This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
OWASP New Zealand Day 2019
21st and 22nd February 2019 - Auckland
- Introduction
- Call for Volunteers
- Training - 21 Feb
- Presentation Schedule - 22 Feb
- Abstracts and Bios
- Call for Sponsorships
- Diversity Fund
- Code of Conduct
- Call for Presentations - CLOSED
- Call For Trainers - CLOSED
UPDATE #6 (15 February) - Registration for training classes is now CLOSED.
UPDATE #5 (23 January) - The presentation schedule, talk abstracts, and speaker bios have been posted. Check the "Presentation Schedule" and "Abstracts and Bios" tabs below.
UPDATE #4 (12 January) - The Call for Presentations is now closed. Those submitting proposals will be notified shortly whether their talks have been accepted.
UPDATE #3 (7 January) - Registration for Training Classes Now Open! Visit EventBrite to reserve your spot!
UPDATE #2 (22 December) - Registration Now Open! Visit EventBrite to register now!
IMPORTANT UPDATE (21 December) - Call for Presentations Extended: The Call for Presentations has been extended, and will now close on Friday, 11 January, 2019.
Introduction
We are proud to announce the tenth OWASP New Zealand Day conference, to be held at the University of Auckland on Friday, February 22nd, 2019. OWASP New Zealand Day is a one-day conference dedicated to information security, with an emphasis on secure architecture and development techniques to help Kiwi developers build more secure applications.
There will be two streams throughout the day. The first stream will include introductory talks on application and information security topics, as well as on policy, compliance, and risk management. The second stream will primarily address deeper technical topics.
Who is it for?
- Web Developers
- Security Professionals and Enthusiasts
- Program and Project Managers
- Business Analysts
- Requirements Analysts
- Software Testers
Conference structure
Date: Friday, 22 February 2019
Time: 9:00am - 6:00pm
Cost: FREE
The main conference is on Friday, the 22nd of February, and will have two streams in both the morning and the afternoon:
Stream One:
- Introductory Topics
- Program Management, Policy, Compliance, Risk Management
Stream Two:
- Technical Topics
Training
In addition the main conference on Friday, we are pleased to be offer three training opportunities on Thursday, at the same venue. Course details, including registration, are as follows:
Real-World Penetration Testing
Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 5:30 p.m.
Format: Live online interaction with instructors; interactive Web-based lab exercises
Instructors: Vivek Ramachandran and Nishant Sharma
Instructors' Organisation: Pentester Academy
Registration Fee: $500.00
Training Registration Page (Registration CLOSED)
Are You a Secure Code Warrior?
Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 12:30 p.m.
Instructor: Jaap Karan Singh
Instructor's Organisation: Secure Code Warrior
Registration Fee: $250.00
Training Registration Page (Registration CLOSED)
Threat Modelling: Getting from None to Done
Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 5:30 p.m.
Instructor: Dr. John DiLeo
Instructor's Organisation: OWASP New Zealand Chapter
Registration Fee: $500.00
Training Registration Page (SOLD OUT)
Training registration closed at midnight on 14 February.
General
The tenth OWASP New Zealand Day will be happening thanks to the support provided by the University of Auckland, which will kindly offer the same facilities as those we used in 2018. Entry to the event will, as in the past, be free.
For any comments, feedback or observations, please don't hesitate to contact us.
Registration
Registration is now open. Visit EventBrite to register.
Please join our low volume mailing list to be notified as further schedule information becomes available, and/or follow us on Twitter @owaspnz.
There is no cost for the main conference day. Currently, we are planning to provide morning and afternoon tea; however, this is subject to meeting our sponsorship goals for the event. Spaces are limited, so we do ask that, if at any point you realise you will not be able to attend, you cancel your registration (i.e., "request a refund" in EventBrite) to make room for others.
Important dates
| CFP submission deadline: | 11th January 2019 - Submissions are now closed |
|---|---|
| CFT submission deadline: | 21st December 2018 - Submissions are now closed |
| Training Day date: | 21st February 2019 |
| Training Registration Deadline: | 14th February 2019 - Registration is now closed |
| Conference Day date: | 22nd February 2019 |
| Conference Registration deadline: | 22nd February 2019 (Same-day registration is permitted, if space is available) |
For those of you booking flights, ensure you can be at the venue by 8:30am. The conference will end by 6:00pm. However, we will have post conference drinks at a local drinking establishment for those interested. We are planning to hold a special event on Thursday evening for speakers, trainers, sponsors, and conference volunteers - more details on that to follow.
Places to eat & drink on the day
The University published a handy map (in 2018), to help you find places to eat around campus: File:Retail Map City Campus 2018 v2.pdf
Some of the options available:
- The Deli - Located on Level 1 of the Owen G. Glenn Building - This is closest, but will probably have long lines
- Mojo Symonds - also on campus
- Shakey Isles - coffee and food across the road on the corner of Symonds & Alfred St
- The CBD - walk up and over Albert Park to get to the CBD with many great food options
- Fort Street has burgers, kebabs, and KFC
- High Street & Lorne Street have lots of little cafes and restaurants
- Subway, Starbucks, St. Pierre's Sushi & Pita Pit - walk up Symonds Street
- Vulture’s Lane is a popular pub with the InfoSec crowd, there are more seats downstairs
- The Bluestone Room - also a popular pub just across Queen St
Conference Venue
|
The University of Auckland School of Business |
|
Conference Sponsors
For more information on our Premier Sponsors, please visit our About Our Sponsors page
Conference Host
 |
Platinum Sponsor
 |
Gold Sponsors
 |
 |
 |
 |
Silver Sponsors
|
Sponsoring Provider - Training Day Tea Breaks  |
Supporting Sponsors
|
|
|
|
|
Follow us on Twitter (@owaspnz)
We're still looking for a few good men and women, to assist with conference preparations and to help things go smoothly during the event.
