This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Boston
OWASP Boston
Welcome to the Boston chapter homepage. The chapter leader is Jim Weiler
Participation
OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
Sponsorship/Membership
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
Local News
<paypal>Boston</paypal>
To find out more about the Boston chapter, just join the OWASP Boston mailing list.
Local Chapter Information --- Our Sixth Year
The chapter shipping/mailing address is:
OWASP Boston 35 Wachusett Dr Lexington, MA. 02421
Reviews
Boston Application Security Conference
Boston Application Security Conference
Chapter Meetings
We usually meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm.
Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.
Information for meeting updates about this and other Boston area user groups can also be found at BostonUserGroups.
Location
The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month ( Unless a speaker can only present another night), 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA.
From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C.
Next Meeting ---- Wednesday July 7 at Microsoft Waltham
Agenda: 6:30 - 7 - what's happening in OWASP and how it might be useful to you, general Q+A, networking
Presentations
Rob Cheyne Lightning Talk - Cross Site Request Forgery
In this installment of the Safelight lightning talks series, Rob will present the basics of a Cross-site Request Forgery (CSRF) attack. This is a common vulnerability, yet frequently misunderstood and often overlooked.
Rob will demonstrate how CSRF works, how it can be used as part of a real-world attack, and then discuss ways to prevent the issue from occurring in your own applications.
Main Presentation - Joey Peloquin - Director of Application Security, Fishnet Security
Speaker Bios
Joey Peloquin is responsible for project oversight and quality assurance, business development, and managing the team’s offerings and methodologies. He’s spent the last 9 of 15 years in I.T. specializing in Information Security, with approximately the last five specifically in Application Security. Prior to joining FishNet Security, he created the service offerings and methodology for Hewlett-Packard’s Application Security Center Professional Services Team (formerly SPI Dynamics). At HP, he managed all partner-delivered projects and was the team lead for the internal team with the responsibility of training and mentoring new consultants. Joey also spent nearly a decade with JCPenney Corporation, where he built the Application Security Program, and generated application security awareness through aggressive penetration testing policies.
Rob Cheyne is founder and CEO of Safelight Security Advisors, a leading information security training company. He is an application security expert who has taught security training classes to over 10,000 developers, architects, and managers, and executives. He has 20 years of information technology experience and has been working in information security since 1998. Rob has a solid combination of business and technical expertise, and over the years, he has played the role of software developer, systems integrator, security expert, consultant, trainer and entrepreneur. Prior to Safelight, Rob was a co-founder of @stake, a highly regarded pioneer in information security consulting. In this role, he led and conducted secure architecture and design reviews, secure code reviews, application penetration tests, and security audits for numerous Fortune 500 companies. He helped develop@stake's application security assessment methodologies, and led @stake's Application Security Center of Excellence for two years. Rob was also a co-author of the award-winning L0phtCrack password auditing software and he worked on @stake's SmartRisk Analyzer team, which was successfully spun-off as Veracode.
Past Meeting Notes
May 2010
Rob Cheyne Lightning Talk - SQL Injection
Vinnie Liu - Data Exposure, New Approaches to Open Source Intelligence Techniques, and Incident Handling
April 2010
Dan Hestad Security Innovation Dan will be talking about his experiences with PCI and web applications, and answering questions about do's and don'ts of acceptable PCI practices in web applications.
March 2010
Zack Lanier - Disclosure Samsara, or "the endless vulnerability disclosure debate"
http://n0where.org/talks/samsara_20100310.html
http://n0where.org/talks/samsara_20100310.pdf (very large PDF)
February 2010
Rob Cheyne of Safelight Security Advisors; New Technology, Same Old Vulnerabilities
January 2010 at Microsoft NERD, Cambridge
Josh Abraham, Rapid 7 Technologies
December 2009
Eric Bender, Cenzic
November 2009
Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels - Web Application Vulnerability Scanners
Mush Hakhinian, Leader, Application Security Practice, IntraLinks - Secure coding with no money down using SONAR: unleashing the power of open-source code analysis tools
October 2009
Paul Schofield, Senior Security Engineer, Imperva - From Rivals to BFF: WAF & VA Unite
September 2009 at CORE Technologies, Boston
Paul Asadoorian, Pauldotcom.com
Alex Horan, CORE Security
May 2009
Joey Peloquin, Fishnet Security, Secure SDLC: The Good, the Bad and the Ugly presentation pdf
March 2009
Sabha Kazerooni, Security Compass - Exploit Me tools; Framework Level Threat Analysis
Framework Level Threat Analysis document
Meeting Pizza Sponsor - Arcot
Arcot is a leader in online fraud prevention, strong authentication and eDocument security. Arcot's solutions are easily deployed, low-cost and extremely scalable, allowing organizations to transparently protect their users from fraud without changing user behavior or requiring expensive hardware.
Arcot can be contacted thru Michael Kreppein, [email protected], 617-467-5200, www.arcot.com
December 2008
Brian Holyfield, Gothem Digital Science
Tamper Proofing Web Applications http://www.gdssecurity.com/l/b/2008/12/04/
June 2008
Jeremiah Grossman; Founder and CTO, Whitehat Security
Appetizer - Hacking Intranets from the Outside (Just when you thought your network was safe) Port scanning with JavaScript
Main Topic - Business Logic Flaws: How they put your Websites at Risk
March 2008
Chris Eng; Senior Director, Security Research, Veracode
Description – Attacking crypto in web applications
December 2007
Scott Matsumoto; Principal Consultant, Cigital
Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security
November 2007
Tom Mulvehill Ounce Labs
Description – Tom will share his knowledge and expertise on implementing security into the software development life cycle. This presentation will cover how to bring practicality into secure software development. Several integration models will be explored as well as solutions for potential obstacles
October 2007
George Johnson, Principal Software Engineer EMC; CISSP
An Introduction to Threat Modeling.
September 2007
Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century"
June 2007
Tool Talk - Jim Weiler - WebGoat and Crosssite Request Forgeries
Danny Allan; Director, Security Research, Watchfire
Topic: Exploitation of the OWASP Top 10: Attacks and Strategies
March 2007
Jeremiah Grossman, CTO Whitehat Security: Top 10 Web Application Hacks of 2006
January 2007
Dave Low, RSA the Security Division of EMC: encryption case studies
November 2006
September 2006
Mike Gavin, Forrester Research: Web Application Firewalls
June 2006
Imperva - Application and Database Vulnerabilities and Intrusion Prevention
Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool
May 2006
April 2006
Dennis Hurst; SPI Dynamics: A study of AJAX Hacking
Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!
March 2006
Mateo Meucci; OWASP Italy Anatomy of 2 web attacks
Tom Stracener; Cenzic Web Application Vulnerabilities
February 2006
Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source
January 2006
David Low, Senior Field Engineer: RSA Practical Encryption
December 2005
Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled
November 2005
Robert Hurlbut, Independent Consultant Threat Modeling for web applications
October 2005
Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges
Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways
September 2005
Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security
July 2005
Mark O'Neill, CTO: Vordel - Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security
June 2005
Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools
May 2005
Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom
April 2005
Jonathan Levin - Of Random Numbers
Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security
March 2005
Joe Stagner: Microsoft Let's talk about Application Security
Feb 2005
Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.
Boston OWASP Chapter Leaders
President
Jim Weiler 781 356 0067
Program Committee
Mark Arnold
Jim Weiler 781 356 0067
