OWASP Portland 2019 Training Day

For the fourth year in a row, the Portland OWASP chapter is proud to host our information security training day! This is be an excellent opportunity for the local Portland security community to receive top quality information security and application security training for prices far lower than normally offered. It's also a great chance to network with other local infosec and appsec enthusiasts and meet those who share your interests.

The 4th annual OWASP Portland 2019 Training Day date will be on September 25, 2019. See Details for more info.

General Registration will open at 9am PST on August 15th. Tickets cost $25.00 per session.

Want to get news and information on our 2019 Training Day? Subscribe to the [1] Portland OWASP mailing list or follow @PortlandOWASP on Twitter!

Courses

Courses will be held in two tracks: four in the morning session, and four in the afternoon session. Each participant can register for one morning course, one afternoon course, or one of each.

Morning Session 8:30 AM - Noon

AWS API Threat Modeling and Automated Testing

Sponsored by Cambia

Instructor: Kendra Ash

Abstract: If you are a software, DevOps, QA or security engineer and want to learn how to threat model API's in AWS this course is for you. This course will cover the what, why, when, and how of threat modeling applications in your organization. The bulk of this course will be based on the book Threat Modeling by Adam Shostack and will leverage a variant of the Escalation of Privileges card game. Also, I will dive into the approach I have used to gain adoption from engineering teams as a security engineer. After gaining an understanding of threat modeling, we will dive into how we can automate security checks for an AWS environment — leveraging the AWS CLI tool to provide quick engineering feedback on ways to improve the security of their infrastructure.

Takeaways:

• Learn the basics of threat modeling
• Learn ways to gain adoption by your peers
• How to automate security checks for AWS

Bio: Kendra Ash (@securelykash) is an information security engineer at Vacasa, actively building a security team and program by leveraging guidance from her network and industry standards. Co presenting is Ryan Nixon (@taiidani) an experienced DevOps engineer who deeply cares about the security of all applications. Constantly looking for ways to keep all server and application configurations in order with proper auditing & pipelines.

Prerequisites: no previous knowledge is required, this course is for all levels and jobs (QA, DevOps, Security and Software Engineer)

Applied Physical Attacks on Embedded Systems, Introductory Version

Instructor: Joe FitzPatrick

Abstract: This workshop introduces several different relatively accessible interfaces on embedded systems. Attendees will get hands-on experience with UART, SPI, and JTAG interfaces on a MIPS-based wifi router. After a brief architectural overview of each interface, hands-on labs will guide through the process understanding, observing, interacting with, and exploiting the interface to potentially access a root shell on the target.

Security Tools and Jenkins Pipeline

Sponsored by WebMD

Instructor: Sneha Kokil

Abstract: Modern application development embeds security activities in SDLC, while adopting DevSecOps culture. Security tools are being viewed in the context of continuous integration and automation, which are the key factors in achieving a successful DevSecOps implementation. Integrating security tools in the CI/CD pipelines has become a primary focus of most of the organizations, who are striving to build application security from within. This workshop focuses on getting a good understanding of how some of the open source security tools can be integrated in Jenkins CI/CD pipeline for languages such as Go and Java, along with application container scanning solutions. The workshop will be a hands-on experience, where the participants will write their own pipeline code for integrating security tools. The key takeaways from this workshop will help participants experience how security tooling fits into CI/CD pipelines. It will also help them appreciate the real-world challenges and possible solutions, when integrating security in existing SDLC.

Bio: Sneha Kokil is a senior security consultant at Synopsys. With a master's degree in information security from Northeastern University, along with several years of development and security experience, she specializes in integrating software security toolchains within SDLC processes. She is immensely passionate about DevSecOps and how it helps building security in. Outside of work, she is an avid biography and science fiction reader, a swimmer, and a mother to a wonderful daughter.