Please contact John DiLeo ([email protected]), if you're willing and able to help out.
Conference Committee
So, far, a fair few kind souls have stepped up to help out:
- John DiLeo - Conference Chair, OWASP New Zealand Leader (Auckland)
- Lech Janczewski - Conference Host Liaison, on-site Health & Safety contact - Associate Professor, University of Auckland School of Business
- Tess Brothersen
- Austin Chamberlain
- Teresa Chan
- Paul Howarth
- Toni James
- Arshad Khan
- Alex McClennan
- Stephen Sherry
- Anneke Smitheram
- Anthony Vargo
- Anya Yang
- YOU - We are still looking for volunteers to help out on the day, and make this our most successful conference yet!
Training
In addition the main conference on Friday, we are pleased to be offer three training opportunities on Thursday, at the same venue. Course details, including registration, are as follows:
Real-World Penetration Testing
Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 5:30 p.m.
Format: Live online interaction with instructors; interactive Web-based lab exercises
Instructors: Vivek Ramachandran and Nishant Sharma
Instructors' Organisation: Pentester Academy
Registration Fee: $500.00
Training Registration Page (Registration CLOSED)
Are You a Secure Code Warrior?
Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 12:30 p.m.
Instructor: Jaap Karan Singh
Instructor's Organisation: Secure Code Warrior
Registration Fee: $250.00
Training Registration Page (Registration CLOSED)
Threat Modelling: Getting from None to Done
Date: Thursday, 21 February 2019
Time: 8:45 a.m. - 5:30 p.m.
Instructor: Dr. John DiLeo
Instructor's Organisation: OWASP New Zealand Chapter
Registration Fee: $500.00
Training Registration Page (SOLD OUT)
Spaces are going fast, so get in quickly!
Check-in desk will be located in the Level 0 lobby (outside the Case Study Rooms), and will open at 8:00 a.m.
Morning and afternoon tea breaks will be provided; lunch will be on your own.
Presentations
22nd February 2019
| 08:00 | Registration Opens - Main Foyer, Owen G. Glenn Building | ||
| 09:00 |
Welcome to OWASP New Zealand Day 2019 | ||
|
Upstairs Auditorium (Room 115) |
Downstairs Auditorium (Room 098) |
||
| 09:20 |
Exploiting Vulnerabilities from the OWASP Top 10: SQLi, XSS, XXE, File Injection |
09:20 |
Virtual Patching: Does It Work? |
| 10:10 |
Threat Modelling When You've Never Done It Before |
10:10 |
Cloud Catastrophes and How to Avoid Them |
| 10:45 |
That Vulnerability Looks Quite Risky |
10:45 |
JWAT: Attacking JSON Web Tokens |
| 11:20 |
Mob Learning Using the OWASP Top 10 and 30 Days of Security Testing |
||
| 11:40 |
How Can OWASP SAMM Help You Build More Secure Software? |
11:40 |
CTF: The Gateway Drug |
| 12:10 |
Break for Lunch |
||
| 13:30 |
NoHolidayChurchGenius: Password Security with 2020 Vision |
13:30 |
Security Regression Testing on OWASP ZAP Node API |
| 14:05 |
Sharing Is Caring: A Beginner's Guide to Security in the Cloud |
||
| 14:25 |
Eating the Elephant: Application Security When You Aren't a Startup |
14:25 |
CI Can Make $$$ from Thin Air |
| 15:00 |
What's In a Name? Law of Agency and Domain Name Registrations |
15:00 |
Introduction to Building Secure Electron Applications |
| 15:30 |
Break for Afternoon Tea - Coffee / Tea Service Provided |
||
| 16:00 |
How Do I Content Security Policy? |
16:00 |
Hardening Your Docker Infrastructure |
| 16:50 |
OWASP Software Assurance Maturity Model (SAMM) 2.0 |
16:50 |
Reverse Engineering Mobile Apps: Why, What, and the Hows |
| 17:25 |
Why 'Positive Security' Is the Next Software Security Game Changer, and How to Do It |
17:25 |
Serverless Authentication with JWT |
| 18:00 |
Wrap Up |
||
Presentation Abstracts and Speaker Biographies
Track One - Morning (09:20 - 12:10)
Exploiting Vulnerabilities from the OWASP Top 10: SQLi, XSS, XXE, File Injection
David Waters and Kieran Molloy - Pushpay
Abstract
We will give a brief introduction to a selection of the OWASP Top 10 and then demonstrate the exploitation of each of these vulnerabilities using tools and hand crafted attacks. We will also demonstrate how a combination vulnerabilities can be chained together by an attacker.
Speaker Biographies
David is a Senior Software Engineer/Tech Lead and one of the leaders of the Secure Coding Guild at Pushpay, David previously worked for 3 years in the security industry including 1 year in the Security Team at Google in London and draws on 20 years experience as a systems and web developer, primarily working in .NET, Java and JavaScript.
Kieran is a developer with an interest in security.
Threat Modelling When You've Never Done It Before
Kade Morton - Quantum Security
Abstract
Through the Mozilla Open Leaders program I mentored a project from Asuntos del Sur, a humans right group that operates across South America. This is the story of my crash course in basic threat modelling, and how that basic knowledge is now helping activists across South America.
