Difference between revisions of "Boston"

Revision as of 21:32, 27 January 2011

OWASP Boston

Welcome to the Boston chapter homepage. The chapter leader is Jim Weiler

Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Sponsorship/Membership

to this chapter or become a local chapter supporter. Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?

Local News

<paypal>Boston</paypal>

To find out more about the Boston chapter, just join the OWASP Boston mailing list.

Boston Application Security Conference --- FREE

Boston Application Security Conference

Boston Application Security Conference - Call For Papers

Listing Of All Pages Related To The Boston Application Security Conference

Local Chapter Information --- Our Sixth Year

The chapter shipping/mailing address is:

OWASP Boston 35 Wachusett Dr Lexington, MA. 02421

Reviews

Reviews of security podcasts

Chapter Meetings

We usually meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm.

Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.

Information for meeting updates about this and other Boston area user groups can also be found at BostonUserGroups.

Location

The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month ( Unless a speaker can only present another night), 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA.

From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C.

Next Meeting ---- Wednesday Feb. 2 Microsoft Waltham

Presentations

Main Topic – Security Leadership series

Rob Cheyne - CEO Safelight Security

Security Leadership series: Delivering a successful security presentation Presentation and training skills are critical in any field, but are especially important for security. OWASP participants consist of current and future information security leaders who absolutely must be able to effectively communicate security topics to others in their organizations.

Anyone can be an effective presenter, but few people take the time to hone this critical skill. Rob Cheyne, CEO, Safelight Security, will present a special train-the-trainer session where he will divulge the secrets of a successful security or technical presentation. Come and learn how to move beyond "death by powerpoint", and be ready to challenge everything you know about giving a technical presentation.

Part 1 (6:30-7pm): Rob will cover a basic information security topic using traditional presentation and training methods and then he will re-teach the same topic using modern accelerated learning techniques. He's going to keep the topic a secret until you get there, so you'll have to show up to see what it is. Hint: the topic itself is not the point.

Part 2 (7-9pm): Accelerated learning debrief. Rob will teach you how to be a more effective presenter by breaking down the key elements of a successful presentation or training. OWASP participants can directly use these techniques to make their own security and technical presentations more effective. He will break down his security topic from part 1 and explain the presentation and training techniques one by one. This will be like having the magician pulls a rabbit out of the hat and then explain in detail how he did the trick.

This is a special, pre-RSA warm-up talk that may never be repeated. If you've ever struggled to give an effective technical presentation, please make every effort to attend. You will get the most value from this talk if you can show up early to participate in both parts 1 and 2. Please show up ready to have some fun and participate fully in an interactive and entertaining discussion. And there will be pizza. What more could you ask for?  :-)

FYI - it's possible (but not guaranteed) that a brave volunteer will be chosen to present an arbitrary 5-minute technical topic that they are familiar with for demonstration purposes.

Speaker Bio

Rob Cheyne speaks regularly at security conferences, and is a regular presenter at the OWASP Boston chapter. Over the years, he has trained well over 10,000 people on various information security topics. He is a former @stake hacker and co-founder who has been fortunate to work with some really smart people and is passionate about sharing what he has learned. He is currently the CEO of Safelight Security, a leading provider of custom information security education programs that integrates deep security expertise with innovative approaches to interactive learning. Rob is also on the advisory boards for the Source: Boston and Source: Seattle security conferences.

Pizza will be provided by Safelight Security

Past Meeting Notes

December 2010

Application Architecture Security Assessment - Second session

Rob Cheyne, CEO SafeLight Security Advisors

November 2010

Open SAMM – Software Assurance Maturity Model

Shakeel Tufail is the Federal Practice Manager at Fortify, an HP company.

October 2010

Rob Cheyne, CEO SafeLight Security Advisors Overview: In this highly interactive two-part workshop, Rob Cheyne of Safelight Security will show you the basics of conducting a real-world architecture & design review. This workshop draws from Safelight's Security Architecture Fundamentals training course, a two-day course frequently used to teach Fortune 500 companies how to look at their system architectures from both the hacker's and the designer’s point of view.

July 2010

Lightning Talk – Rob Cheyne, CEO Safelight Security Advisors In this installment of the Safelight lightning talks series, Rob will present the basics of a Cross-site Request Forgery (CSRF).

Main Presentation - Drive-by Pharming with MonkeyFist

Joey Peloquin - Director of Application Security, Fishnet Security

June 2010

Rob Cheyne Lightning Talk - topic to be announced

Main Presentation - Ryan Barnett The Web Hacking Incident Database (WHID) is a Web Application Security Consortium project dedicated to maintaining a list of web applications related security incidents. Ryan Barnett is director of application security research at Breach Security where he leads Breach Security Labs.

May 2010

Rob Cheyne Lightning Talk - SQL Injection

Vinnie Liu - Data Exposure, New Approaches to Open Source Intelligence Techniques, and Incident Handling

April 2010

Dan Hestad Security Innovation Dan will be talking about his experiences with PCI and web applications, and answering questions about do's and don'ts of acceptable PCI practices in web applications.

March 2010

Zack Lanier - Disclosure Samsara, or "the endless vulnerability disclosure debate"

http://n0where.org/talks/samsara_20100310.html

http://n0where.org/talks/samsara_20100310.pdf (very large PDF)

February 2010

Rob Cheyne of Safelight Security Advisors; New Technology, Same Old Vulnerabilities

January 2010 at Microsoft NERD, Cambridge

Josh Abraham, Rapid 7 Technologies

December 2009

Eric Bender, Cenzic

November 2009

Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels - Web Application Vulnerability Scanners

Mush Hakhinian, Leader, Application Security Practice, IntraLinks - Secure coding with no money down using SONAR: unleashing the power of open-source code analysis tools

October 2009

Paul Schofield, Senior Security Engineer, Imperva - From Rivals to BFF: WAF & VA Unite

September 2009 at CORE Technologies, Boston

Paul Asadoorian, Pauldotcom.com

Alex Horan, CORE Security

May 2009

Joey Peloquin, Fishnet Security, Secure SDLC: The Good, the Bad and the Ugly presentation pdf

March 2009

Sabha Kazerooni, Security Compass - Exploit Me tools; Framework Level Threat Analysis

ExploitMe Document

Framework Level Threat Analysis document

Meeting Pizza Sponsor - Arcot

Arcot is a leader in online fraud prevention, strong authentication and eDocument security. Arcot's solutions are easily deployed, low-cost and extremely scalable, allowing organizations to transparently protect their users from fraud without changing user behavior or requiring expensive hardware.

Arcot can be contacted thru Michael Kreppein, [email protected], 617-467-5200

December 2008

Brian Holyfield, Gothem Digital Science

Tamper Proofing Web Applications http://www.gdssecurity.com/l/b/2008/12/04/

June 2008

Jeremiah Grossman; Founder and CTO, Whitehat Security

Appetizer - Hacking Intranets from the Outside (Just when you thought your network was safe) Port scanning with JavaScript

Main Topic - Business Logic Flaws: How they put your Websites at Risk

March 2008

Chris Eng; Senior Director, Security Research, Veracode

Description – Attacking crypto in web applications

December 2007

Scott Matsumoto; Principal Consultant, Cigital

Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security

Cigital Presentation

November 2007

Tom Mulvehill Ounce Labs

Description – Tom will share his knowledge and expertise on implementing security into the software development life cycle. This presentation will cover how to bring practicality into secure software development. Several integration models will be explored as well as solutions for potential obstacles

Ounce presentation

October 2007

George Johnson, Principal Software Engineer EMC; CISSP

An Introduction to Threat Modeling.

September 2007

Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century"

June 2007

Tool Talk - Jim Weiler - WebGoat and Crosssite Request Forgeries

Danny Allan; Director, Security Research, Watchfire

Topic: Exploitation of the OWASP Top 10: Attacks and Strategies

March 2007

Jeremiah Grossman, CTO Whitehat Security: Top 10 Web Application Hacks of 2006

January 2007

Dave Low, RSA the Security Division of EMC: encryption case studies

November 2006

September 2006

Mike Gavin, Forrester Research: Web Application Firewalls

June 2006

Imperva - Application and Database Vulnerabilities and Intrusion Prevention

Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool

May 2006

April 2006

Dennis Hurst; SPI Dynamics: A study of AJAX Hacking

Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!

March 2006

Mateo Meucci; OWASP Italy Anatomy of 2 web attacks

Tom Stracener; Cenzic Web Application Vulnerabilities

February 2006

Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source

January 2006

David Low, Senior Field Engineer: RSA Practical Encryption

December 2005

Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled

November 2005

Robert Hurlbut, Independent Consultant Threat Modeling for web applications

October 2005

Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges

Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways

September 2005

Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security

July 2005

Mark O'Neill, CTO: Vordel - Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security

June 2005

Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools

May 2005

Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom

April 2005

Jonathan Levin - Of Random Numbers

Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security

March 2005

Joe Stagner: Microsoft Let's talk about Application Security

Feb 2005

Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.

Boston OWASP Chapter Leaders

President

Jim Weiler 781 356 0067 begin_of_the_skype_highlighting              781 356 0067      end_of_the_skype_highlighting

Program Committee

Mark Arnold

Jim Weiler 781 356 0067