Projects Summit 2013

AppSec USA 2013

Project Summit Home

2013 OWASP Project Summit Report

Introduction

The OWASP Project Summit is a smaller version of the much larger OWASP Summits. This event activity gives our project leaders the opportunity to showcase their project progress, and have attendees sit down and work on project tasks during the event. It is an excellent opportunity to engage the event attendees, and it gives project leaders the chance to move forward on their project milestones while meeting new potential volunteers that can assist with future milestones.

For more details see also the main Project Summit pages at the main OWASP AppSecUSA website: http://appsecusa.org/2013/activities/owasp-project-summit/

Working Sessions

Click on the working session name to see the home page for that particular session. During the Summit those working session home pages will be used to document discussions and outcomes.

If you're interested in adding a Working Session for the 2013 Summit, there still is time to start a session! Please review the Working Session methodology for Working Session rules.

NOTE: The current banners below are placeholders. Track topics are subject to change.

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Project Reviews	Introduction to new assessment criteria to conduct reviews. Team in small groups (2 to 3 max) based on experience and background to asses a set of Projects (Code, Tool or Documentation). Fill in the Questionnaire (Google Forms) to complete assessment of Projects and provide the review with a final score and results (Project defined as Incubator, Lab or Flagship). Review results of questionnaire with your team. Present results and conclusions of assessment session.	Review of all the current Flagship, some Lab, and some Incubator projects. Find here. Assign them an appropriate stage designation based on the review. Update the inventory based on reviews. Create banners that show what stage each project is on. To be placed on the wiki.	Johanna Curiel @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	ESAPI Hackathon	Planning to sponsor 2 "senior developers" to attend the hack-a-thon and take the lead role on the development effort, they will be involved in the architecture aspect of the project and goal-building and attendees will be able to choose a component from the architecture to work on. We will purchase a prize for the developer/team that accomplishes the most quality work scored based on complexity of the component(s) they will be working on. The judges for the prizes will be Jeff Williams, Kevin Wall and Chris Schmidt. There will be a set of guidelines for entries – primarily, backwards compatibility and/or clear upgrade path from ESAPI 2.x, testability, and distribution model of the component.	Identify the primary goals to deem the hack-a-thon a success. Layout the overall architecture vision for ESAPI 3.0. Lay down the infrastructure (Git, Continuous Integration, Testing Framework, etc.). Design the specification for the components that will be required. Close down all inactive ESAPI Projects.	Chris Schmidt @	Chris Schmidt @ Kevin Wall @ Jeff Williams @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	OWASP Media Project	The first and main instance of the project will be a YouTube channel. To gather potential sources and existing videos in order to populate the OWASP channel. Give projects exposure with video content.	Presenting Google Hangouts Presenting the official OWASP YouTube channel. Gather potential sources and existing videos in order to populate the OWASP channel.	[email protected] @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	OWASP PHP Security and RBAC Project	To demonstrate and introduce the OWASP PHP Security Project, have people contribute to it and have people contribute it to their own projects! The project is developed, we're going to show sample usages and have people try to hack them (which should be impossible). We also introduce the libraries and discuss what future works are needed on the project. The project is really interesting and has a cool aim, and this will help get a lot more people in its community. RBAC Project OWASP RBAC is a new cutting-edge technology taht can revolutionize the authorization domain. Unfortunately because its rigorous and comlex, we havent been very succesful in expanding its usage. Get the people know how awesome this is, and get them use it in their applications. This is a pretty mature project and is one of those things that you don't know exists, but when you do you can't get enough of. We also like to get contributors porting it to other programming languages.	The RBAC project aims to port and promote standard NIST Level 2 RBAC implementations. OWASP PHP Security project plans to gather around secure PHP libraries, and provide a full featured framework of libraries for secure web applications in PHP, both as separate de-coupled libraries and as a whole secure web application framework.	Abbas Naderi @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Bug Bounty Session	Collaboration, Learning and Sharing Knowledge - By creating an environment where attendees can get together in an 'live hacking' event. In order to keep things focused, the 'targets' are going to be companies that have public "Bug Bounties' programs. These will be companies that accept and want to be targets for such ethical hacking activities. Each participant will be asked to have 'common sense' and to respect a couple 'soft' rules of engagement. All participants are encouraged to share their ideas, techniques and discoveries. In addition to the 'Bug Bounty' targets, we will also add a couple Open Source apps so that the 'builders' also have the opportunity to fix the source code and the 'breakers' can do source-code analysis.	To have authorization to attack/test 'targets'.	Dinis Cruz @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	AppSensor 2.0 Hackathon	Build code for AppSensor 2.0. Move to a service model of both REST and SOAP for event detection and response. Make it possible to identify and and eliminate the threat of an attacker before they are able to successfully identify an exploitable flaw.	Define detection points. Provide guidance on how to respond once a malicious attacker has been identified.	John Melton

