This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Global Industry Committee"

From OWASP
Jump to: navigation, search
(moving YP to closed)
Line 198: Line 198:
 
=== Completed Items  ===
 
=== Completed Items  ===
  
{| class="prettytable FCK__ShowTableBorders"
+
[[Global_Industry_Committee/Completed_Initiatives|View the GIC's past initiatives]]
|-
 
! Task
 
! Completed
 
! Type
 
! Status
 
! Description
 
! Who
 
|-
 
| OWASP Top 10 Presentation
 
| 2/18/11 or 2/25/11
 
| Outreach
 
| Closed
 
| OWASP Presentation Royal Holloway, University of London presentation
 
| YP
 
|-
 
| Leeds Chapter Leader Presentation
 
| 13 Dec 2011
 
| Outreach
 
| Closed
 
| LA is gathering OWASP overview and project information for OWASP Leeds presentation needs.
 
| LA
 
|-
 
| New IETF Web Security working group / W3C Web Application Security Working Group
 
| Ongoing
 
| All Members
 
| Closed
 
| Invite and coordinate OWASP contributions on this IETF/W3C Group
 
| YP
 
|-
 
| [http://www.owasp.org/index.php/OWASP_Mobile_Security_Project Kickoff OWASP Mobile Security Project]
 
| 2011 Summit
 
| Projects
 
| Closed
 
| Provide GIC oversight to Mobile Security Project
 
| DC
 
|-
 
| [[Industry:FTC Protecting Consumer Privacy|FTC Protecting Consumer Privacy in an Era of Rapid Change]]
 
| 18 Feb 2011
 
| Standards
 
| Closed
 
| Provide response to "FTC Protecting Consumer Privacy in an Era of Rapid Change - A framework for businesses and policymakers"
 
| CW
 
|-
 
| [http://www.londoncentral.bcs.org BCS London Central]
 
| 17 Feb 2011
 
| Outreach
 
| Closed
 
| Present a talk about OWASP.
 
| CW
 
|-
 
| [[Industry:ICO Data Sharing CoP|Data Sharing CoP]]
 
| 5 Jan 2011
 
| Standards
 
| Closed
 
| Provide response to UK ICO's "Data Sharing Code of Practice Consultation"
 
| CW/AF
 
|-
 
| CRESTCON
 
| 14 Dec 2011
 
| Outreach
 
| Closed
 
| YP is attending CRESTCON in Royal Holloway, Surrey, UK
 
| YP
 
|-
 
| (ISC)^2 Application Security Advisory Board (ASAB)
 
| 19 Nov 2010
 
| Outreach
 
| Closed
 
| YP is now a member of the (ISC)^2 ASAB, with the first meeting to be held in FL on the above stated date.
 
| YP
 
|-
 
| [http://www.techexecnetworks.com/event_2010.12.01.asp T.E.N./Fortify Software Security Assurance Summit]
 
| 1 Dec 2010
 
| Outreach
 
| Closed
 
| Discuss quick wins and high impact software assurance activities using the OWASP SAMM model as reference and cite other OWASP projects as resources.
 
| AF
 
|-
 
| [[Industry:DOJ Nondiscrimination on the Basis of Disability|DOJ Nondiscimination on the Basis of Disability]]
 
| 30 Nov 2010
 
| Standards
 
| Closed
 
| Provide response to US DOJ's "Accessibility of Web Information and Services of State and Local Government Entities and Public Accommodations"
 
| AF/LA
 
|
 
|-
 
| [[Industry:e-Consumer Protection Consultation|e-Consumer Protection Consultation]]  
 
| 13 Oct 2010
 
| Standards
 
| Closed
 
| Review and provide official OWASP response to [http://www.oft.gov.uk/ UK Office of Fair Trading] [http://www.oft.gov.uk/OFTwork/consultations/current/eprotection/ e-Consumer Protection Consultation].
 
| YP
 
|-
 
| [[Industry:ENISA Cloud Computing Common Assurance Metrics|ENISA Common Assurance Maturity Model]]
 
| 8 Oct 2010
 
| Standards
 
| Closed
 
| Work with [[:Category:OWASP Cloud ‐ 10 Project]] to contribute to the development of Common Assurance Maturity Model for [http://www.enisa.europa.eu/ ENISA]/Cloud Security Alliance/etc joint initiative.
 
