OWASP EU Summit 2008

	'SETTING THE WEB APPLICATION SECURITY AGENDA FOR 2009' 3th - 7th November 2008	Summit media coverage Sponsored Participants

KEY RESULTS FROM THE OWASP SUMMIT

SUMMIT CONCLUSIONS DOCUMENT

"ALGARVE, PORTUGAL, November 7, 2008 – The Open Web Application Security Project (OWASP) today announced results from the annual OWASP Summit. Over 80 application security experts from over 20 countries joined forces to identify, coordinate, and prioritize our 2009 efforts to create a more secure Internet.

OWASP is a free and open community that focuses on improving application security. There is overwhelming evidence that the vast majority of web applications contain security holes that are increasingly putting people and organizations at serious risk. Securing web applications is an extraordinarily difficult technical challenge that demands a concerted effort.

“OWASP came together for a week and produced a stunning amount of new ideas,” said OWASP Chair Jeff Williams. “Our community is growing and organizing into a powerful movement that will affect software development worldwide. This summit marks a major milestone our efforts to improve application security. (...)” See here the fully OWASP Board's signed document with OWASP Summit 2008's conclusions" and watch OWASP Board's videos - Jeff Williams and Dinis Cruz.

---

Key results from the OWASP Summit include:

UPDATED OWASP PRINCIPLES

• Free & Open,

• Governed by rough consensus & running code,

• Abide by a code of ethics (see ethics),

• Not-for-profit,

• Not driven by commercial interests,

• Risk based approach.

UPDATED CODE OF ETHICS

• Support the implementation of and promote compliance with standards, procedures, controls for application security,

• Have objectivity, due diligence and professional care in accordance with established standards,

• Responsible disclosure.

NEW OUTREACH PROGRAMS

• OWASP has expanded its outreach efforts by building relationships with technology vendors, framework providers, and standards bodies. In addition, we piloted a new program to provide free one-day seminars at universities and developer conferences worldwide.

NEW GLOBAL COMMITTEE STRUCTURE

• OWASP recognized the extraordinary contribution of our most active leaders by engaging them to lead a set of six new committees. Each democratically established committee will focus on a key function or geographic region, such as OWASP projects, conferences, local chapters, membership and industry outreach.

OWASP GLOBAL COMMITTEES ( OWASP GC)
Education	Chapters	Conferences	Industry	Projects & Tools	Membership

How to Join a Global Committee - Applications being accepted until January 9th 2009 for a 24 month term.

NEW FREE TOOLS AND GUIDANCE

• OWASP announced the release of Live CD 2008, many new testing tools, static analysis tools, the Enterprise Security API (ESAPI v1.4), AntiSamy, the Application Security Verification Standard (ASVS), guidance for Ruby on Rails and Classic ASP, international versions of our materials, and much more.

OWASP is proud to launch the following new or updated tools:
PROJECT	AUTHOR
OWASP Application Security Verification Standard - SoC 08	Mike Boberski
OWASP AppSensor - SoC 08	Michael Coates
OWASP Access Control Rules Tester - SoC 08	Andrew Petukhov
OWASP AntiSamy Project - SoC 08	Arshan Dabirsiaghi
OWASP Application Security Tool Benchmarking Environment and Site Generator Refresh Project - SoC 08	Dmitry Kozlov
OWASP Code Crawler - SoC 08	Alessio Marziali
OWASP JSP Testing Tool - SoC 08	Jason Li
OWASP Live CD - SoC 08	Matt Tesauro
OWASP OpenPGP Extensions for HTTP - Enigform and mod openpgp - SoC 08	Arturo ‘Buanzo’
OWASP Orizon Project - SoC 08	Paolo Perego
OWASP Python Static Analysis Project - SoC 08	Georgy Kilmov
OWASP Skavenger Project - SoC 08	Matthias Rohr
OWASP Teachable Static Analysis Workbench - SoC 08	Dmitry Kozlov & Igor Konnov

OWASP is proud to launch the following new or updated documents and resources:
PROJECT	AUTHOR
OWASP Application Security Desk Reference - SoC 08	Leonardo Cavallari
OWASP Backend Security Project - SoC 08	Carlo Pelliccioni
OWASP Classic ASP Security Project - SoC 08	Juan Carlos Calderon
OWASP Code Review Project - SoC 08	Eoin Keary
OWASP Education Project - SoC 08	Sebastien Deleersnyder, Martin Knobloch
OWASP Internationalization Project - Soc 08	Juan Carlos Calderon
OWASP Spanish Project - SoC 08	Juan Carlos Calderon
OWASP Positive Security Project - SoC 08	Eduardo V.C. Neves
OWASP Ruby on Rails Security Project - SoC 08	Heiko Webers
OWASP Securing WebGoat using ModSecurity Project - SoC 08	Stephen Craig Evans
OWASP Source Code Review - SoC 08	James Walden
OWASP Testing Guide V3 - SoC 08	Matteo Meucci

Find more OWASP Projects at the OWASP Projects Page.

