|
|
| (225 intermediate revisions by 11 users not shown) |
| Line 1: |
Line 1: |
| − | {{Chapter Template|chaptername=Boulder|extra=The chapter leader is [mailto:owasp@justplainpix.com Andy Lewis]|mailinglistsite=http://lists.owasp.org/mailman/listinfo/owasp-boulder|emailarchives=http://lists.owasp.org/pipermail/owasp-boulder}} | + | ===Special Thanks=== |
| | + | The continued sponsorship of Aerstone, Applied Trust, and Coalfire keep the chapter running strong. Thank you. |
| | + | {| cellpadding="15" |
| | + | |- |
| | + | | [[Image:BoulderSponsorAerstone.png | 120px | link=https://aerstone.com | alt=Aerstone | Aerstone]] |
| | + | | [[Image:AppliedTrust.png | 120px | link=http://www.appliedtrust.com | alt=Applied Trust | Applied Trust]] |
| | + | | [[Image:Coalfire.png | 120px | link=http://www.coalfire.com/ | alt=Coalfire | Coalfire]] |
| | + | |} |
| | | | |
| − | == '''Next Meeting''' == | + | __NOTOC__ |
| − | The next meeting is '''Thursday, February 21st, 2008'''. We're awaiting confirmation that it can be held at [https://www.cexp.com Corporate Express's] US Headquarters at [http://maps.google.com/maps?q=1+Environmental+Way,+Broomfield,+CO+80021,+USA&sa=X&oi=map&ct=title 1 Environmental Way, Broomfield, CO 80021]
| + | <font size="2"> |
| − | The sponsor is HP, and the speaker will be Michael Sutton of [https://h10078.www1.hp.com/cda/hpms/display/main/hpms_content.jsp?zn=bto&cp=1-11-201_4000_100__ HP/SPI Dynamics]. Updates will be spammed to the Chapter Mailing List.
| + | =About= |
| | + | {{:Boulder/About}} |
| | | | |
| − | We're also gaining traction on a '''possible Front Range Web Security Summit''', so if you're interested in helping or sponsoring please email Kathy Thaxton, the Conference Director... kthaxton AT businesspartnersolutions DOT com.
| + | =Upcoming Events= |
| | + | {{:Boulder/Events-Upcoming}} |
| | | | |
| − | Agenda:
| + | =Past Events= |
| | + | {{:Boulder/Events-Past}} |
| | | | |
| − | 6-6:30 Dinner (pizza provided by [http://www.hp.com HP])
| + | =Chapter Projects= |
| | + | {{:Boulder/Projects}} |
| | | | |
| − | 6:30 - 6:40 Chapter business
| + | =Chapter Support= |
| | + | {{:Boulder/Support}} |
| | | | |
| − | 6:40 - 8:00 Presentation and Q&A
| + | </font> |
| | + | <headertabs /> |
| | | | |
| − | Following the meeting we will have informal discussions over beverages at the Gordon Biersch Brewery and Restaurant.
| |
| | | | |
| − | ----
| + | == Upcoming Events == |
| | | | |
| − | == '''''Member Survey''''' ==
| + | '''Thursday Evenings: ''' We typically (but not always) hold our chapter meetings on the third Thursday of the month. We meet in Lafayette, CO, just outside of Boulder. Newcomers are always welcome! Meeting details can be found on our [http://www.meetup.com/OWASP-Boulder/ MeetUp.com] site. Please RSVP on that site as seating can fill up quickly. |
| − | Please take time to complete the [http://www.surveymonkey.com/s.aspx?sm=vmwG4_2bchOC_2b3nF2apeGSXg_3d_3d member survey] to help improve the value the Chapter brings to the Boulder/Front-Range community.
| |
| | | | |
| − | == Local News ==
| + | <br><br> |
| − | '''SPI Dynamics to Speak at Feb's Chapter Meeting'''
| |
| − | Derek Zunker, my local HP rep, has volunteered to sponsor February's meeting, including providing a speaker from SPI Dynamics on February 21st.