| CW
 
|-
 
| [http://www.w3.org/TR/2010/WD-mwabp-20100713/ Mobile Web Application Best Practices Working Draft]
 
| 6 Aug 2010
 
| Standards
 
| Closed
 
| Review and provide official OWASP response to W3C's [http://www.w3.org/2005/MWI/BPWG/ Mobile Web Best Practices Working Group].
 
| DC
 
|-
 
| [http://www.oft.gov.uk/ UK Office of Fair Trading]
 
| 23 Jul 2010
 
| Standards
 
| Closed
 
| Ask to be added to official consultation list
 
| CW
 
|-
 
| [http://www.businesslink.gov.uk BusinessLink]
 
| 1 Jul 2010
 
| Outreach
 
| Closed
 
| Offer to contribute to development of IT security information about [http://www.businesslink.gov.uk/bdotg/action/layer?topicId=1075421745 application security] on the BusinessLink website for UK SMEs. Outcome - no help required at present, but BusinessLink system to be disbanded.
 
| CW
 
|-
 
| Veracode
 
| 28 Jun 2010
 
| Outreach
 
| Closed
 
| Discuss use of Open SAMM to classify Secure SDL maturity in Veracode's code analysis summary reports. Outcome - positive response received.
 
| CW
 
|-
 
| [http://www.owasp.org/index.php/Leeds_UK OWASP Leeds/North]
 
| 16 Jun 2010
 
| Outreach
 
| Closed
 
| Presentations at chapter meeting in Newcastle-upon-Tyne about ENISA CAMM and OWASP Appsensor
 
| CW
 
|-
 
| [http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2010 Front Range OWASP Conference (FROC) 2010]
 
| 2 Jun 2010
 
| Outreach
 
| Closed
 
| Conference organisation [http://tinyurl.com/froctalks Vids & presentations online]
 
| DC
 
|-
 
| [http://www.isaca-denver.org/meetings/MAY_2010_CHPT_MTG.shtml OWASP Presentation at ISACA Denver Annual Meeting]
 
| 27 May 2010
 
| Outreach
 
| Closed
 
| Presentation [https://docs.google.com/fileview?id=0B_-vbfka88vFNjIwY2IwYjItZmYyNi00MmNiLWFhOWItYmQ4OGZmZjVmZWUx&hl=en Presentation online]
 
| DC
 
|-
 
| [http://www.issa-uk.org/ ISSA-UK]
 
| 13 May 2010
 
| Outreach
 
| Closed
 
| Presentation
 
| YP
 
|-
 
| [[Industry:Personal Information Online Code of Practice|Personal Information Online COP]]
 
| 5 Mar 2010
 
| Legislation
 
| Closed
 
| Provide response to UK Information Commissioner's Office draft "Personal Information Online Code of Practice"
 
| YP
 
|-
 
| [http://www.enisa.europa.eu/ ENISA] Mobile Apps
 
| Mar 2010
 
| Outreach
 
| Closed
 
| Identify and introduce OWASP contact for ENISA's Mobile Apps Project, in conjunction with Dinis Cruz.
 
| CW
 
|-
 
| [[Industry:Technology Strategy Board Secure Software Development Initiative|Technology Strategy Board Secure Software Development Partnership]]
 
| 18 Feb 2010
 
| Outreach
 
| Closed
 
| Liaise with the UK [http://www.innovateuk.org/ Technology Strategy Board] about the Secure Software Development Partnership (SSDP) in conjunction with the [http://www.owasp.org/index.php/London London chapter] leader Justin Clarke
 
| CW
 
|-
 
| US [http://www.issa-nova.org Information Systems Security Association Northern Virginia Chapter (ISSA-NOVA)]
 
| 21 Jan 2010
 
| Outreach
 
| Closed
 
| Provide presentation covering CSSLP, fundamentals of AppSec and Intro to OWASP and Global Industry Committee
 
| AF
 
|-
 
| [http://www.enisa.europa.eu/ ENISA]
 
| Jan 2010
 
| Outreach
 
| Closed
 
| Discuss opportunities for OWASP to work with ENISA, in conjunction with Dinis Cruz.
 
| CW
 
|-
 
| [[:Industry:Draft NIST SP 800-37 Revision 1|NIST SP 800-37 Revision 1 FPD]] Review Project
 
| 30 Dec 2009
 
| Standards
 
| Closed
 
| Provide response to "NIST SP 800-37 Revision 1 Final Public Draft, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach"
 
| RB
 
|-
 
| [http://www.crest-approved.org/ CREST] CRESTCon
 
| 15 Dec 2009
 
| Outreach
 
| Closed
 
| Already an oversubscribed event, YP & CW have been placed on the reserve list. Update: Positions secured for the 15th.
 