OWASP Top 10 / Juice Shop Hack Session

Sponsored by Kraken

Instructor: David Quisenberry

Abstract: This session is meant for those new to OWASP Top Ten. We will go over the OWASP Top Ten - where it came from, what it’s good for, what are the top ten, etc. And illustrate the concepts in the OWASP Top Ten through another OWASP Flagship Project - The OWASP Juice Shop. This will be a hands on class so everyone can follow along in the Juice Shop to explore the concepts. There will be time at the end for everyone to continue on their vulnerability hunting and a friendly Juice Shop CTF.

Bio: David Quisenberry (@dmqpdx16) is a backend developer and security champion with Daylight Studio, a local Portland boutique web agency. He serves on the Portland OWASP board as Outreach/Events coordinator and does what he can to up the involvement of established and emerging software developers in security conversations.

Prerequisites: Laptop capable of running docker and burpsuite.

Afternoon Session: 1:30 PM - 5:00 PM

Web Applications and Filesystem Security / Deserialization Attacks

Sponsored by ForgeRock

Instructor: Timothy Morgan

Abstract: This course starts by exploring the security ramifications of filesystem semantics, security capabilities, and little known-features as they relate to web application development.  Students will practice file upload attacks against a intentionally-vulnerable web application.  Next, the course transitions to deserialization attacks, a recently added OWASP Top 10 item, using multiple practical examples to explain this tricky technical issue. Students will have an opportunity to try deserialization attacks in a realistic scenario.

Learning Objectives:

• To better appreciate the ways modern filesystems work on different platforms and what security impacts may result from certain unintuitive behaviors
• Explore the many challenges involved in safely processing file uploads
• Learn about deserialization attacks and how to identify when an application might be at risk

Prerequisites:

• A basic understanding of web application development is strongly recommended
• A laptop or workstation for each student (or pair of students)
• Ability to change proxy settings, install software and run executables on this system
• Please install VirtualBox 6 in order to run a small virtual machine
• If using a Mac, consider bringing a real mouse with 2 buttons. VirtualBox doesn't always play well with other pointing devices on Macs

Container Security

Sponsored by Summit Security

Instructor: Alex Ivkin

Abstract: "When it comes to container security there are two prevailing schools of thought - either containers are secure by default, so you should not care much, or containers can not be secure in principle, so you should avoid them at all costs. In this training you will go through the real world examples of configuring and running containers in a secure manner. You will get insights into the security of both Windows and Linux containers, container infrastructure, such as container registries and orchestration platforms - docker swarm and kubernetes. We will examine real world vulnerabilities unique to different architectures of containers and how to address them.

Takeaways:

1. Building and running docker containers securely
2. Avoiding common pitfalls in docker infrastructure setup (dockerd, docker registry)
3. Navigating security in the container orchestration platforms (docker swarm, kubernetes)"

Bio: Alex Ivkin (@alerxes) is a Director of Solutions at Eclypsium, a local Portland company, specializing in firmware, hardware and supply chain security. Alex has deep implementation experience in a long list of security domains, including cloud, application security and IAM. He co-authored the ISACA CSX Professional certification and is an alpine climber.

Prerequisites:

• Mid to advanced level technical experience
• Basic experience with running docker containers
• Laptop with docker for windows setup and tested

Intro to Chrome Exploitation

Sponsored by Security Innovation

Instructor: Justin Angra

Abstract: Over 3 billion browser devices are actively loading arbitrary data served by someone else. What happens if one of those pages contains maliciously crafted JavaScript? Could they capture your passwords, perform UXSS, or worse - execute local code on your machine? In this session, you will get the opportunity to explore the anatomy and play with common vulnerability patterns in the renderer process of Chrome. This will be an interactive class; please bring a laptop with Docker installed.