EVENT AGENDA

Agenda for Monday, November 3rd, 2008
13:00	Lunch
	Training Sessions
15:00 - 17:00	Securing WebGoat with ModSecurity Stephen Craig Evans	WebSec Apps for Managers and Executives Video Mano Paul	OWASP Testing Guide Matteo Meucci
19:00	Summit Briefing Dinis Cruz and Summit Organization Team
20:00	Dinner

Agenda for Tuesday, November 4th, 2008
08:00	Registration
09:00	Summit Keynote Dinis Cruz and Summit Organization Team
	Documents		Tools
09:30	OWASP Testing Guide - SoC 08 Matteo Meucci		OWASP JSP Testing Tool - SoC 08 Jason Li
09:45	OWASP Code Review Project - SoC 08 PowerPoint Presentation Eoin Keary		OWASP Orizon Project - SoC 08 PowerPoint Presentation Paolo Perego
10:00	OWASP Application Security Desk Reference - SoC 08 Leonardo Cavallari Militelli		OWASP Live CD - SoC 08 Matt Tesauro
10:15	OWASP Spanish Project - SoC 08 Juan Carlos Calderon		OWASP WebScarab Project PowerPoint Presentation Rogan Dawes
10:30	Coffee Break
10:45	.NET ESAPI Alex Smolen
11:00	Working Sessions Briefing Dinis Cruz
	Working Sessions

11:15 - 13:00	Documentation Projects/Guides Integration and Unified 4.0 Version WS Conclusions Eduardo Neves	OWASP Intrinsic Security Working Group - Browser Security Arshan Dabirsiaghi	Tools Projects WS Conclusions Matt Tesauro
13:00	Lunch
	Training Sessions
14:00	The Art and Science of Threat Modeling Web Applications Video Mano Paul	Web Server Hardening SELinux PDF Presentation Pavol Luptak	Offensive WebApp Hacking Video - LDAP, XML and SQL injection Video - LDAP injection demo XML injection demo Video - SQL injection demo Marco Slaviero
15:00	Phishing attack Video Matt Teasuro & Brad Causey	Clickjacking Video Demonstration Arshan Dabirsiaghi
16:00	Coffee Break
	Working Sessions
16:30	OWASP Enterprise Security API Project (ESAPI) Video WS Conclusions Jeff Williams
18:30	OWASP Application Security Desk Reference - ASDR Leonardo Cavallari		.NET Project Dinis Cruz

Agenda for Wednesday, November 5th, 2008
09:15	Daily Briefing Dinis Cruz
	Standards and Education		Tools
10:00	OWASP Positive Security Project - SoC 08 Eduardo Neves		OWASP Access Control Rules Tester - SoC 08 PowerPoint Presentation Andrew Petukhov
10:15	OWASP Education Project - SoC 08 Sebastien Deleersnyder, Martin Knobloch		OWASP Teachable Static Analysis Workbench - SoC 08 PowerPoint Presentation Dmitry Kozlov
10:30	OWASP Internationalization Project - Soc 08 Juan Carlos Calderon		OWASP AppSensor - SoC 08 PowerPoint Presentation Michael Coates
10:45	PASSWD Project: Metrics and Vulnerabilities PowerPoint Presentation Lucilla Mancini		OWASP Backend Security Project - SoC 08 PowerPoint Prsentation Carlo Pelliccioni
11:00	OWASP Open Review Project Dan Cornell		OWASP Application Security Tool Benchmarking Environment and Site Generator Refresh Project - SoC 08 PowerPoint Presentation Dmitry Kozlov
11:15	OWASP Global Committee Elections
11:30	Coffee Break
	Working Sessions
12:45	Education Project WS Conclusions Sebastien Deleersnyder		Testing Guide Matteo Meucci	Web Application Framework Security Arshan Dabirsiaghi
14:45	Lunch (During Working Sessions)
	Training Sessions
15:00	Flash Player Security Peleus Uhley	OWASP Top 10 Video Sebastien Deleersnyder and Martin Knobloch	Uncovering WebScarab's Secret Treasures PowerPoint Presentation Rogan Dawes	Hacking the Orizon PowerPoint Presentation Paolo Perego
17:00	Coffee Break
	Working Sessions
17:30	Code Review Guide Eoin Keary	EU Funding for OWASP Projects Carlos Serrao	OWASP Certification Tom Brennan	Software Assurance Maturity Model Pravir Chandra
19:00	OWASP Website WS Conclusions PPT Presentation Fabio Cerullo	Metrics & Vulnerabilities Lucilla Mancini	OWASP Orizon Paolo Perego