Speaker Biography
Kade is a consultant with Quantum Security. When not doing information security stuff, he volunteers with Mozilla.
That Vulnerability Looks Quite Risky
Peter Jakowetz - Quantum Security
Abstract
Technical findings are great, and finding vulnerabilities in your software so you can fix them is key to ensuring safe and secure code. However what about those things you can’t fix? Do they seem too expensive or hard? This talk will discuss the best way to manage these issues using risk management.
Speaker Biography
Peter is an electrical engineer turned security consultant from Wellington, NZ. Certified in many-a-thing, he spends a good chunk of time working on PCI, ISO and NZISM audits, and making security findings readable to senior management. In his spare time, he enjoys playing with open-source hardware and software, poking cars, and breaking things.
Mob Learning Using the OWASP Top 10 and 30 Days of Security Testing
Mike Clarke - Erudite Software
Abstract
Not sure how to get started learning about security? Why not team up with a group of others in the same boat and learn together?
After learning the basics of the OWASP Top Ten, I took part in the 30 Days of Security Testing challenge through WeTest with 100+ other software testers new to security. My talk is about how a small idea turned into an online workspace of over 100 people new to InfoSec, a series of great Meetups, and lessons learned along the way.
Speaker Biography
I’ve always been interested in IT and fascinated by information security. I worked for the Royal New Zealand Navy as a Communications Warfare Specialist before trying my hand at software testing. I’m currently working for Erudite Software in Auckland, as the sole tester in a development team largely focused on healthcare software solutions. I’ve recently signed on as an organiser for WeTest Auckland, where we throw together Meetups and online challenges to learn about testing.
How Can OWASP SAMM Help You Build More Secure Software?
Mohamed Hassan - Aura Information Security
Abstract
Have you ever wondered why you or your team keep having high and critical security vulnerabilities in your software? Why you didn't discover these vulnerabilities earlier than two weeks before going life? How penetration testing can be effective when you're changing your software every two weeks? Can security be easier? How can you embed security into your software life cycle? How do you know if security initiatives are paying off? This talk will answer these questions and more!
Speaker Biography
Mohamed has been a penetration tester for more than six years. Mohamed has delivered security training to developers, in New Zealand and internationally. He also helps organisations embed more security into their software development lifecycle. In his free time, Mohamed likes to keep active and enjoy New Zealand’s landscape.
Track Two - Morning (09:20 - 12:10)
Virtual Patching: Does It Work?
Kirk Jackson - RedShield
Abstract
Writing secure applications is hard, and often vulnerabilities are found after your application has already been released to production.
But what happens if you’re not able to fix the vulnerabilities quickly? Wouldn’t it be great if the someone else could secure your website for you?
Speaker Biography
Kirk works at RedShield, leads the OWASP Wellington-area Meetup, and has previously helped organise the annual OWASP NZ Day in Auckland.
Kirk worked as a Web developer before switching to the defence team - setting up Xero’s security practice, working as a pen tester, and in defence roles at several companies.
Cloud Catastrophes and How to Avoid Them
Mike Haworth - Insomnia Security
Abstract
Cloud and traditional infrastructure are different and sometimes the consequences of not changing mindset can be.. unpleasant.
Speaker Biography
Mike is a Principal Consultant for Insomnia Security, based in Wellington. He likes pentesting most things, and is rubbish at writing bios.
JWAT: Attacking JSON Web Tokens
Louis Nyffenegger - Pentester Lab
Abstract
Nowadays, JSON Web Tokens are everywhere. They are used as session tokens or just to pass data between applications or µservices. By design, JWT contains a high number of security and cryptography pitfalls. In this talk, we are going to learn how to exploit (with demos) some of those issues.
Speaker Biography
Louis is a security engineer based in Melbourne, Australia. He performs pentest, architecture and code review. Louis is the founder of PentesterLab, a learning platform for Web penetration testing. Recently, Louis talked at OWASP AppSecDay Melbourne, and ran two workshops at DEF CON 26, in 2018.
CTF: The Gateway Drug
Toni James - Orion Health
Abstract
I can't stop thinking about it, I can't wait for the next one, it keeps me up late at night, and I always want more. Flags that is! A how-to and where-to-start with Capture the Flag competitions, accompanied by a casual discourse about imposter syndrome, sexism in tech, and pondering the harsh realities of vim (not really, I never use vim, I'd never be able to get out of it). Followed by a live walkthrough of my favourite CTF challenges, the ones I think would entice other devs and wanna-be hackers to give it a try. "The first one's free."
Speaker Biography
Toni is a snowboarder turned software engineer, with an addiction to security. She's won a few scholarships in her quest to get more women into tech and she's really good at supporting others to do 'all the things'. A firm believer in ‘you need to see it to be it,’ she puts herself out there to enable others to step up and challenge the status quo. She/Her. @_tonijames
Track One - Afternoon 1 (13:30 - 15:30)
NoHolidayChurchGenius: Password Security with 2020 Vision
Antonio Radich - Quantum Security
Abstract
This season's passwords are now in fashion, similar to last year's, with one difference. Passwords are a staple in the developer toolkit. Developers follow guidelines put out by NIST or the GCSB. Users are ‘efficient’. With everyone striving for the minimum, we can already see "Winter (2019) is coming…"
Speaker Biography
Antonio has been with Quantum Security, as a Security Consultant performing penetration tests and security audits, for two years. He is interested in red teaming, post exploitation, and general security on an organisation level.
