Belgium Events 2008

Chapter Meeting (Apr-9-2008) in Brussels

WHEN

Wednesday, April 9th, 2008 (18h00-20h30)

WHERE

Location: Deloitte Diegem,

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome & Sandwiches
  
• 18h30 - 18h40: OWASP Update (by Sebastien Deleersnyder, OWASP BeLux)
  
• 18h40 - 20h30: Exploiting Oracle databases via the Web (by Alexander Kornbrust, Red Database Security GmbH)
  

Presentation + discussion

Alexander Kornbrust is the founder and CEO of Red-Database-Security GmbH, a company specialized in Oracle security. Red-Database-Security is one of the leading companies in Oracle security. He is responsible for Oracle security audits and Oracle anti-hacker trainings and gave various presentations on security conferences like Black Hat, Bluehat, IT Underground. Alexander Kornbrust has worked with Oracle products as an Oracle DBA and Oracle developer since 1992. During the last years, Alexander has found over 220 security bugs in different Oracle products.

OWASP on Infosecurity.be 2008

WHEN

Thursday, March 20th, 2008 (15h00pm-16h00pm) in Room 2 of the Seminar Program

TOPIC: Web hacks of 2007 and how to protect your web applications in 2008 with OWASP

Presentation is online now.

The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security "visible," so that people and organizations can make informed decisions about application security risks.

First an overview of the major web hacks of 2007 will be given, including XSS Vulnerabilities in Common Shockwave Flash Files, Universal XSS in Adobe’s Acrobat Reader Plugin , Firefoxurl URI Handler Flaw, Anti-DNS Pinning ( DNS Rebinding ), Port Scan without JavaScript, …

Then some important OWASP projects are described, covering the OWASP Guide, the OWASP Top Ten, OWASP WebGoat, OWASP CLASP, OWASP WebScarab, OWASP Testing and OWASP Code Review. Using and improving these OWASP solution will aid organisations to prevent 2008 from being as bad as 2007.

Speaker: Sebastien Deleersnyder

Sebastien Deleersnyder started the successful Belgian OWASP Chapter and performed several public presentations on web application and web services security. Sebastien specialises in (web) application security, combining his application development and information security experience. He is currently OWASP board member and responsible for the Telindus, Belgacom ICT application security offering.

Chapter Meeting (4-Mar-2008) in Leuven

WHEN

Tuesday, March 4th, 2008 (18pm-21pm)

WHERE

Distrinet Research Group, Katholieke Universiteit Leuven sponsored the venue

Location: Department of Computer Science (auditorium 00.225) Celestijnenlaan 200 A, 3001 Heverlee

PROGRAM

The agenda:

• 18h00 - 18h30: Welcome, Refreshments and drinks
  
• 18h30 - 18h45: Sebastien Deleersnyder, OWASP BeLux
  

        OWASP Update

• 18h45 - 19h00: Kenneth Van Wyck, , KRvW Associates
  

CAcert.org and Thawte

If you're using either of these free x.509 certificate services, and are still trying to get the 50 assurance points necessary to have your real name on your certificates, stop by with two forms of government-issued ID (and photocopies, if using Thawte -- not necessary for CAcert). Ken will be happy to help out with either/both 10 Thawte points or 35 CAcert points. No charge, of course.

If you also are a Thawte or CAcert.org notary, you can help by adding your points to Ken's and thereby allowing other attendees to obtain all the assurance points needed in one swift swoop.

• 19h00 - 20h00: Ken Van Wyk, KRvW Associates
  

Development life cycle issues

Several secure software development processes have been published in the past few years. These include Microsoft's Secure Development Lifecycle, Cigital's "Touchpoints", and OWASP's own CLASP project. Which one is right for your organization, or would your needs be best served by taking the best of each and coming up with "your own" process? In this talk, we'll compare and contrast each of these approaches and talk about the practical aspects of putting them to maximum use, including pitfalls to avoid.

Ken Van Wyk Ken van Wyk, has over 20 years of professional experience in IT Security and has worked at Carnegie Mellon University's CERT®, the U.S. Department of Defense, SAIC and Para-Protect. Co-author of two popular O'Reilly books, Incident Response: Planning & Management and Secure Coding: Principles and Practices, Ken also writes a monthly column for IT Security on-line news portal, eSecurityPlanet. He is one of the founders of the Carnegie Mellon CERT/CC, and a much sought after lecturer on security technology. He is a partner at KRvW Associates.

• 20h00 - 20h15: break
• 20h15 - 21h15: Bart De Win, DistriNet, K.U.Leuven
  

Structural improvements for SDLs

Based on an extensive study and comparison of a number of secure software development processes (the results of which have been presented during the Belgium OWASP day last year), we have identified a number of structural improvements for these processes. In this talk, I will present these improvements from a general perspective, give hints on how they could be addressed and I will elaborate on some of them (e.g., the integration of security principles in a process) in more detail with results of ongoing research.

Bart De Win Bart De Win is a postdoctoral researcher in the DistriNet research group at the Department of Computer Science, Katholieke Universiteit Leuven. His research focuses on secure software engineering, including software development processes, aspect-oriented software development and model-driven security. Bart has served on the organizing and program committees of several international secure software engineering workshops.