| YP
 
|-
 
| [http://msdn.microsoft.com/en-us/security/cc448177.aspx SDL Pro Network]
 
| 30 Nov 2009
 
| Outreach
 
| Closed
 
| Contact SDL Pro Network to discuss if there are opportunities for OWASP to become involved or connected in some way
 
| CW
 
|-
 
| [[Industry:Draft NIST IR 7628|Draft NIST IR 7628]]
 
| 25 Nov 2009
 
| Standards
 
| Closed
 
| Provide response to "NIST IR 7628 Draft Smart Grid Cyber Security Strategy and Requirements"
 
| CW
 
|-
 
| [http://www.owasp.org/index.php/OWASP_AppSec_DC_2009 Appsec DC 2009]
 
| 10-13 Nov 2009
 
| Outreach
 
| Closed
 
| Conference organisation - special effort to engage with US Federal sector
 
| RB
 
|-
 
| [http://www.justice.gov.uk/ UK Ministry of Justice]
 
| -
 
| Legislation
 
| Closed
 
| Ask to be added to official consultation list
 
| CW
 
|-
 
| [http://www.it-sa.de/ IT-SA]
 
| 13-15 Oct 2009
 
| Outreach
 
| Closed
 
| OWASP booth at trade show
 
| GH
 
|-
 
| [http://www.owasp.org/index.php/OWASP_AppSec_Germany_2009_Conference OWASP AppSec Germany 2009]
 
| 13 Oct 2009
 
| Outreach
 
| Closed
 
| Conference organisation
 
| GH
 
|-
 
| US [http://www.loc.gov Library of Congress]
 
| 28 Sep 2009
 
| Outreach
 
| Closed
 
| Presentation about OWASP
 
| RB
 
|-
 
| [http://www.owasp.org/index.php/OWASP_Ireland_AppSec_2009_Conference OWASP Ireland AppSec 2009]
 
| 10 Sep 2009
 
| Outreach
 
| Closed
 
| Conference organisation
 
| EK
 
|-
 
| OWASP Citations
 
| 7 Sep 2009
 
| Other
 
| Closed
 
| Identify and record the most important references to OWASP in official, or otherwise important, documents. Page created at: [[Industry:Citations]]
 
| CW
 
|-
 
| US [http://www.loc.gov Library of Congress]
 
| 26 Aug 2009
 
| Outreach
 
| Closed
 
| Presentation about OWASP
 
| RB
 
|-
 
| OWASP webcast at Brighttalk [http://www.brighttalk.com/summit/dataprivacy2 Data and Privacy in Web 2.0 Summit]
 
| 13 Aug 2009
 
| Outreach
 
| Closed
 
| Deliver [http://www.brighttalk.com/webcasts/4767/attend OWASP presentation on XSS, client side exploitation, and countermeasures].
 
| DC
 
|-
 
| [[Industry:SAFECode Secure Development Practices (update to Oct 2008 version)|SAFECode Secure Development Practices (update to Oct 2008 version)]]
 
| 31 Jul 2009
 
| Standards
 
| Closed
 
| Response to [http://www.safecode.org/ SAFECode] "Fundamental Practices for Secure Software Development: A Guide to the Most Effective Secure Development Practices in Use Today."
 
| CW
 
|-
 
| [http://www.owasp.org/index.php/Category:OWASP_CSA_Project OWASP CSA Project]
 
| 8 Jul 2009
 
| Standards
 
| Closed
 
| Response to RFC [http://www.cloudsecurityalliance.org/guidance/csaguide.pdf Cloud Security Alliance Guidance v1.0]
 
| TB
 
|-
 
| [[Scotland]]
 
| 25 Jun 2009
 
| Outreach
 
| Closed
 
| Presentation about the Global Industry Committee, its role and recent activities (presentation slides [[Image:Owasp-scotland-industry-committee-june-2009.ppt]] and written notes [[Image:Owasp-scotland-industry-committee-june-2009-notes.pdf]])
 
| CW
 
|-
 
| OWASP Presentation at [http://cfp2009.org/ CFP Con 2009]
 
| 1 Jun 2009
 
| Outreach
 
| Closed
 
| Deliver presentation on web threats and countermeasures. See [http://www.cfp2009.org/wiki/index.php/Tutorials/Workshops CFP tutorial page] grep OWASP for more info.
 