Sharing Is Caring: A Beginner's Guide to Security in the Cloud
Petra Smith - Aura Information Security
Abstract
Thinking of moving your applications to the cloud? How do you make sure they stay secure? This fast, fun, beginner-friendly session will demystify cloud security, introduce you to the most common cloud security models, and help you to choose the model that’s right for you.
Speaker Biography
Petra grew up wanting to be Sailor Mercury – the awkward blue-haired one from Sailor Moon who used computers to protect the world from evil. Now she’s a purple-team security consultant at Aura Information Security, which you have to admit is pretty close. She loves to teach people to pick locks, and gets kind of ranty about privacy, trust, and making digital spaces safe and inclusive for everyone.
Eating the Elephant: Application Security When You Aren't a Startup
Stephen Morgan - Westpac New Zealand
Abstract
DevSecOps, AppSec Engineers, and Continuous Integration Security are a panacea, but how do older institutions with many legacy systems and technical debt even begin to tackle agile application security practices? We will explore ways that you can start working with your developers write secure code.
Speaker Biography
Stephen is an Information Security Consultant at Westpac New Zealand where he wrangles Pen Testers, reviews codes, and diminishes his rapport with developers. He has worn many hats including those of a Customs Officer, Penetration Tester, Java Developer, and (cough) IT Auditor.
What's In a Name? Law of Agency and Domain Name Registrations
Judy Ting-Edwards - Ports of Auckland
Abstract
Have you ever hired Web developers to make a Web site for you, but then find out that you don’t actually own the domain name when you checked on Whois? Find out why this is the case and how we (maybe) should be doing domain name registrations, by taking a leaf from the law of agency’s book.
Speaker Biography
Judy has been registering domain names since 2013 when she was a junior lawyer for a stingy boss. She has recently changed careers to work in infosec, with a special interest in policy and appsec. As a part of a recent web hygiene audit, she discovered inconsistencies in how web devs register domain names in the industry and would like to see the industry come together with a best practice guideline. Risk management has been a constant in both her careers and she is always open to discussions on policies to embrace technology and reduce risks for the business at the same time.
Track Two - Afternoon 1 (13:30 - 15:30)
Security Regression Testing on OWASP ZAP Node API
Kim Carter - BinaryMist
Abstract
The OWASP ZAP HTTP intercepting proxy is useful for manually attacking your Web apps and APIs. Now, we have the official Node API to programatically drive ZAP to regression test our creations. I’ll show you how to build a fully featured security regression testing CLI, consumable by your CI/nightly builds.
Speaker Biography
Kim is a Technologist / Engineer, Information Security Professional, Entrepreneur, and the founder of BinaryMist Ltd. He is one of the OWASP NZ Chapter leaders and a Certified Scrum Master. Facilitator, mentor and motivator of cross functional, self managing teams. With a solid 17 years of commercial industry experience across many domains, Kim enjoys teaching others how to apply information security to their Agile processes, bringing the security focus up front where it’s the cheapest to implement, increasing profit and reducing costs. Co-organiser of the Christchurch Hacker Con, International trainer, speaker, published author, and Software Engineering Radio podcast host, focusing on software and network architecture, Web development and engineering, and information security. Kim is also a regular blog poster. Kim loves designing and creating robust software and networks, breaking software and networks, then fixing them and helping organisations increase productivity.
CI Can Make $$$ from Thin Air
Sajeeb Lohani - Privasec
Abstract
This talk covers how people can utilise free tools, outside of their intended use case, in a malicious way. Using TravisCI as an example, we will look into what essentially can become a distributed super computer, to mine bitcoins and distributed denial of service attacks free of any cost whatsoever.
Speaker Biography
Sajeeb is a penetration tester at Privasec, with years of prior development experience. Having graduated from Monash University with a Bachelor of Software Engineering (Honours) in 2017, Sajeeb remains passionate about contributing to and improving cyber security research. Sajeeb gives back regularly to the Melbourne cyber security community by founding the Monash Cyber Security Club, presenting at SecTalks, and mentoring at the Australian Women in Security Network (AWSN) Cadets workshops. Sajeeb also runs initiatives which attempt to responsibly disclose security issues within open source software projects, making the world of software ‘more secure’.
Introduction to Building Secure Electron Applications
Nawaz Gayoom - Provoke Solutions
Abstract
Electron is a popular framework for building desktop apps and is used by many prominent companies today. To build a production-ready Electron app, there are certain security considerations we need to take into account, if we are loading any external content on it.
Speaker Biography
Nawaz is a software developer at Provoke Solutions mostly working on web applications for the past 3 years. In this digital age with increasingly complex systems, it is a personal passion of mine to keep information secure and accessible. Apart from enjoying researching about security and sharing things that I learn along the way while in projects for my clients I do spend some (probably a little more than that) time watching Netflix as well. Other things I like doing include singing, surfing and sampling food.
Track One - Afternoon 2 (16:00 - 18:00)
How Do I Content Security Policy?
Kirk Jackson - RedShield
Abstract
Content Security Policy (CSP) helps you secure your Web site, by declaring which javascript and resources it uses. This means that XSS attacks will be greatly limited.
However, setting up CSP on an existing Web site is hard. We’ll discuss an easy approach that you can follow to set up CSP.
Speaker Biography
Kirk works at RedShield, leads the OWASP Wellington-area Meetup, and has previously helped organise the annual OWASP NZ Day in Auckland.
