Belgium

OWASP Belgium

Welcome to the Belgium chapter homepage. The chapter leader is Sebastien Deleersnyder

Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Sponsorship/Membership

to this chapter or become a local chapter supporter. Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?

Local News

The presentation by Seba “Beyond network security: why hackers don't care about your firewall” for the Belnet Security Conference on May 5 is available for download here

Block your agenda's for chapter meetings next months:

In Brussels (LCM) on the 23th of May, 18h-21h, together with ISSA Belgium with:

• The Ghost of XSS Past, Present and Future – A Defensive Tale (by Jim Manico, Infrared Security)
• Non-convential Attacks: Things your security scanners won't find (by Tom Van Der Mussele, Verizon)
• Discussion: How CERT.be & OWASP can improve web application security in Belgium (by Christian Van Heurck, CERT.be)

In Brussels on the 16th of June, 18h-21h with:

• The OWASP AppSensor Project (by Colin Watson, Watson Hall Ltd)
• How to become Twitter's admin: An introduction to Modern Web Service Attacks (by Andreas Falkenberg, RUB)

Structural Sponsors 2010

OWASP Member affiliated to the Belgium chapter:

      

OWASP Belgium thanks its structural chapter supporters for 2010 and the OWASP BeNeLux Day 2010:

If you want to support our chapter, please contact Seba Deleersnyder

<paypal>Belgium</paypal>

Next Meeting (23th of May 2011) in Brussels

WHEN

23th of May2011 18h-21h00

WHERE

LCM, Haachtsesteenweg 579 1031 Brussel

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Sandwiches
  
• 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 18h45 - 19h00: ISSA Update (by Clement Herssens)
  
• 19h00 - 19h45: Non-convential Attacks: Things your security scanners won't find (by Tom Van Der Mussele, Verizon)
  

This presentation will handle non-conventional attacks, such as:

• Attacking XML Streams
• Context escaping
• Session Time-outs

Tom Van der Mussele is a Lead Security Analyst for the Governance, Risk & Compliance Programs in EMEA for Verizon Business Security Solutions. Prior to joining the Governance, Risk & Compliance Programs, Tom worked as Penetration tester. In this role, he specialized in security audits, including penetration testing and web application vulnerability assessments for major financials and governmental organizations.

• 19h45 - 20h30: The Ghost of XSS Past, Present and Future – A Defensive Tale (by Jim Manico, Infrared Security)
  

This talk will discuss the past methods used for XSS defense that were only partially effective. Learning from these lessons, will will also discuss present day defensive methodologies that are effective, but place an undue burden on the developer. We will then finish with a discussion of future XSS defense mythologies that shift the burden of XSS defense from the developer to various frameworks. These include auto-escaping template technologies, browser-based defenses such as Content Security Policy, and Javascript sandboxes such as the Google CAJA project and JSReg.

Jim Manico is a managing partner of Infrared Security with over 15 years of professional web development experience. Jim is also the chair of the OWASP connections committee, one of the project managers of the OWASP ESAPI project, a participant and manager of the OWASP Cheatsheet series, the producer and host of the OWASP Podcast Series, the manager of the OWASP Java HTML Sanitizer project and the manager of the OWASP Java Encoder project. When not OWASP'ing, Jim lives on of island of Kauai with his lovely wife Tracey.

• 20h30 - 21h00: Discussion: How CERT.be & OWASP can improve web application security in Belgium (by Christian Van Heurck, CERT.be)
  

CERT.be presentation and group discussion

REGISTRATION

Please register via RegOnline: https://www.regonline.com/owasp-belgium-2011-05-23

Next Meeting (16th of June 2011) in Brussels

WHEN

16th of June 2011 18h-21h00

WHERE

TBD

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Sandwiches
  
• 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 18h45 - 19h45: The OWASP AppSensor Project (by Colin Watson, Watson Hall Ltd)
  

The OWASP AppSensor Project defines a conceptual framework and methodology that offers prescriptive guidance to implement attack detection and automated response into an existing application. The talk will provide an overview why conventional defences do not work, and how application-specific detection can be used to identify, and respond to, attackers before they are able to find a flaw to exploit. Implementations will be described that have been tested against security scanning tools, manual attackers and how the technique could be used to defend against an application worm.

