AppSec Brasil 2009

Para a versão em português, veja em AppSec Brasil 2009 (pt-br)

International Conference on Application Security

TI-Controle and the Computing Centre of the Deputy Chamber present the First International Conference on Application Security that will happen in Brasilia, Capital of Brazil with the support of OWASP Brazilian Chapter. The Conference consists of two days of training sessions, followed by a two-day conference on a single track.

Conference Dates

The conference will happen from October 27th, 2009 to October 30th, 2009. The first two days will be tutorial days (see below). Plenary sessions will be held on October 29th and 30th.

Keynotes

Gary McGraw

CTO, Cigital

Title: The Building Security In Maturity Model (BSIMM)

Bio: Gary McGraw is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C. area. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Java Security, Building Secure Software, Exploiting Software, Software Security, and Exploiting Online Games; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 100 peer-reviewed scientific publications, authors a monthly security column for informIT, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean's Advisory Council for the School of Informatics. Gary served on the IEEE Computer Society Board of Governors, produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine (syndicated by informIT), and produces the Reality Check Security Podcast for CSO Online.

Jason Li

Aspect Security

Title: Agile and Secure: Can We Do Both?

Co-author: Jerry Hoff, Aspect Security

Bio: Coming soon.

Agenda

Please see the Portuguese version of this page at http://www.owasp.org/index.php/AppSec_Brasil_2009_(pt-br)#tab=Agenda

Tutorial Days - October 27-28

OWASP will host numerous 1 and 2 day tutorial sessions prior to the conference. If you are interested in delivering a tutorial at this event, please see the Call for Training Provider.

Presentation Abstracts

The Building Security In Maturity Model (BSIMM)

Gary McGraw, Cigital

As a discipline, software security has made great progress over the last decade. There are now at least 34 large scale software security initiatives underway in enterprises including global financial services firms, independent software vendors, defense organizations, and other verticals. In 2008, Brian Chess, Sammy Migues and I interviewed the executives running nine initiatives using the twelve practices of the Software Security Framework as our guide. Those companies among the nine who graciously agreed to be identified include: Adobe, The Depository Trust and Clearing Corporation (DTCC), EMC, Google, Microsoft, QUALCOMM, and Wells Fargo. The resulting data, drawn from real programs at different levels of maturity was used to guide the construction of the Building Security In Maturity Model (BSIMM). This talk will describe the observation-based maturity model, drawing examples from many real software security programs. A maturity model is appropriate because improving software security almost always means changing the way an organization works ---people, process, and automation are all required. While not all organizations need to achieve the same security goals, all successful large scale software security initiatives share common ideas and approaches. Whether you rely on the Cigital Touchpoints, Microsoft's SDL, or OWASP CLASP, there is much to learn from practical experience. Use the BSIMM as a yardstick to determine where you stand and what kind of software security plan will work best for you.

Agile and Secure: Can We Do Both?

Jason Li and Jerry Hoff, Aspect Security

To be defined.

Practical Information

Venue

The event will be held in Brasília, Brazil's Capital at: Câmara dos Deputados, Anexo II, Praça dos Três Poderes.

You can check the location at Google Maps

Registration

Will be available soon.

Accommodations

To be defined

Transportation to the Conference

To be defined

How to get to the venue?

To be defined

Registration and Conference Fees

There will be no fees for this conference, only registration is required to participate.

Committees

Conference Committee

OWASP Conferences Chair: Dave Wichers - Aspect Security - dave.wichers 'at' owasp.org

2009 AppSec Brasil Program Committee ([email protected]):

• Conference Chair: Lucas C. Ferreira (lucas.ferreira at owasp.org)
• Tutorials Organization: Eduardo V. C. Neves (eduardo.neves at owasp.org)
• Tracks Organization: Wagner Elias (wagner.elias at owasp.org)

Pre-Event Organization Team

• Cassio Goldschmidt (cassio 'at' owasp.org)
• Kuai Hinojosa (kuai.hinojosa 'at' owasp.org)
• Leonardo Cavallari - (leo.cavallari 'at' owasp.org)
• Thiago Lechuga (thiagoalz 'at' gmail.com)
• Dinis Cruz (dinis.cruz 'at' owasp.org)

Event Organization Team

Links and other information

Event page on LinkedIn: http://events.linkedin.com/OWASP-AppSec-Brasil/pub/65160

FAQ

Q. Who is promoting the conference?

A. This conference is being supported and organized by the TI-Controle Community and the Deputy Chamber, with the contents (presentations, keynotes, training, etc) selected by the OWASP Brazilian Chapter.

Q. What will it cost?

A. Nothing. Thanks to its sponsor, the conference will be free of charge. However we have limited seats, so please register early.

Call For Papers

Q. What is the Open Web Application Security Project (OWASP)?

The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work with your support.

Q. How many speaking slots are there?

Please see the Conference Agenda in its main page.

Q. What are the submission deadlines?

The CFP submission deadline is July 11th, with the final version of the presentation material due September 15th 2009.

Q: Who is allowed to submit presentations?

A: Original authors may submit presentations for consideration. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.

Q: Why aren't Third Parties such as PR Firms allowed to submit presentations?

A: Due to potential copyright and intellectual property liability issues as well as the need for OWASP to have direct contact with potential and selected presenters to expedite selection and deliverable materials, we require that only original authors of presentations submit for the Call for Papers. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.

Q: Are there any restrictions on the content of the presentations?

A: Yes, all presentations must respect the rules defined in the OWASP Speaker Agreement.

Q: How long will I have to wait before I am notified if I have been accepted or denied?

A: Submitters will be notified of the status (acceptance or denial) on August 7th 2009.

Q. Is there an honorarium for presenters?

No. OWASP is committed to making its conferences available to the widest possible audience. In order to do this OWASP keeps the entrance free for the AppSec Brazil 2009 to make the conference accessible. As a result we are unable to provide a monetary honorarium but we welcome our speakers as our guests to the conference where they can network with other security professionals. We will provide lodging and domestic air travel for one presenter for each selected work.

Q: I have been accepted. What are the materials that I have to turn in and what are the deadlines?

A: The following is a list of materials that are required from each accepted presentation. Failure to proceed these materials by the deadlines set forth for the event the presentation was accepted for will result in cancellation of acceptance.

• A confirmed Speaker Agreement (July 15th 2009)
• Presentation in PowerPoint or Keynote format using the OWASP Template (September 15th 2009)
• Detailed Bibliography of resources, co-authors, etc. (September 15th 2009)
• Optional White Paper for inclusion on CD (September 15th 2009)

Q: Do I have to submit a White Paper?

A: No. We would certainly appreciate any White Papers that can be included on the conference web site but they are not required. If you have written an existing white paper to go along with your presentation, please submit it with your CFP submission. Submissions with attached White Papers will receive additional consideration.

Q: What if I have a co-author who is not presenting. How do I cite the person(s)?

A: All co-authors and works that have been used should be cited in a detailed bibliography that will be published on the Conference CD.

Q: I have been accepted and would like to add co-presenters. Can I still do this?

A: No. Co-presenters should have been added at the time that the Presentation was submitted. They may attend the conference and present if they register as any other participant.

Q: My PR company/friends/co-workers/family would like to come see me give my presentation. Will they be allowed in for free?

A: Yes, but they need to register on the conference web site as any other conference participant.

Q. I have more questions

A: Email [email protected] concerning this event.