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	OWASP Training Development Session	OWASP Boot camp development. OWASP Training events brainstorming session and planning.	Develop a roadmap for an OWASP Bootcamp Program. Develop a handfull of ideas for an OWASP Training Program.	Konstantinos Papapanagiotou @	Martin Knobloch @ Konstantinos Papapanagiotou @
view edit	OWASP Academies Development Session	OWASP Academies discussion. OWASP University Outreach. OWASP Student Chapter.	Develop a roadmap for OWASP Academies Program for 2014.	Martin Knobloch @	Konstantinos Papapanagiotou @ Martin Knobloch @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	ESAPI Hackathon	Planning to sponsor 2 "senior developers" to attend the hack-a-thon and take the lead role on the development effort, they will be involved in the architecture aspect of the project and goal-building and attendees will be able to choose a component from the architecture to work on. We will purchase a prize for the developer/team that accomplishes the most quality work scored based on complexity of the component(s) they will be working on. The judges for the prizes will be Jeff Williams, Kevin Wall and Chris Schmidt. There will be a set of guidelines for entries – primarily, backwards compatibility and/or clear upgrade path from ESAPI 2.x, testability, and distribution model of the component.	Identify the primary goals to deem the hack-a-thon a success. Layout the overall architecture vision for ESAPI 3.0. Lay down the infrastructure (Git, Continuous Integration, Testing Framework, etc.). Design the specification for the components that will be required. Close down all inactive ESAPI Projects.	Chris Schmidt @	Chris Schmidt @ Kevin Wall @ Jeff Williams @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Mobile Security Project	The primary focus is at the application layer. Target the areas that the average developer can make a difference. Focus on the mobile applications deployed to end user devices. Focus on the broader server-side infrastructure which the mobile apps communicate with. A heavy focus is placed on the integration between the mobile application, remote authentication services, and cloud platform-specific features.	Top Ten Mobile Risks Mobile Tools Mobile Security Testing Mobile Cheat Sheet Series Secure Mobile Development	Jack Mannino @ Jason Haddix @ Daniel Miessler @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Bug Bounty Session	Collaboration, Learning and Sharing Knowledge - By creating an environment where attendees can get together in an 'live hacking' event. In order to keep things focused, the 'targets' are going to be companies that have public "Bug Bounties' programs. These will be companies that accept and want to be targets for such ethical hacking activities. Each participant will be asked to have 'common sense' and to respect a couple 'soft' rules of engagement. All participants are encouraged to share their ideas, techniques and discoveries. In addition to the 'Bug Bounty' targets, we will also add a couple Open Source apps so that the 'builders' also have the opportunity to fix the source code and the 'breakers' can do source-code analysis.	To have authorization to attack/test 'targets'.	Dinis Cruz @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Project Guide Review Session	Figure out what else needs to be done for each project. Assign sections to each participant. Finish various sections assigned to you. Consolidate all finished sections.	Finished content for AppSensor Book. Finished content for Development Guide Book. Finished content for Code Review Guide Book. . Finished content for Testing Guide Book.	Michael Hidalgo @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	ESAPI Hackathon	Planning to sponsor 2 "senior developers" to attend the hack-a-thon and take the lead role on the development effort, they will be involved in the architecture aspect of the project and goal-building and attendees will be able to choose a component from the architecture to work on. We will purchase a prize for the developer/team that accomplishes the most quality work scored based on complexity of the component(s) they will be working on. The judges for the prizes will be Jeff Williams, Kevin Wall and Chris Schmidt. There will be a set of guidelines for entries – primarily, backwards compatibility and/or clear upgrade path from ESAPI 2.x, testability, and distribution model of the component.	Identify the primary goals to deem the hack-a-thon a success. Layout the overall architecture vision for ESAPI 3.0. Lay down the infrastructure (Git, Continuous Integration, Testing Framework, etc.). Design the specification for the components that will be required. Close down all inactive ESAPI Projects.	Chris Schmidt @	Chris Schmidt @ Kevin Wall @ Jeff Williams @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Bug Bounty Session	Collaboration, Learning and Sharing Knowledge - By creating an environment where attendees can get together in an 'live hacking' event. In order to keep things focused, the 'targets' are going to be companies that have public "Bug Bounties' programs. These will be companies that accept and want to be targets for such ethical hacking activities. Each participant will be asked to have 'common sense' and to respect a couple 'soft' rules of engagement. All participants are encouraged to share their ideas, techniques and discoveries. In addition to the 'Bug Bounty' targets, we will also add a couple Open Source apps so that the 'builders' also have the opportunity to fix the source code and the 'breakers' can do source-code analysis.	To have authorization to attack/test 'targets'.	Dinis Cruz @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	PCI Toolkit Working Session	To help define if the system components of your network falls within the PCI-DSS requirements. Create an assessment and a final report of your scope delimitation.	Beta version will be released in December 2013.