OWASP Amass: Discovering Your Exposure on the Internet

Sponsored by Daylight Studio

Instructor: Jeff Foley

Abstract: Today, large organizations deal with the challenge of running their infrastructure across many networks and namespaces due to the use of cloud and hosting services, legacy environments and acquisitions. This can make it difficult to maintain visibility of Internet-facing assets and to track down systems that pose a risk to security. The OWASP Amass Project has developed a tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery. During this talk, the founder of the project will discuss how OWASP Amass uses OSINT, network reconnaissance, graph databases and information sharing to provide both attackers and defenders better visibility of target organizations.

Bio: Jeff Foley is the Founder and Project Leader of the OWASP Amass project. Mr. Foley has nearly 20 years of experience as an innovator for research & development, software engineering and red team activities in information security. He is a results-driven technical leader known for delivering game-changing research findings to overcome real-world challenges. Jeff serves as the Manager for Vulnerability Engineering at National Grid and is the CTO & Co-founder of ClaritySec, an Upstate New York based information security startup. Prior to this, he was the Director of Research for the Cyber Systems, Weapon Systems & Sensors Operation at Alion Science & Technology. While serving at Northrop Grumman, Jeff built and led the internal penetration testing team and was the program manager for offensive security research & development. Mr. Foley also shares his expertise and experience by supporting several local university information security programs and participating in information security competitions, such as the SUNY Polytechnic Institute Cybersecurity Advisory Board, Mohawk Valley Community College Computer Science Advisory Board and the CNY Hackathon Competition.

2019 Sponsors

Interested in becoming a sponsor? Here is a document outlining the opportunities: Sponsorship-Doc. Reach out to [email protected] to let us know.

Mixer Sponsors

              

Training Session Sponsors

                                                                                         

Morning Coffee Sponsors

General Sponsors

Details

OWASP Portland 2019 Training Day will be on September 25, 2019.

This year for the 2nd time, we'll be located at:

World Trade Center Portland
121 SW Salmon St.
Portland, OR 97204. 

Later in the evening, a social mixer will also be held at Rock Bottom Restaurant & Brewery, just a short walk away:

206 SW Morrison St
Portland, OR 97204

Schedule

Time	Activity
8:00 AM - 8:30 AM	Morning Registration and Continental Breakfast
8:30 AM - 12:00 PM	AWS API Threat Modeling and Automated Testing (Kendra Ash)	Applied Physical Attacks on Embedded Systems, Introductory Version (Joe FitzPatrick)	Security Tools and Jenkins Pipeline (Sneha Kokil)	OWASP Top 10 / Juice Shop Hack Session (David Quisenberry)
12:00 PM - 1:30 PM	Lunch on your own - Meet a new friend and grab a bite!
1:00 PM - 1:30 PM	Afternoon Registration (for those attending only in the afternoon)
1:30 PM - 5:00 PM	Advanced Application Security Testing (Timothy Morgan)	Container Security (Alex Ivkin)	Intro to Chrome Exploitation (Justin Angra)	OWASP Amass: Discovering Your Exposure on the Internet (Jeff Foley)
5:00 PM - 7:30 PM	Evening Mixer @ Rock Bottom Restaurant and Brewery

Interested in teaching a training at Training Day 2019? Contact Portland OWASP via the mailing list or Twitter!

Lunch Ideas

Here are some lunch ideas:

• Farmhouse Cafe, 101 SW Main St.
• The Good Earth Cafe, 1136 SW 3rd Ave.
• Chipotle Mexican Grill, 240 SW Yamhill St.
• Luc Lac Vietnamese Kitchen, 835 SW 2nd Ave.
• Rock Bottom Restaurant & Brewery, 206 SW Morrison St.
• Buffalo Wild Wings, 327 SW Morrison St.
• Cafe Yumm, 301 SW Morrison St.
• Killer Burger, 510 SW 3rd Ave.
• House of Ramen, 223 SW Columbia St.
• There are some food carts north of the World Trade Center on SW 3rd Ave. and SW Stark St.

How to Register

Registration will again be via EventBrite

Thank you to the OWASP Foundation and the many sponsors, trainers, volunteers and trainers that have helped make Training Day a success and allow us to continue!