Los Angeles/2009 Meetings/January 28

Speaker: Ben Walther

Ben Walther firmly believes testers have a wonderfully devious mindset, and has been promoting the idea of "security testing" at Cigital's clients, at OWASP events, and to any friends and relatives who will listen. To this end, with the aid of O'Reilly media, Ben Walther and Paco Hope recently published a book entitled the "Web Security Testing Cookbook." Everyone is welcome to join us at our chapter meetings. Meeting agenda will be sent to the Los Angeles OWASP mailing list prior to the meeting. List archives are also available for members who want to take a look at the latest discussion topics prior to the event.

Abstract:Building Security into the Test Organization

The common approach to detecting web security issues is still the regular application of a post-release pen-test or tool based scan. These last minute examinations rarely live up to broader organizational goals; they can be difficult to repeat, measure, or optimize over time. Most of all they're expensive: they find bugs late in the lifecycle. This talk recommends moving security testing responsibility within the test team itself. The approach discussed will work with-or-without the existence of explicit security requirements. See how security testing has been applied at other organizations and how it might be customized for yours.