| |
| | | | |
| − | '''New OWASP Tools Available - Jan 2008'''
| + | [[Category:OWASP Chapter]] |
| − | Four new OWASP tools are available. [https://www.owasp.org/index.php/ESAPI OWASP Enterprise Security API] helps organizations get organized about application security, [https://www.owasp.org/index.php/Category:OWASP_CSRFTester_Project OWASP CSRFTester] tests for CSRF flaws, OWASP [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project CSRFGuard] stops CSRF attacks, and the fantastic new [https://www.owasp.org/index.php/SpoC_007_-_OWASP_The_Anti-Samy_Project Anti-Samy] component allows safe posting of rich content.
| + | [[Category:United_States]] |
| − | | + | [[Category:Colorado]] |
| − | | |
| − | '''XSS defense - the "dimuitive worm contest"'''
| |
| − | RSnake hosted a contest to write the smallest XSS worm. His results are here: [http://ha.ckers.org/xss-worms/ XSS Worm Analysis And Defense]. It's good reading for anyone trying to come to grips with XSS prevention.
| |
| − | | |
| − | | |
| − | '''Flash Security Testing'''
| |
| − | The team working on the [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project OWASP Flash Security Project] has released the [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] tool to detect flash security issues like XSS and Cross-Site Flashing. It's worth a look.
| |
| − | | |
| − | '''Aspect-Oriented Programming'''
| |
| − | Security Focus has a very interesting article regarding AOP and security written by Rohit Sethi on October 16th, 2007. It complements and reinforces the [https://www.owasp.org/index.php/Boulder#November_Meeting_Notes AOP talk] given by Pat White from Fortify Software for the Nov Chapter Meeting. If you know of any other useful AOP references please share by posting to the chapter mailing list...
| |
| − | | |
| − | '''Cool References - November 28th, 2007'''
| |
| − | Google for "Microsoft AntiXSS Library" and you'll see some pretty cool resources for '''stifling Cross-Site-Scripting problems'''.
| |
| − | | |
| − | OWASP has a similar project:
| |
| − | http://www.owasp.org/index.php/Category:OWASP_Encoding_Project
| |
| − | | |
| − | in addition to the '''''OWASP Enterprise Security API project''''' (which looks REALLY COOL):
| |
| − | | |
| − | http://www.owasp.org/index.php/ESAPI
| |
| − | | |
| − | Finally, many of the OWASP wikis are available as books, either for purchase in hard-copy or as a ''free download'':
| |
| − | | |
| − | Online bookstore = http://stores.lulu.com/owasp
| |
| − | Shirts hats etc... http://www.cafepress.com/owasp
| |
| − | | |
| − | | |
| − | '''Boulder OWASP News - November 15th, 2007'''
| |
| − | Several Security Professionals have expressed interest in serving as Chapter Officers or part of a Board of Directors.
| |
| − | | |
| − | We expect to assemble interested parties in early Dec to plan out 2008.
| |
| − | | |
| − | == '''What should I expect to see at a bOWASP meeting?''' ==
| |
| − | | |
| − | Each speaker will be encouraged to cover:
| |
| − | - demonstration of the threat ( "look! I got EVERYONE'S credit card #!")
| |
| − | - overview/sample of vulnerable code, preferably in PHP, Java, or .Net env.
| |
| − | - some details regarding how to correct the code
| |
| − | - some thoughts as to how to test for the problem and/or "immunize" against it during a typical SDLC
| |
| − | - additional tools and references
| |
| − | | |
| − | | |
| − | == '''What's a Typical Agenda for the Chapter?''' ==
| |
| − | 6-6:30 - pizza and beverages provided by a sponsor
| |
| − | | |
| − | 6:30-6:40 - intro to OWASP and Chapter Business
| |
| − | | |
| − | 6:40-7:35'ish - presentation, demonstration, or workshop
| |
| − | | |
| − | 7:35'ish - Q & A
| |
| − | | |
| − | after Q & A - adjourn to less formal environment
| |
| − | | |
| − | == January 2008 Meeting Notes==
| |
| − | | |
| − | Aman Garg of [http://www.tippingpoint.com TippingPoint] presented '''"Success Stories for Resolving App Security Bugs"'''.
| |
| − | The 2 things that got my attention were common evasion techinques and his commitment to spending ~20% of available testing/QA time doing UNstructured testing. It must be working - [http://www.tippingpoint.com TippingPoint] is the market leader in the IPS space. Many thanks to Aman for presenting, to [http://www.tippingpoint.com TippingPoint] for sponsoring, and to [http://www.cexp.com Corporate Express] for hosting as we all try to get better at writing more secure code!
