This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Bay Area"
(→Next Event) |
(→Next Event) |
||
| Line 7: | Line 7: | ||
=== Next Event === | === Next Event === | ||
| − | + | November 30, 2011 | |
| − | ''' | + | Stanford Campus, Gates 104 |
| + | Directions to the Gates building available here: http://forum.stanford.edu/visitors/directions/gates.php | ||
| + | |||
| + | '''Agenda''' | ||
| + | 5:30pm - Welcome | ||
| + | 5:40pm - Jason Chan, Practical Cloud Security | ||
| + | 6:15pm - Luca Carettoni, From CVE-2010-0738 to the recent JBoss worm | ||
| + | 6:50pm - David Fifield, Evading censorship with browser-based proxies | ||
| + | 7:25pm - Abraham Kang, DOM-based XSS and output encoding | ||
| − | ''' | + | '''You must RSVP''' at http://owaspbayareanov2011.eventbrite.com/ prior to attending, we need to know how many people are coming to make sure we have the correct room sizing. |
| − | + | ---- | |
| + | '''Jason Chan - Practical Cloud Security | ||
| + | ''' | ||
| + | Over the past several years, there has been much hand wringing and teeth gnashing related to public cloud security. Because of this, many organizations have limited or delayed their cloud usage. | ||
| + | Faced with business and market imperatives that demanded scale and elasticity that traditional data center architectures could not provide, Netflix jumped head first into the public cloud two years ago. As we continue to mature our environment, we’ve also begun leveraging the benefits of the public cloud to enhance our security posture and capabilities. | ||
| + | This presentation will be a practical examination of Netflix’s approach to cloud security. Topics covered include: | ||
| + | • Using public cloud automation and APIs to enhance security visibility | ||
| + | • Netflix’s “Security Monkey” tool for cloud security monitoring and alerting | ||
| + | • Inter-host reachability and connectivity analysis for firewall policy evaluation and optimization | ||
| + | • Netflix’s model-driven architecture for securing and managingsystems and applications | ||
| + | • Call to action: Cloud Security Gap Analysis and Next Steps | ||
| − | + | '''Luca Carettoni - From CVE-2010-0738 to the recent JBoss worm | |
| + | ''' | ||
| + | Being a widely deployed enterprise application server, JBoss has always been a juicy target for attackers. Security vulnerabilities and misconfigurations in critical components, such as the infamous JMX-console, can be exploited in order to execute arbitrary code and harm the confidentiality, integrity and availability of the entire system. Our quick journey through JBoss insecurity will start from the analysis of a critical authentication bypass flaw to the recent JBoss worm which affected numerous installations worldwide. This presentation will also cover practical aspects on how to detect misconfigurations and secure your application server. | ||
| − | + | '''David Fifield - Evading censorship with browser-based proxies | |
| + | ''' | ||
| + | Proxy systems like Tor and VPNs can be used to get around Internet censorship and access blocked resources, but what happens when the circumvention system itself is blocked? A flash proxy is a miniature proxy that runs in a web browser, that can be activated just by viewing a web page. Web site visitors provide a large and constantly changing pool of proxy addresses that are difficult to block. Even though each proxy may last only seconds or minutes, it is possible to switch between them in a way that makes web browsing more or less seamless. We will share details of our flash proxy implementation and explain how to add a proxy to your web page. | ||
| − | + | '''Abraham Kang - DOM-based XSS and output encoding | |
| − | + | ''' | |
| − | + | An interactive presentation that intends to turn all of the listeners of the presentation into XSS experts and help them understand how to mitigate XSS properly using output encoding. | |
| − | |||
| − | |||
| − | |||
| − | ''' | ||
=== Previous Event === | === Previous Event === | ||
Revision as of 22:10, 2 November 2011
OWASP Bay Area
Welcome to the Bay Area chapter homepage.
Participation
OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
Sponsorship/Membership
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
Chapter Meetings
Date and Location
Next Event
November 30, 2011
Stanford Campus, Gates 104 Directions to the Gates building available here: http://forum.stanford.edu/visitors/directions/gates.php
Agenda 5:30pm - Welcome 5:40pm - Jason Chan, Practical Cloud Security 6:15pm - Luca Carettoni, From CVE-2010-0738 to the recent JBoss worm 6:50pm - David Fifield, Evading censorship with browser-based proxies 7:25pm - Abraham Kang, DOM-based XSS and output encoding
You must RSVP at http://owaspbayareanov2011.eventbrite.com/ prior to attending, we need to know how many people are coming to make sure we have the correct room sizing.
Jason Chan - Practical Cloud Security Over the past several years, there has been much hand wringing and teeth gnashing related to public cloud security. Because of this, many organizations have limited or delayed their cloud usage. Faced with business and market imperatives that demanded scale and elasticity that traditional data center architectures could not provide, Netflix jumped head first into the public cloud two years ago. As we continue to mature our environment, we’ve also begun leveraging the benefits of the public cloud to enhance our security posture and capabilities. This presentation will be a practical examination of Netflix’s approach to cloud security. Topics covered include: • Using public cloud automation and APIs to enhance security visibility • Netflix’s “Security Monkey” tool for cloud security monitoring and alerting • Inter-host reachability and connectivity analysis for firewall policy evaluation and optimization • Netflix’s model-driven architecture for securing and managingsystems and applications • Call to action: Cloud Security Gap Analysis and Next Steps
Luca Carettoni - From CVE-2010-0738 to the recent JBoss worm Being a widely deployed enterprise application server, JBoss has always been a juicy target for attackers. Security vulnerabilities and misconfigurations in critical components, such as the infamous JMX-console, can be exploited in order to execute arbitrary code and harm the confidentiality, integrity and availability of the entire system. Our quick journey through JBoss insecurity will start from the analysis of a critical authentication bypass flaw to the recent JBoss worm which affected numerous installations worldwide. This presentation will also cover practical aspects on how to detect misconfigurations and secure your application server.
David Fifield - Evading censorship with browser-based proxies Proxy systems like Tor and VPNs can be used to get around Internet censorship and access blocked resources, but what happens when the circumvention system itself is blocked? A flash proxy is a miniature proxy that runs in a web browser, that can be activated just by viewing a web page. Web site visitors provide a large and constantly changing pool of proxy addresses that are difficult to block. Even though each proxy may last only seconds or minutes, it is possible to switch between them in a way that makes web browsing more or less seamless. We will share details of our flash proxy implementation and explain how to add a proxy to your web page.
Abraham Kang - DOM-based XSS and output encoding An interactive presentation that intends to turn all of the listeners of the presentation into XSS experts and help them understand how to mitigate XSS properly using output encoding.
Previous Event
When: June 22nd 11:30am - 1:30pm
Where: Pacific Gas & Electric Co Inc, 245 Market Street, Room 1417, San Francisco CA 94111 Directions
Agenda:
Networking
1) Tom Brennan, International Board of Directors OWASP Foundation "Where we are... Where we are going"
2) Sam Bowne, City College San Francisco Computer Networking and Information Technology- BIO
3) TBD
RSVP to: Teresa Stevens - ExSi(at)pge(dot)com so she can get a head count.
Lunch will be provided.
Donate Funds to Bay Area Chapter
<paypal>Bay Area</paypal>