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	OWASP O2 Documentation Session	Discuss the development of an O2 Handbook. Develop a documentation outline and assign sections to attendees.	Alpha version will be released in December 2013.

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	ZAP Hackathon Session	Explain how people can contribute to ZAP Demonstrate how to set up a ZAP development environment Explain ZAP code structure Show people how to code scripts, active/passive scan rules, add-ons, core changes and improve the docs and localization Let people hack the ZAP code and docs with full support and guidance	Identify set of enhancements attendees can work on Everyone with access to a ZAP dev environment An understanding of the ZAP code structure An understanding of how to develop ZAP code A set of small enhancements that can be committed immediately	Simon Bennetts @	Johanna Curiel

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	ESAPI Hackathon	Planning to sponsor 2 "senior developers" to attend the hack-a-thon and take the lead role on the development effort, they will be involved in the architecture aspect of the project and goal-building and attendees will be able to choose a component from the architecture to work on. We will purchase a prize for the developer/team that accomplishes the most quality work scored based on complexity of the component(s) they will be working on. The judges for the prizes will be Jeff Williams, Kevin Wall and Chris Schmidt. There will be a set of guidelines for entries – primarily, backwards compatibility and/or clear upgrade path from ESAPI 2.x, testability, and distribution model of the component.	Identify the primary goals to deem the hack-a-thon a success. Layout the overall architecture vision for ESAPI 3.0. Lay down the infrastructure (Git, Continuous Integration, Testing Framework, etc.). Design the specification for the components that will be required. Close down all inactive ESAPI Projects.	Chris Schmidt @	Chris Schmidt @ Kevin Wall @ Jeff Williams @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Bug Bounty Session	Collaboration, Learning and Sharing Knowledge - By creating an environment where attendees can get together in an 'live hacking' event. In order to keep things focused, the 'targets' are going to be companies that have public "Bug Bounties' programs. These will be companies that accept and want to be targets for such ethical hacking activities. Each participant will be asked to have 'common sense' and to respect a couple 'soft' rules of engagement. All participants are encouraged to share their ideas, techniques and discoveries. In addition to the 'Bug Bounty' targets, we will also add a couple Open Source apps so that the 'builders' also have the opportunity to fix the source code and the 'breakers' can do source-code analysis.	To have authorization to attack/test 'targets'.	Dinis Cruz @

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Open SAMM	Evaluate an organization’s existing software security practices. Build a balanced software security program in well-defined iterations. Demonstrate concrete improvements to a security assurance program. Define and measure security-related activities within an organization.	Flexibility A model that can be applied organization-wide.	Sebastien Deleersnyder

Summit Organisation Pages

These are pages with organization details about this event

• Projects Summit 2013 Attendees
• Mailing list (at Google Groups: owasp-project-summit-2013
• Projects Summit page at main AppSec USA website
• Working_Sessions
• Venue
• Remote_Participation
• Budget

Reference Links:

• Last Summit webpages: Summit_2011