| DC
 
|-
 
| ENISA [http://www.enisa.europa.eu/pages/02_03_news_2009_02_19_who_is_who.html Who-Is-Who Directory]
 
| -
 
| Outreach
 
| Closed
 
| Contact ENISA regarding OWASP inclusion in directory (in progress). Encourage European chapter leaders to contact their ENISA liaison officers (completed). Contact UK liaison officer on behalf of London, Leeds and Scotland chapters.
 
| CW
 
|-
 
| IIL [http://www.iilondon.co.uk/ Insurance Institute of London]
 
| 2 Jun 2009
 
| Outreach
 
| Closed
 
| Contact IIL regarding future input to their publication [http://www.iilondon.co.uk/XtraCart/store/comersus_viewItem.asp?idProduct=187 Insurance Aspects of E-Commerce]
 
| CW
 
|-
 
| [[Industry:Draft NIST SP 800-118|Draft NIST SP 800-118]]
 
| 29 May 2009
 
| Standards
 
| Closed
 
| Provide response to "Draft NIST Special Publication 800-118 Guide to Enterprise Password Management"
 
| CW/EK/RB/DC
 
|-
 
| German IT Industry Association
 
| 15 May 2009
 
| Outreach
 
| Closed
 
| Presentation on OWASP
 
| GH
 
|-
 
| [http://docs.google.com/Present?docid=ddkr62qv_171cd7gh5fb&skipauth=true Outreach Presentation to Frontier Airlines]
 
| 7 May 2009
 
| Outreach
 
| Closed
 
| Provide outreach presentation covering fundamentals of AppSec and Intro to OWASP
 
| DC
 
|-
 
| [[Industry:DPC BS 10012|DPC BS 10012]]
 
| 31 Mar 2009
 
| Standards
 
| Closed
 
| Provide response to "BS 10012 Specification for the management of personal information in compliance with the Data Protection Act 1998" Draft for Public Comment (DPC)
 
| CW
 
|-
 
| [[Industry:Draft NIST SP 800-53 Revision 3|Draft NIST SP 800-53 Revision 3]]
 
| 27 Mar 2009
 
| Standards
 
| Closed
 
| Provide response to "Draft NIST Special Publication 800-53 (Revision 3) Recommended Security Controls for Federal Information Systems and Organizations"
 
| RB
 
|-
 
| [[Industry:Draft NIST SP 800-122|Draft NIST SP 800-122]]
 
| 13 Mar 2009
 
| Standards
 
| Closed
 
| Provide response to "Draft NIST Special Publication 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)"
 
| CW
 
|-
 
| [[London]]
 
| 12 Mar 2009
 
| Outreach
 
| Closed
 
| Presentation about the Global Industry Committee, its role and recent activities (presentation slides [[Image:Owasp-london-industry-committee-march-2009.ppt]] and written notes [[Image:Owasp-london-industry-committee-march-2009-notes.pdf]])
 
| CW
 
|-
 
| [[Industry:Digital Britain Interim Report|Digital Britain Interim Report]]
 
| 11 Mar 2009
 
| Legislation
 
| Closed
 
| Provide response to UK Government's "Digital Britain Interim Report Jan 2009"
 
| CW
 
|-
 
| [http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2009 SnowFROC Front Range]
 
| 5 Mar 2009
 
| Outreach
 
| Closed
 
| Conference organisation
 
| DC
 
|-
 
| US [http://www.commerce.gov/ Department of Commerce]
 
| 25 Feb 2009
 
| Outreach
 
| Closed
 
| Presentation about OWASP to Economic Security Working Group
 
| RB
 
|-
 
| [[Industry:DPC BS 8878:2009|DPC BS 8878:2009]]
 
| 31 Jan 2009
 
| Standards
 
| Closed
 
| Provide response to "BS 8878:2009 Web accessibility. Building accessible experiences for disabled people" Draft for Public Comment (DPC)
 
| Puneet/CW
 
|-
 
| AppSec Presentation Delivered to Infragard, Dec 2008
 
| Dec 2008
 
| Outreach
 
| Closed
 
| [http://www.infragard.net/ Infragard] is a collaboration between the US FBI and maintainers of critical infrastructure. [http://docs.google.com/Present?docid=ddkr62qv_0cn7km4c3&skipauth=true Presentation here]. Email DC for full PPT with speaker notes
 
| DC
 
|-
 
| The Register [http://www.theregister.co.uk/2008/11/22/google_analytics_as_security_risk/ Google Analytics — Yes, it is a security risk]
 
| Nov 2008
 
| Outreach
 
| Closed
 
| Co-ordination of response and provision of comments from OWASP leaders about risk of JavaScript on Barack Obama's website
 
| DC
 
|}
 
  
 
