attempt to extrapolate the future of this space to determine what changes must be made going forward.
Where: Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store.
See directions to Whole Foods.
When: April 29th, 2008, 11:30am - 1:00pm
Who: Mano Paul
Bio Manoranjan (Mano) Paul started his career as a Shark Researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with a 4.0 GPA and valedictory accolades. Partnering with (ISC)2, the global leader in information security certification and education, he founded and serves as the President & CEO of Express Certifications, a professional certification assessment and training company whose product (studISCope) is (ISC)2’s OFFICIAL self assessment offering for renowned security certifications like the CISSP® and SSCP®. Express Certifications is also the self assessment testing engine behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded and serves as the CEO of SecuRisk Solutions, a company that specializes in three areas of information security - Product Development, Consulting, and Awareness, Training & Education.
What: Security – The Road Less Travelled
Abstract - What do you think Shakespeare had to say about Software Security? What does an naked motorist have to do with Confidentiality? What does the Jungle Book character Baloo have to say about Security Essentials (The Bear Bare Necessities of Life security)? What does the African Wildlife have to do with Security Concepts? What does pH have to do with Security? and more … The Road Less Travelled by renowed poet, Robert Frost ends by with the statement “And that has made all the difference”. Come to find out the answers to the questions above and see what it takes to look at Security from a different perspective, that would make ALL the difference. The session will cover not only the higher level abstractions of security concepts, but will dive deep wherever applicable into concepts and code, making it a MUST attend for Development, QA, PM and Management Staff on both the IT and Business side. Also, if you are interested in becoming a CISSP® or SSCP®, come find out about the official (ISC)2 self-assessment tool developed by Express Certifications to aid candidates in their study efforts and how you can get valuable discounts.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
When: March 25th, 2008, 11:30am - 1:00pm
Who: Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax
Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies.
Topic: Static Analysis Techniques for Testing Application Security
Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes.
Where: Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store.
See directions to Whole Foods.
When:February 26th, 2008 - Michael Howard, Author of Writing Secure Code
Topic: Microsoft's SDL: A Deep Dive
In this presentation, Michael will explain some of the inner workings of the SDL as well as some of the decision making process that went into some of the SDL requirements. He will also explain where SDL can be improved.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
January 29th, 2008 - Mark Palmer, Hoovers and Geoff Mueller, NI @ WHOLE FOODS, Downtown
Where: Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store.
See directions to Whole Foods.
When: December 4th, 2007, 11:30am - 1:00pm
Who: Jeremiah Grossman (WhiteHat Security, CTO, OWASP Founder, Security Blogger)
Topic: Business Logic Flaws
Session handling, credit card transactions, and password recovery are just a few examples of Web-enabled business logic processes that malicious hackers have abused to compromise major websites. These types of vulnerabilities are routinely overlooked during QA because the process is intended to test what a piece of code is supposed to do and not what it can be made to do. The other problem(s) with business logic flaws is scanners can’t identify them, IDS can’t detect them, and Web application firewalls can’t defend them. Plus, the more sophisticated and Web 2.0 feature-rich a website, the more prone it is to have flaws in business logic.
This presentation will provide real-world demonstrations of how pernicious and dangerous business logic flaws are to the security of a website. He’ll also show how best to spot them and provide organizations with a simple and rational game plan to prevent them.
Where: National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
November 27th, 2007 Austin OWASP chapter meeting - Robert Hansen (SecTheory.com, ha.ckers.org and is regarded an expert in Web Application Security)
Robert will be talking about different ways to de-anonymize and track users both from an offensive and defensive standpoint. He will discuss how the giants of the industry do it and next generation tactics alike.
Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. See directions to Whole Foods.
October 2007 Austin OWASP chapter meeting October 30th, 11:30am - 1:00pm at National Instruments "Social networking" - Social networking is exploding with ways to create your own social networks. As communities move more and more online and new types of communities start to form, what are some of the security concerns that we have and might face in the future? by Rich Vázquez, and Tom Brown.
September 2007 Austin OWASP Chapter September 2007 - Tue, September 25, 2007 11:30 AM – 1:00 PM at Whole Foods Meeting 550 Bowie Street, Austin "Biting the hand that feeds you" - A presentation on hosting malicious content under well know domains to gain a victims confidence. "Virtual World, Real Hacking" - A presentation on "Virtual Economies" and game hacking. "Cover Debugging - Circumventing Software Armoring techniques" - A presentation on advanced techniques automating and analyzing malicious code.
August 2007 Austin OWASP chapter meeting - 8/28, 11:30am - 1:00pm at National Instruments. Josh Sokol presented on OWASP Testing Framework and how to use it, along with free and Open Source tools, in a live and interactive demonstration of web site penetration testing.
July 2007 Austin OWASP chapter meeting - 7/31, 11:30am - 1:00pm at Whole Foods. Dan Cornell will be presenting on Cross Site Request Forgery
June 2007 Austin OWASP chapter meeting - 6/26, 11:30am - 1:00pm at National Instruments. James Wickett from Stokes Cigar Club presented on OWASP Top 10 and using Web Application Scannners to detect Vulnerabilities.