Kirk worked as a Web developer before switching to the defence team - setting up Xero’s security practice, working as a pen tester, and in defence roles at several companies.
OWASP Software Assurance Maturity Model (SAMM) 2.0
John DiLeo - Orion Health
Abstract
The OWASP SAMM Project Team recently release a Beta version of SAMM 2.0, which is currently open for comment. The model provides a framework for assessing the maturity of an organisation’s software assurance program, and identifying areas for future emphasis in improving the security of their development practices. This talk will provide an overview of the model, the benefits that can be realised by organisations utilising the model, and the process for assessing the maturity of the organisation’s software assurance program.
Speaker Biography
John is one of the co-leaders of the OWASP New Zealand Chapter. He moved to Auckland, from the United States, in 2017, and now works as Orion Health's Application Security Architect. John's focus is on developing and managing enterprise-wide Software Assurance Programmes, including the assessment of the organisation's maturity and building a roadmap to improve. This led him to join the core team of the OWASP SAMM project, where he helped to create the new model.
Before moving into application security, John worked as a solution architect, a Web development lead, and in developing discrete-event simulations of distributed systems. Along the way, he's also worked as a college instructor, trainer, and general IT consultant.
Why 'Positive Security' Is the Next Software Security Game Changer, and How to Do It
Jaap Karan Singh - Secure Code Warrior
Abstract
A 2017 report based on 400,000 application scans reported that only 30% passed the OWASP Top 10 policy. This presentation showcases the principles and practice of “positive security” and explains why it is an important game changer that will substantially improve application security.
Speaker Biography
Jaap Karan Singh is the Co-Founder and Chief Singh of Secure Code Warrior, a global security company that makes software development better and more secure. After security testing at BAE Systems in Australia, Jaap moved from hacking Web applications to educating developers on how to protect their own applications. Jaap has delivered training on web application security concepts and run workshops at Australian financial and telecommunications organisations in Australia. He specialises in Javascript technologies such as HTML5, Node, Express and Mongo. He recently created and delivered a course on hacking and protecting modern Javascript applications at OWASP AppSec EU 2016.
Track Two - Afternoon 2 (16:00 - 18:00)
Hardening Your Docker Infrastructure
Kim Carter - BinaryMist
Abstract
The security defaults of Docker are designed to get you up and running (“just work”) quickly, rather than being the most secure. There are many default configurations that can be improved upon. In this talk we’ll walk through improving the security of Docker hosts, containers, networking, and deployments.
Speaker Biography
Kim is a Technologist / Engineer, Information Security Professional, Entrepreneur, and the founder of BinaryMist Ltd. He is one of the OWASP NZ Chapter leaders and a Certified Scrum Master. Facilitator, mentor and motivator of cross functional, self managing teams. With a solid 17 years of commercial industry experience across many domains, Kim enjoys teaching others how to apply information security to their Agile processes, bringing the security focus up front where it’s the cheapest to implement, increasing profit and reducing costs. Co-organiser of the Christchurch Hacker Con, International trainer, speaker, published author, and Software Engineering Radio podcast host, focusing on software and network architecture, Web development and engineering, and information security. Kim is also a regular blog poster. Kim loves designing and creating robust software and networks, breaking software and networks, then fixing them and helping organisations increase productivity.
Reverse Engineering Mobile Apps: Why, What, and the Hows
Karan Sharma
Abstract
I’d like to talk about why Reverse Engineering mobile apps is important for an organisation, what can you discover while reversing an app and how can you apply those lessons to add an additional layer of defense while building your future apps.
Speaker Biography
Karan started his career as a network engineer before moving into information security field 8 years ago. He is working as a security consultant for one of the leading financial institutes of NZ. He has a true passion for breaking & fixing web/mobile apps. He enjoy doing app reversing in his free time and love sharing his knowledge with others.
Serverless Authentication with JWT
Mehul Patel
Abstract
Authentication is one of the big parts of every application. Security is always something that is changing and evolving. In this talk, I will cover what JSON Web Tokens (JWTs) are and why using JWTs in your applications when it comes to security is awesome.
Speaker Biography
Mehul is an engineer who loves digging into technology, and public speaker currently living in India. His interests range from technology to innovation. He is also interested in Web development, writing, and safe programming.
Mehul holds a Masters in Computers Science and has been working and contributing towards the open source community in all ways he can. He is a social guy, loves to interacting with new people, traveling, playing cricket, He can dance like crazy!!!
Currently, Mehul is an Engineer at Zimbra, Ambassador at Auth0, Mentor at Mozilla Reps and Campus Advisory Committee at Mozilla and Founder/Organizer of Google Developer Group - Nashik. Moreover, He is the initiator of Rust Hacks - the super safe system programming language of course and co-founder of Infinite Defense Foundation (IDF).
Call For Sponsorships
OWASP New Zealand Day 2019 will be held in Auckland on the 22nd of February, 2019, and is a security conference entirely dedicated to application security. The conference is once again being hosted by the University of Auckland with their support and assistance. OWASP New Zealand Day 2019 is a free event, but requires sponsor support to help be an instructive and quality event for the New Zealand community. OWASP is strictly not for profit. The sponsorship money will be used to help make OWASP New Zealand Day 2019 a free, compelling, and valuable experience for all attendees.