| |
| − | | |
| − | ----
| |
| − | Outline for January 17th:
| |
| − | | |
| − | Web app protection
| |
| − | | |
| − | * php exploit demo
| |
| − | * primer on php vulnerabilities and various layers at which these can be exploited
| |
| − | * primer on XSS (cross site scripting) vulnerabilities
| |
| − | * what you can do to make your web apps more secure
| |
| − |
| |
| − | My experiences running QA/testing at TippingPoint
| |
| − | | |
| − | * conventional wisdom in testing (make a million test cases, really comprehensive regression testing)
| |
| − | * challenges in testing
| |
| − | * tradeoff between responsiveness and thorough QA cycle
| |
| − | * making processes secure & tamper proof
| |
| − | * architecture issues - separating platform from application
| |
| − | * best practices & recommendations from my experience
| |
| − | | |
| − | ----
| |
| − | | |
| − | Aman's Bio: A veteran in the network security industry with over 10 years of experience, Aman Garg is currently Principal Architect at TippingPoint, where his current work focuses on design and research for new products and solutions, partnerships with other solution providers, and prototyping technology concepts. He has worn several different hats at TippingPoint - most recently, running the market /competitive analysis group, and leading the certification effort of TippingPoint products by NSS & ICSA Labs.
| |
| − | | |
| − | Mr. Garg holds an MBA from University of Texas Austin, a Masters in Electrical Engineering from Texas A&M University, and a bachelors in Electrical Engineering from Indian Institute of Technology, Kanpur. His interests are in network security and network performance testing arenas. His research work on mitigating Denial of Service attacks has been cited by several academic journals.
| |
| − | | |
| − | == November Meeting Notes==
| |
| − | '''Security and AOP (Aspect Oriented Programming)'''
| |
| − | | |
| − | Many thanks to [http://www.cexp.com Corporate Express] for providing the facilities, to [http://www.coalfiresystems.com Coalfire Systems] for providing dinner, and to [http://www.fortifysoftware.com/ Fortify Software] for providing the speaker!
| |
| − | | |
| − | Speaker: Patrick White, Program Manager for .[http://www.fortifysoftware.com/ Fortify Software].
| |
| − | | |
| − | Topic: Security and AOP
| |
| − | | |
| − | Aspect Oriented Programming is an incredibly interesting methodology that has gradually gained popularity over the years. As interesting as the concepts are, they are often admittedly difficult to actualize. In this talk Patrick will be examining what AOP is and how it can make a real and meaningful impact during your development. In addition, he'll look at how powerful security features can be added to an application using AOP either in sync or out sync with development.
| |
| − | | |
| − | Bio: Patrick White is a Program Manager at Fortify Software. He holds a BS in Computer Engineering and Computer Science from the University of Southern California and has earned numerous Microsoft certifications including MCSE, MCSD, and MCPD. He previously worked for several Bay Area startups and was at Microsoft before joining the Fortify Software team.
| |
| − | | |
| − | Patrick's presentation can be found here:
| |
| − | https://www.owasp.org/images/2/27/SecurityAndAOPII_FortifySoftware20071115.pdf
| |
| − | '''''Yeah, sometimes it's OK to bolt on security after the fact...'''''
| |
| − | | |
| − | == September Meeting Notes ==
| |
| − | '''First Boulder OWASP Meeting was held September 20th, 2007'''
| |
| − | Jeremiah's presentation was OUTSTANDING and MUCH APPRECIATED. Jeremiah kindly allowed it to be posted here:
| |
| − | | |
| − | https://www.owasp.org/images/f/f8/OWASP_Boulder_09202007.pdf
| |
| − | | |
| − | MANY THANKS to Whitehat Security[http://www.whitehatsec.com], Corporate Express[http://www.cexp.com/], Business Partner Solutions[http://www.businesspartnersolutions.com/], and all who attended for making this a success!
| |
| − | | |
| − | There was also a brief discussion about integrating security into the SDLC. Here's a link for a GREAT presentation done by Michael Walters. Note the diagrams on slide 13:
| |
| − | | |
| − | http://www.squadco.com/presentations/OWASP_Denver.pdf
| |
| − | | |
| − | Also, if your QA team isn't aware of SQuAD (the Software Quality Association of Denver) you may want to point them to www.squadco.com as a resource.