May 2007 Austin OWASP chapter meeting - 5/29, "Bullet Proof UI - A programmer's guide to the complete idiot". Robert will be talking about ways to secure a web-app from aggressive attackers and the unwashed masses alike.
April 2007 Austin OWASP chapter meeting - 4/24, 11:30am - 1:00pm at National Instruments. H.D. Moore (creator of MetaSploit will be presenting)
March 2007 Austin OWASP chapter meeting - 3/27, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C which is the tallest building on campus (8 levels). There will be signs posted in the lobby to direct you where to go and the receptionists will be able to assist you as well. See directions to National Instruments.
January 2007 Austin Chapter Meeting - 1/30, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S15.
December Meeting - Due to the holidays, there will be no December OWASP meeting. However, we are looking for speakers for the January meeting. If you or anyone you know would be a good candidate, let us know! Happy Holidays!
November 2006 Austin Chapter Meeting - 11/21, 11:30am - 1:00pm at National Instruments, 11500 N Mopac, Building C Conference Room 1S14.
October 2006 Austin Chapter Meeting - 10/31 - Boo!
September 2006 Austin Chapter Meeting - 9/26, 12-1:00 at Texas ACCESS Alliance building located at the intersection of IH-35 South and Ben White
August 2006 Austin Chapter Meeting - Tuesday- 8/29, 11:30-1:30 on the National Instruments campus, Mopac B (the middle building), conference room 112 (in the Human Resources area to the left of the receptionist). See directions to National Instruments. Hint: It is on your left on Mopac if you were heading up to Fry's from Austin.
Austin OWASP chapter kickoff meeting - Thursday, 7/27, 12-2pm @ Whole Foods Market (downtown, plaza level, sign in with receptionist)
Recent presentation recordings can be found at the Vimeo OWASP Austin Channel
The following presentations have been given at local chapter meetings:
- August 2011 - Protecting Your Applications From Backdoors by Joe Brady
- June 2011 Half-Day - Penetration Testing with Metasploit by Raphael Mudge
- May 2011 - Why Ha.ckers.org Doesn't Get Hacked by James Flom
- February 2011 - Supercharged Password Cracking Techniques by Rick Redmond
- August 2010 - Application Assessments Reloaded
- January 2010 - Reducing Your Data Security Risk Through Tokenization by Josh Sokol
- September 2009 - OWASP ROI: Optimize Security Spending using OWASP
- August 2009 - Threat Modeling
- April 2009 - Architecting a Secure Web System by Josh Sokol
- October 2008 - Using Proxies to Secure Applications and More by Josh Sokol
- August 2007 - OWASP Testing Framework
- July ? - A Rough Start of a Toolset for Assessing Java/J2EE Web Apps - MattFranz discussed some custom Python tools he has been writing for conducting security testing of a Struts (and other Java) web applications.
- August ? - AJAX Security: Here we go again - Dan Cornell from Denim Group discussed security issues in the one the popular Web 2.0 technlogy
Kyle Smith, Chapter Leader
David Hughes, Board Member
Josh Sokol, Board Member
James Wickett, Board Member, Conference Czar
Tiana Chandler, Training/Study Coordinator
Matt Snider, Sponsor Coordinator
Kate Brew, Speaker and Special Event Coordinator
Mike Cherry, Special Projects, South
Joseph Schoefield, Special Projects/Chapter Outreach, North
The Austin OWASP Chapter can offer your company three unique sponsorship opportunities. If you are interested in taking advantage of any of these opportunities, please contact Kyle Smith, the Austin OWASP Chapter President.
Opportunity #1 - Austin Security Professionals Happy Hour Sponsorship
The Austin OWASP Chapter organizes a monthly Austin Security Professionals Happy Hour event along with the Capitol of Texas ISSA Chapter. This event has historically drawn around 30 of Austin's finest security professionals for networking and more. Your sponsorship of this event includes appetizers and drinks for the attendees. Feel free to pass out business cards and network just like you would anywhere else. You'll find no better opportunity to get your name in front of 30+ security professionals for around $500.
Opportunity #2 - OWASP Meeting Lunch Sponsorship
Our monthly Austin OWASP meetings are held during a person's typical lunch hours from 11:30 AM to 1:00 PM. For your sponsorship of around $750 we can arrange food and drinks for up to 60 attendees. In exchange for your sponsorship, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the lunch sponsor in all e-mail communications about the meeting.
Opportunity #3 - OWASP Meeting Presenter Sponsorship
Although OWASP is a non-profit organization, we strive to provide our members with the best presenters we possibly can. While the Austin area has tons of security talent, sometimes it's worthwhile to reach beyond our borders to pull in more awesome presenters. In exchange for covering travel expenses for these presenters, our chapter will provide you with 5 minutes at the start of the meeting to introduce yourself and tell us about the products or services that your company offers. You'll also receive mention of being the presenter sponsor in all e-mail communications about the meeting.
If a link is available, click for more details on directions, speakers, etc. You can also review Email Archives to see what folks have been talking about.
<paypal>Austin</paypal>
How to add a new Austin article
You can follow the instructions to make a new Austin article. Please use the appropriate structure and follow the Tutorial. Be sure to paste the following at the end of your article to make it show up in the Austin category:
[[Category:Austin]]