Agenda for Thursday, November 6th, 2008
09:15	Daily Briefing Dinis Cruz
	Technology		Tools
10:00	OWASP Classic ASP Security Project - SoC 08 Juan Carlos Calderon		OWASP Source Code Review - SoC 08 PowerPoint Presentation James Walden
10:15	OWASP Ruby on Rails Security Project - SoC 08 PDF Presentation Heiko Webers		OWASP OpenPGP Extensions for HTTP - Enigform and mod openpgp - SoC 08 Arturo Alberto Busleiman
10:30	OWASP Webslayer Project Christian Martorella		OWASP Securing WebGoat using ModSecurity Project - SoC 08 Stephen Evans and Christian Folini
11:00	OWASP Skavenger Project - SoC 08 Matthias Rohr		OWASP AntiSamy Project - SoC 08 Marcin Wielgoszewski
11:15	Coffee Break
	Working Sessions
11:30	OWASP Top 10 - 2009 Dave Wichers	OWASP Intra Governmental Affairs David Campbell	SAMM v2	OWASP Website Fabio Cerullo	Handling Web MalWare
13:00	Lunch (During Working Sessions)
	Training Sessions
14:00	Ajax Security	Auditing Flash Applications Peleus Uhley		WebApp Assessment Vicente Aguilera Diaz	Mod Security Lucas C. Ferreira
	Working Sessions
16:30	OWASP Strategic Planning and Business Models compatible with OWASP values Jeff Williams, Dinis Cruz, Dave Wichers, Sebastien Deleersnyder, Tom Brennan & Kate Hartmann and Paulo Combra
18:30	Two-way Internationalization of OWASP Content Juan Carlos Calderon & Sebastien Deleersnyder		OWASP Best Practices for Chapter Leaders WS Conclusions Georg Hess		OWASP Live CD & DVD Matt Tesauro
20:00	Gala Dinner
22:00	OWASP Band

Agenda for Friday, November 7th, 2008
10:00	Daily Briefing Dinis Cruz
10:15	OWASP AppSec Agenda 2009: Working Session Outcomes
	Documentation Projects/Guides Integration and Unified 4.0 Version Eduardo Neves
	Browser Security Arshan Dabirsiaghi
	ESAPI Jeff Williams
	Tools Projects Matt Tesauro
	Code Review Guide Eoin Keary
	OWASP Certification Tom Brennan
	Software Assurance Maturity Model Pravir Chandra
	Top 10 2009 Dave Wichers
	Intra Governmental Affairs David Campbell
	Best Practices for Chapter Leaders Georg Hess
11:15	Coffee Break and Vote (put your dots on the wall)
11:30	Live CD & DVD Matt Tesauro
	ADSR Leonardo Cavallari
	Education Project Sebastien Deleersnyder
	Web Application Framework Security Arshan Dabirsiaghi
	Testing Guide Matteo Meucci
	OWASP Censorship Tom Brennan
	EU Funding for OWASP Projects Carlos Serrao
	OWASP Website Fabio Cerullo
	OWASP Orizon Paolo Perego
	Handling Web MalWare
	2-Way Internationalization Juan Carlos Calderon
	Portuguese Public & Private Organizations Carlos Serrao
	Winter of Code 2009 Dinis Cruz and Sebastien Deleersnyder
13:00	Lunch
14:00	Board Meeting
17:00	Announcement of Summit Procedings

OWASP BOARD MEETING

Board meeting was held at the OWASP Summit - RESULTS.

EVENT'S PHOTOS

More event's photos can be seen here.
Summit's slide show.

ARCHIVED DATA

FORMER AGENDA: Click here to see.

SUMMIT BROCHURE: 6 page brochure or this 33 page brochure.

VENUE & TRAVEL ARRANGEMENTS: The OWASP European Summit 2008 was hosted at the 5 start Resort in Algarve Portugal (Grande Real Santa Eulália Resort & Hotel). Hotel booking and the travel arrangements were be handled via Diplomata Tours, the assigned travel agency. The venue location - Google Maps Link. Nearest Airport - Faro.

OTHER LINKS: Press Information, Open Letter to Browsers&Frameworks, OWASP Summit UALG 1 Day Conference, OwaspEU08Summit on Twitter!, OWASP EU Summit 2008 Internals.

SPONSORS: