Boston

Welcome to the OWASP Boston Chapter

To find out more about the Boston chapter, please send an email to Jim Weiler or just join the OWASP Boston mailing list.

We meet the FIRST WEDNESDAY of EVERY MONTH, 6:30 to 9 pm.

Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.

Information and an RSS feed for meeting updates about this and other Boston area user groups can be found at Boston User Groups.

Location

The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month, 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA.

From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C.

Reviews

Security Podcast Reviews

I've been listening to lots of Computer Security presentations on my iPod (MP3 files) and I've found them a great way to spend some of the 5 hours a week commuting time I have. I thought I'd share my opinion of the ones I've found, and maybe some of you can let us know your opinions of any security podcasts you know of. Most of these I found using iTunes as the podcast aggregator, but I've included their direct links and their own self description. Most you can subscribe to, but some are from a portal of single podcasts. Generally no one's background, experience or job is described. None of these are particularly about web application security except MightySeek, but they can be interesting. There are others explicitly about network or VOIP security that I have not included. I've included the iPod display and iTunes description in order to judge how easy it is to select the one you want on your iPod and to manage them in your library, like remembering which ones you've listened to and deleting them.

Local News

Wed. June 7

• 6:30 pm - Jim Weiler - Short Topic - TBD
• 7:00 Imperva - Application and Database Vulnerabilities and Intrusion Prevention
• 8:15 - Using Paros Proxy Server as a Web Application Vulnerability tool - Part 3 analysing Paros sessions; Paros utilities

Speaker - Dan Carcone, Senior Security Engineer; Imperva

This will be a live Application and Database hacking demonstration on a live web site that was created specifically for this purpose. This web site is sitting behind a market leading Firewall, and the applications running it were designed by a third party firm that specializes in creating on-line shopping applications. Discussion will include many real life examples of penetration tests that we have conducted.

He is responsible for providing technical sales support, application and database security consulting and training services to the company’s customers. Mr. Carcone has 16+ years experience in penetration testing and securing information systems from unauthorized intrusion and attacks.

He first worked as Security Testing Engineer at Bell Telephone Companies Security consulting group in 1987 specializing in UNIX systems. Since then Mr. Carcone has worked at numerous fortune 1000 companies and software vendors, providing consulting to companies how to protect their most valuable information assets.

JW - this tool can be used as a non-intrusive HTTP request rules engine, to look at any part of the request as well as the response; and as a non-intrusive database request rules engine. Even if malicious requests get thru your app thay can be stopped before entering the database.

Short Topic - TBD - Jim Weiler

Speaker - Jim Weiler Topic - Using Paros Proxy Server as a Web Application Vulnerability tool - Part 3 session analysis and reporting; using Paros tools; modifying and resending requests Past Meeting Notes

Past Meeting Notes

Feb 2005

Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.

March 2005

Joe Stagner: Microsoft Let's talk about Application Security

April 2005

Jonathan Levin - Of Random Numbers

Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security

May 2005

Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom

June 2005

Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools

July 2005

Mark O'Neill, CTO: Vordel - Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security

September 2005

Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security

October 2005

Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges

Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways

November 2005

Robert Hurlbut, Independent Consultant Threat Modeling for web applications

December 2005

Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled

January 2006

David Low, Senior Field Engineer: RSA Practical Encryption

February 2006

Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source

March 2006

Mateo Meucci; OWASP Italy Anatomy of 2 web attacks

Tom Stracener; Cenzic Web Application Vulnerabilities

April 2006

Dennis Hurst; SPI Dynamics: A study of AJAX Hacking

Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!