The sponsorship funds collected are to be used for things such as:
- Venue - Room use and on-site management fees
- Name tags - We feel that getting to know people within the New Zealand community is important, and name tags make that possible
- Promotion - We would like to reach a wider audience, by utilising paid advertising for the event
- Printed Materials - Printed materials will include program information, room signs, and lanyards
- Recognition items for speakers and trainers
- Morning and afternoon tea, to promote a congenial environment for networking among application security professionals
Facts
Last year, the event was supported by seven sponsors and attracted more than 700 registrations. Plenty of constructive (and positive!) feedback from the audience was received, and we are using this to make the conference more appealing to more people. For more information on the last New Zealand Day event, please visit: https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2018
The OWASP New Zealand community is strong, with more than 500 people currently subscribed to the mailing list (sign up). OWASP New Zealand Day is expected to attract between 900 and 1000 attendees this year.
OWASP regular attendees are IT project managers, IT security managers, IT security consultants, Web application architects and developers, QA managers, QA testers and system administrators.
How to Become a Sponsor
All financial matters related to the conference, including Sponsorship Agreements and payments, are handled through the OWASP Foundation. To express interest in supporting the conference as a sponsor, please contact us by email.
Premium Sponsorship Packages
| Platinum |
Gold |
Silver |
Bronze |
A La Carte (See Below) | |
|---|---|---|---|---|---|
| Enrolment Limit | 2 | 6 | -- | -- | Varies |
| General Rate | $5,000 | $3,000 | $1,750 | $1,000 | Varies |
| OWASP Corporate Member Rate | $4,250 | $2,550 | $1,500 | $850 | N/A |
| A La Carte Sponsorship Discount | 15% | 10% | 5% | -- | -- |
| Banner in Conference Lobby (see notes) | Yes | No | No | No | Varies |
| Banner at Side of Stage (see notes) | Yes (2) | Yes (1) | No | No | No |
| Logo on Attendee Badges | Yes | Yes | No | No | Varies |
| Logo on Room Signs | Yes | Yes | Yes | No | Varies |
| Company Description on Conference Web Page | 150 words | 100 words | 50 words | No | Varies |
| Pre-Conference Reception Tickets | 4 | 3 | 2 | 1 | Varies |
| Logo on Conference Tote Bags | Yes | Yes | Yes | No | Varies |
| Mention in Pre-Event Publicity | Yes | Yes | Yes | Yes | Varies |
| Logo on Conference Web Site | Yes | Yes | Yes | Yes | Yes |
| Recognition during Opening/Closing Sessions | Yes | Yes | Yes | Yes | Yes |
| Promotional Items in Conference Tote Bags (see notes) | Yes (up to 3) | Yes (up to 2) | Yes (1) | Yes (1) | Varies |
A La Carte Sponsorship Opportunities
1. Morning and Afternoon Tea Breaks - Conference Day
Sponsorships Available: Four (4)
General Rate: $4,500
Benefits:
- Opportunity to display your company's banner in the conference lobby (see notes below) throughout the day of the conference
- Recognition as sponsoring provider, on signs displayed on service tables during tea breaks
- Sponsor logo printed on attendee badges
- Sponsor logo printed on Room Signs
- Single-colour sponsor logo imprinted on conference tote bags
- Sponsor logo displayed on conference Web page, alongside Platinum Sponsors
- Opportunity to include 150-word company description in About Our Sponsors section of conference Web page
- Written recognition as a leading sponsor, in pre-event publicity communications
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
2. Pre-Conference Reception
On the Thursday evening, the OWASP New Zealand Day Committee will host a reception for speakers, trainers, conference volunteers, and Premier Sponsors. The event will be held at an establishment near the conference venue.
Sponsorships Available: Two (2)
General Rate: $2,000
Benefits:
- Opportunity to display your company's banner at the reception venue (see notes below) during the reception
- Opportunity to address reception attendees, as "hosting" sponsor of reception
- Recognition as sponsoring provider, on signs displayed on service tables/bars during reception
- Sponsor logo printed on Room Signs
- Single-colour sponsor logo imprinted on conference tote bags
- Sponsor logo displayed on conference Web page, alongside Silver Sponsors
- Opportunity to include 100-word company description in About Our Sponsors section of conference Web page
- Written recognition as a leading sponsor, in pre-event publicity communications
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
3. Conference Tote Bags for Attendees
Sponsorships Available: One (1)
General Rate: $1,800
Benefits:
- Single-colour sponsor logo printed on the Conference Tote Bags, along with those of Platinum, Gold, and Silver Sponsors
- Sponsor logo printed on Room Signs
- Sponsor logo displayed on conference Web page
- Opportunity to include 50-word company description in About Our Sponsors section of conference Web page
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
4. Lanyards for Attendee Badges
Sponsorships Available: One (1)
General Rate: $1,800
Benefits:
- Single-colour sponsor logo printed on the Attendee Lanyards, along with the OWASP logo
- Sponsor logo printed on Room Signs
- Sponsor logo displayed on conference Web page
- Opportunity to include 50-word company description in About Our Sponsors section of conference Web page
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
5. Speaker Gifts
Sponsorships Available: One (1)
General Rate: $1,500
Benefits:
- Sponsor logo printed on Room Signs
- Single-colour sponsor logo imprinted on conference tote bags
- Sponsor logo displayed on conference Web page, alongside Silver Sponsors
- Opportunity to include 50-word company description in About Our Sponsors section of conference Web page
- Written recognition as a leading sponsor, in pre-event publicity communications
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
6. Morning and Afternoon Tea Breaks - Training Day
Sponsorships Available: Two (2) --Funded, no longer available
General Rate: $750
Benefits:
- Opportunity to display your company's banner in the training facility lobby (see notes below) throughout the training day
- Recognition as sponsoring provider, on signs displayed on service tables during training day tea breaks
- Sponsor logo displayed on conference Web page, alongside Bronze Sponsors
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
7. International Travel Support
As part of the submission process for presentations, prospective presenters from outside New Zealand are given the opportunity to indicate if they will need travel support to be able to attend OWASP New Zealand Day. Each International Travel Support sponsorship is intended to provide a maximum of $2,500 for one international presenter's travel expenses related to attending, and presenting at, the conference. Supported travel expenses may include: return airfare from the airport nearest the presenter's residence to Auckland, two nights' accommodation in a lodging near the conference venue, and return shuttle transportation between the Auckland airport and the accommodation.
Sponsorships Available: No Limit
General Rate: $2,500
Benefits:
- Sponsor logo displayed on conference Web page, alongside Gold Sponsors
- Opportunity to include 100-word company description in About Our Sponsors section of conference Web page
- Opportunity for sponsor representative to introduce sponsored presenter
- Written recognition as a leading sponsor, in pre-event publicity communications
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
8. Diversity Fund
The OWASP New Zealand Day Diversity and Financial Aid Fund has been established to provide financial assistance to students at New Zealand universities. Each Diversity Fund sponsorship is intended to cover travel expenses for one New Zealand student, from outside the Auckland area, who will be attending or presenting at the conference. Each Diversity Fund support recipient will receive funding for return airfare from their nearest domestic airport to Auckland International Airport, two night's accommodation in a lodging near the conference venue, and return shuttle transportation between the airport and the accommodation.
Sponsorships Available: No Limit
General Rate: $750
Benefits:
- Sponsor logo displayed on conference Web page, as a Diversity Fund Sponsor
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
9. Door Prizes
At the closing session of the conference, the OWASP New Zealand Day Committee will conduct a series of random drawings, awarding donated items to attendees, who must be present to win. There is no minimum or maximum value required for donated items, nor is the number of items provided subject to any limit. It is recommended that items provided be of interest to the conference's target audience, rather than of a generic nature.
Sponsorships Available: No Limit
General Rate: In-Kind Donation
Benefits:
- Verbal recognition, at the time of the prize drawing, as the donor of the prize
10. Other Supporting Sponsorships
If your company would like to provide special items to attendees, funding for paid promotional advertising for the event, or other items that we haven't yet thought of, you are welcome to contact us to discuss your ideas.
Sponsorships Available: No Limit
General Rate: In-Kind Donation
Benefits:
- Sponsor logo displayed on conference Web page, as a Supporting Sponsor
- Visual and verbal recognition of sponsor at opening and closing sessions of conference
Notes
Sponsor Logos:
- Logos are to be provided by the respective sponsors, as digital files (JPEG and PNG preferred)
- Logos provided should be full colour
- For lanyards and tote bags (including Platinum/Gold/Silver Sponsors), a single-colour version of the logo should also be provided, in a separate file. If a single-colour version of the logo is not provided by the sponsor, the OWASP New Zealand Day Committee reserves the right to electronically convert the full-colour logo to a single-colour version, or omit the sponsor's logo from the imprinted items if that proves infeasible.
Sponsor Banners:
- Lobby and stage-side banners are to be provided by the respective sponsors, must be free-standing, and their size is subject to approval by the OWASP New Zealand Day Committee.
- The conference venue includes two tracks, conducted in separate auditoriums; Platinum Sponsors may display one banner to the side of each auditorium's stage; Gold Sponsors may display a banner to the side of the stage in one auditorium. Gold Sponsors may express an auditorium preference, but final locations are at the discretion of the OWASP New Zealand Day Committee.
- There will be a maximum of four (4) sponsor banners displayed in each auditorium, with placement priority given to Platinum Sponsors.
Promotional Items:
- Printed materials are limited in dimensions to A4 size - either a single sheet, printed on one or both sides; or a single A3 sheet, folded in half
- Small imprinted items are also acceptable - pens, stress balls, USB keys, fidget spinners, etc.
- Design of printed materials and imprinted items are subject to approval by OWASP New Zealand Day Committee
- RECRUITMENT: In addition to the promotional item allowances included in Premium Sponsorship Packages, any sponsor may provide one A5-size card with information on actual current vacancies for which candidates are actively being sought
All amounts listed are in New Zealand dollars (NZD)
Diversity and Financial Aid fund
Thanks to the generous support of our lovely sponsors, we have some funding available to help people from around New Zealand attend the OWASP NZ Day, who would otherwise find it hard to attend. In particular, we welcome applications from women, people of colour, LGBTIQ, and all others. You all deserve to be able to learn more about security, and we’ll do our best to help make that happen!
Our funds are limited, and we’ll be reviewing applications every week, starting at the end of January. Submit your application soon, so we can approve them promptly, and you’ll be in several review cycles!
Process:
- Fill out our Application Form
- We will review and approve applications each week. The first reviews will be completed by 29 January.
- We will contact all applicants and let them know the result of the review.
- Successful applicants will be contacted to help sort things out.
We use the following criteria to help us decide who gets approved:
- We are biased towards (but not exclusively for) diverse applicants.
- We do attempt to maximise cost efficiency and will aim to get as many people to OWASP as possible, with our limited funds.
Each successful recipient can choose whether to be kept anonymous (in which case only the OWASP NZ committee will know the details of your funding), or to be put in touch with the supporting company whose sponsorship is going towards your attendance. We think some of our sponsors may enjoy the opportunity to chat with you on the day talk about your experiences and plans for the future, but that’s totally optional and up to you.
If you have any questions, feel free to drop us an email: [email protected]
Code of Conduct
We want to make the OWASP NZ Day a welcoming environment for all attendees. To that end, we would like to remind you that all activities associated with this event are subject to OWASP's Conference Policies. At their core, these policies are intended to promote and maintain an inclusive, welcoming environment for all participants - actions detrimental to that environment are unwelcome.
Speakers, trainers and sponsors have all been reminded of these policies, and are expected to abide by them like all attendees.
If you have any concerns during the day, please seek out John, Austin, or Brendan. We will make ourselves visible at the start of the day, so you know what we look like.
Call for Presentations
UPDATE: The Call for Presentations is now CLOSED. The committee is reviewing the proposals received, and will be notifying submitters of their selection status shortly.
OWASP New Zealand Day conferences attract a high quality of speakers from a variety of security disciplines, including architects, Web developers and engineers, system administrators, penetration testers, policy specialists and more.
We would like a variety of technical levels in the presentations submitted, corresponding to the three focus areas of the conference:
Track One:
- Introductions to various Information Security topics, and the OWASP projects
- Policy, Compliance and Risk Management
Track Two:
- Technical topics
Introductory talks should appeal to an intermediate to experienced software developer, without requiring a solid grounding in application security or knowledge of OWASP projects. These talks should be engaging, encourage developers to learn more about information security, and give them techniques that they can immediately return to work and apply to their jobs.
This being an OWASP conference, the selection process for talks in Track One will give priority to those related to OWASP's Projects, Tools, and Guidance (check out the current [OWASP Project Inventory](https://www.owasp.org/index.php/Category:OWASP_Project#tab=Project_Inventory) for more information). If multiple submissions are received related to the same OWASP Project/Tool, preference will be given to speakers actively involved as leaders or members of the respective project teams.
Technical topics are running all day and should appeal to two audiences - experienced software security testers or researchers, and software developers who have a “OWASP Top Ten” level of understanding of web attacks and defences. You could present a lightning, short or long talk on something you have researched, developed yourself, or learnt in your travels. Ideally the topics will have technical depth or novelty so that the majority of attendees learn something new.
We would also like to invite talks that will appeal to those interested in the various non-technical topics that are important in our industry. These talks could focus on the development of policies, dealing with compliance obligations, managing risks within an enterprise, or other issues that could appeal to those in management roles.
We encourage presentations to have a strong component on fixing and prevention of security issues. We are looking for presentations on a wide variety of security topics, including but not limited to:
- Web application security
- Mobile security
- Cloud security
- Secure development
- Vulnerability analysis
- Threat modelling
- Application exploitation
- Exploitation techniques
- Threat and vulnerability countermeasures
- Platform or language security (JavaScript, NodeJS, .NET, Java, RoR, Python, etc)
- Penetration Testing
- Browser and client security
- Application and solution architecture security
- PCI DSS
- Risk management
- Security concepts for C*Os, project managers and other non-technical attendees
- Privacy controls
The submission will be reviewed by the OWASP New Zealand Day conference committee and the highest voted talks will be selected and invited for presentation.
PLEASE NOTE:
- Due to limited funds availability, the conference budget does not include a plan to cover expenses for international speakers. However, if sponsorship funds are received for this purpose, we will issue a call for support applications from those outside New Zealand who have submitted proposals. Please indicate in the "additional information" section, whether you would be able to present without such support.
- If you are selected as a speaker, and your company is willing to cover travel and accommodation costs, the company will be recognised as a "Supporting Sponsor" of the event.
Please submit your presentation on PaperCall.
Submission Deadline: Friday, 11th January 2019 (NOW CLOSED)
Applicants will be notified in the following week after the deadline, whether they were successful or not.
Call For Trainers
The Call for Trainers is now closed. Trainers selected to present training have been contacted, and details are now being finalised.
We are happy to announce that training will run on Thursday, 21 February 2019, the day before the OWASP NZ Day conference. The training venue will be Level 0, Rooms: case rooms 1(005), 2(057), 3(055), and 4(009), kindly provided by the University of Auckland School of Business, in the same building as the OWASP NZ Day conference itself. Classes can contain up to 69 students, with power for laptop usage and Wi-Fi. A wide range of half-day or full-day training proposals will be considered, see the Call for Papers for a list of example topics.
If you are interested in running one of the training sessions, please contact John DiLeo ([email protected]) with the following information:
- Trainer name
- Trainer organisation
- Telephone + email contact
- Short Trainer bio
- Training title
- Trainer requirements (e.g. a projector, whiteboard, etc)
- Trainee requirements (e.g. laptop, VMware/VirtualBox, etc)
- Training summary (less than 500 words)
- Target audience (e.g. testers, project managers, security managers, web developers, architects)
- Skill level required (Basic / Intermediate / Advanced)
- What attendees can expect to learn (key objectives)
- Short course outline
The fixed price per head for training will be $250 for a half-day session and $500 for a whole-day session. As this training is part of an OWASP event, part of the proceeds go back to OWASP. The split is as follows:
- 25% to OWASP Global - used for OWASP projects around the world
- 25% to OWASP NZ Day - used for NZ Day expenses
- 50% to the training provider.
Submission Deadline: Friday, 21st December 2018
Applicants will be notified in the following week after the deadline, whether they were successful or not.