| |
| − | | |
| − | == September Meeting ==
| |
| − | '''First Boulder OWASP Meeting to be held September 20th, 2007'''
| |
| − | | |
| − | Site:
| |
| − | '''Corporate Express US Headquarters'''
| |
| − | [http://www.cexp.com/]
| |
| − | 1 Environmental Way
| |
| − | Broomfield, CO 80021
| |
| − | | |
| − | Time: Dinner and beverages will be available starting at 6 PM, compliments of [http://www.businesspartnersolutions.com/ Business Partner Solutions]. Presentation will start at 6:30.
| |
| − | | |
| − | Speaker: Jeremiah Grossman, CTO of [http://www.whitehatsec.com WhiteHat Security].
| |
| − | | |
| − | Topic: Top 10 Web Attack Techniques, their Potential Impact, and Strategies to Protect Your Company
| |
| − | | |
| − | To date, information security has been focused mainly on vulnerabilities at the network and software (OS, web server, etc.) levels. However, a new battleground is quickly developing that poses an even greater threat to companies’ brands/reputations and data. As companies drive more and more business processes to the web, vulnerabilities in their custom Web applications have become the new target for a new class of hackers. And the payoff is now financial gain, not personal notoriety.
| |
| − | | |
| − | Jeremiah Grossman will:
| |
| − | – Reveal the top 10 attacks of 2006 by creativity and scope
| |
| − | – Predict what these attacks mean for website vulnerability management in 2007
| |
| − | – Present strategies to protect your corporate websites
| |
| − | | |
| − | Bio: Jeremiah Grossman is the founder and CTO of WhiteHat Security, considered a world-renowned expert in Web security, co-founder of the Web Application Security Consortium, and recently named to InfoWorld's Top 25 CTOs for 2007. Mr. Grossman is a frequent speaker at industry events including the BlackHat Briefings, RSA, ISACA, CSI, OWASP, Vanguard, ISSA, Defcon, and a number of large universities. He has authored dozens of articles and white papers; is credited with the discovery of many cutting-edge attack and defensive techniques; and is a co-author of XSS Attacks. Mr. Grossman is frequently quoted in major media publications such as InfoWorld, USA Today, PCWorld, Dark Reading, SC Magazine, SecurityFocus, Cnet, SC Magazine, CSO, and InformationWeek. Prior to WhiteHat he was an information security officer at Yahoo!
| |
| − | | |
| − | == Chapter Leader Links ==
| |
| − | | |
| − | | |
| − | https://www.owasp.org/index.php/About_OWASP
| |
| − | | |
| − | https://www.owasp.org/index.php/How_OWASP_Works
| |
| − | | |
| − | https://www.owasp.org/index.php?title=How_OWASP_Works&diff=22690&oldid=15689 (this is a previous version of the 'How OWASP Works' page which contains some ideas about the future)
| |
| − | | |
| − | https://www.owasp.org/index.php/OWASP_brand_usage_rules
| |
| − | | |
| − | https://www.owasp.org/index.php/Chapter_Rules
| |
| − | | |
| − | https://www.owasp.org/index.php/Chapter_Leader_Handbook
| |
| − | | |
| − | https://www.owasp.org/index.php/Category:Chapter_Resources
| |
| − | | |
| − | http://www.owasp.org/index.php/Tutorial#Editing_OWASP
| |
| − | | |
| − | And finally, if you
| |
| − | haven't seen this amazing page created by Sebastien a while back with
| |
| − | descirptions and links to past OWASP presentations, you must check it out
| |
| − | now: http://www.owasp.org/index.php/OWASP_Education_Presentation
| |
| − | | |
| − | Of particular interest:
| |
| − | https://www.owasp.org/images/d/df/OWASP_-_Presentation_for_potential_sponsorships.doc
| |
| − | | |
| − | | |
| − | '''OWASP Moves to MediaWiki Portal - 11:36, 20 May 2006 (EDT)'''
| |
| − | | |
| − | OWASP is pleased to announce the arrival of OWASP 2.0!
| |
| − | | |
| − | OWASP 2.0 utilizes the MediaWiki portal to manage and provide
| |
| − | the latest OWASP related information. Enjoy!
| |
The continued sponsorship of Aerstone, Applied Trust, and Coalfire keep the chapter running strong. Thank you.
to this chapter or become a local chapter supporter.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? 