=== General Presentations and Reports  ===
 
=== General Presentations and Reports  ===

Revision as of 22:17, 30 March 2011

The Global Industry Committee was created during the OWASP EU Summit in Portugal. The primary purpose of the Global Industry Committee is to work with industry executives to gather requirements from industry, work with Membership, Projects and others.

Mission Statement

To expand awareness of and promote the inclusion of software security best practices in Industry, Government, Academia and regulatory agencies and be a voice for industry. We will accomplish this through outreach; including presentations, development of position papers and collaborative efforts with other entities. Powerpoint of Accomplishments


Committee Plan

Step 1: Identify specific organizations worth working with to spread the OWASP gospel

Step 2: Prioritize the proposed liaisons based on potential impact, and also realistic likelihood of the organization actively working with us

Step 3: Execute, leveraging global OWASP resources as much as possible to maximize impact

Step 4: Evaluate progress & repeat Step 1-3

Committee Members


Members:

Name Email Location
Lorna Alamri lorna.alamri 'at' owasp dot org USA
Joe Bernik § bernik 'at' gmail dot com USA
Rex Booth rex.booth 'at' gt dot com USA
David Campbell dcampbell 'at' owasp dot org USA
Alexander Fry alexander.fry 'at' owasp dot org USA
Georg Hess georg.hess 'at' artofdefence dot com Germany
Colin Watson colin.watson 'at' owasp dot org UK
Mauro Flores mauro.flores 'at' owasp dot org Uruguay
Mateo Martinez mateo.martinez 'at' owasp dot org Uruguay


§ The committee chair is Joe Bernik. The previous chairs were:

  • Yiannis Pavlosoglou (Nov 2010 to Jan 2011)
  • Colin Watson (Nov 2009 to Oct 2010)


Board Member Representative:

Name Email Location
Eoin Keary eoin.keary 'at' owasp dot org Ireland


Secretary:

Name Email Location
Sarah Baso sarah.baso 'at' owasp dot org USA

Former members of the committee:

  • Yiannis Pavlosoglou

Monthly Report

See below...

Getting Involved

Mailing List

Join our mailing list - this is the best way to find out what's going on day-to-day, and to provide input.


Meetings

The next Global Industry Committee meeting will be:

  • Friday, April 1 at 14:00 hrs GMT
    • +1 877 534 8500 or International +1 513 534 8500
    • Passcode 410105 #
    • Agenda: TBD


  • Friday, March 18 at 5pm / 17:00 hrs GMT
    • +1 877 534 8500 or International +1 513 534 8500
    • Passcode 410105 #
    • Agenda forthcoming

Minutes of previous meetings are:


Membership

Membership explains how to become an OWASP organization supporter or individual member. But you don't have to be an OWASP Member or Committee Member to contribute.

The current committee members joined for a 12 month term - see How to Join a Committee and Global Committee Pages. We would especially welcome new members who can widen our geographic coverage (e.g. Africa, Asia and South America) and who have time to contribute proactively.


Other ongoing initiatives


Committee Working Documents


Current Activity

Work in Progress

The current activities being undertaken:

Task Deadline Type Status Description Who
FedRAMP 17 Jan 2011 Standards In progress Provide response to FedRAMP certification and accreditation process RB
Hacking Lab 14 Dec 2011 Outreach In progress Matt Tesauro has been working with Hacking Lab previously and brought it to the GIC MAT
OWASP Panel at Brighttalk Appsec Summit 16 March 2011 Outreach In progress Join an expert panel of OWASP leaders as they discuss new web application threats and give their insights on ways to secure them for your business [1] DC

Completed Items

View the GIC's past initiatives

General Presentations and Reports

OWASP Summits:

About the Industry Committee:

Summaries (for inclusion into other full OWASP presentations):


Other Global Committees