Colin Watson is co-founder of Watson Hall Ltd, based in London, where his work involves the management of application risk, designing defensive measures, building security & privacy in to systems development and keeping abreast of relevant international legislation and standards. He holds a BSc in Chemical Engineering from Heriot-Watt University in Edinburgh, and an MSc in Computation from the University of Oxford. He contributes to a number of OWASP projects and is a member of the OWASP Global Industry Committee.

• 19h45 - 20h00: Break
  
• 20h00 - 21h30: How to become Twitter's admin: An introduction to Modern Web Service Attacks (by Andreas Falkenberg, RUB)
  

More details to follow

REGISTRATION

Please register via RegOnline: registration will open once location is known.

Previous Meeting (March 1st 2011) in Leuven

WHEN

March 1st 2011 18h-21h30

WHERE

Hosted by Distrinet Research Group (K.U.Leuven).

Address:
Department of Computer Science (auditorium 00.225)
Celestijnenlaan 200 A
3001 Heverlee

Routemap: http://distrinet.cs.kuleuven.be/about/route/

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Sandwiches
  
• 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  
• 18h45 - 19h45: The Thinking Person's Guide to the Cloud. HOWTO: Keep your head in the clouds and your feet on the ground (by Gunnar Peterson, Arctec Group)
  

“Everything we think of as a computer today is really just a device that connects to the big computer that we are all collectively building"-Tim O'Reilly

My friend Chris Hoff asked this question in a recent podcast - "why is the OWASP Top Ten the same year after year? why don't these things gets fixed?"[1]. The reason is that software security and security architecture and design is nowhere near as a high priority as it needs to be.

If you look at the evolution of software over the years, you will see a history of more and more systems and data being connected together. Beginning with the Web through to component based application and then to Web services, at each step the common theme is more connectivity, more integration. Software is a rapidly changing universe

Unfortunately, Information Security has not kept up. Our field started out promisingly in the mid-90s with network firewalls and SSL for security mechanisms to defend websites, but that is about as far it got. In 1999 when SOAP emerged as a firewall-friendly protocol designed for the explicit reason to go through the firewall, that should have been a wake up call to Information Security that the "firewall + SSL" security architecture was past its prime, but here 10 years later we are still hitting the snooze button.

My view is that as technology is deployed we need security mechanisms that form fit to those new technologies, instead what we have is security technologies that form fit to auditor's excel spreadsheets.

Gunnar Peterson is a Managing Principal at Arctec Group. He is focused on distributed systems security for large mission critical financial, financial exchanges, healthcare, manufacturer, and insurance systems, as well as emerging start ups. Mr. Peterson is an internationally recognized software security expert, frequently published, an Associate Editor for IEEE Security & Privacy Journal on Building Security In, a contributor to the SEI and DHS Build Security In portal on software security, a Visiting Scientist at Carnegie Mellon Software Engineering Institute, and an in-demand speaker at security conferences. He maintains a popular informationsecurity blog at http://1raindrop.typepad.com.

• 19h45 - 20h00: Break
  
• 20h00 - 21h30: Threat modeling (by John Steven, Cigital)
  

How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management. Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.

John Steven is Senior Director of Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted adviser to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine and speaks with regularity at conferences and trade shows. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.

John leads the Virginia OWASP Northern Virginia (NoVA) chapter.

Past Events

• Events held in 2010
• Events held in 2009
• Events held in 2008
• Events held in 2007
• Events held in 2006
• Events held in 2005

Belgium OWASP Chapter Leaders

The BeLux Chapter is supported by the following board:

• Erwin Geirnaert, Zion Security
• Philippe Bogaerts, F5
• André Mariën, Inno.com
• Lieven Desmet, K.U.Leuven
• Joël Quinet, Telindus
• Sebastien Deleersnyder, Zenitel
• Bart De Win, Ascure

Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.