OWASP AppSec Seattle 2006/Agenda

OWASP Training Courses

T1. Foundations of Web Application Security - One Day Course - October 16th, 2006
This powerful one day course focuses on the most common web application security problems, including the OWASP Top Ten. The course will introduce and demonstrate hacking techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities into their code. Read more here!
T2. WebServices and XML Security - One Day Course - October 16th, 2006
Many enterprises are currently developing new Web Services and/or adding and acquiring Web Services functionality into existing applications -- now is the time to build security into the system! Read more here!
T3. Advanced Asp.Net Exploits and Countermeasures - One Day Course - October 16th, 2006
In this one day course you will push Asp.Net to the limit and will be shown how Asp .NET applications and environments can be exploited by skilled attackers. Advanced exploitation techniques will be presented together with low-level technical analysis of the .Net Framework. You will also learn advanced defense techniques such as: Building an Asp .NET Security Protection layer (also called a Web Application Firewall) and Real time patching of vulnerabilities in the target application, the .Net Framework or the CLR. Read more here!

OWASP Seattle 2006 Conference Schedule

Day 1 - October 17th, 2006
	Track 1: Auditorium 1	Track 2: Auditorium 2
08:00 - 09:00	Registration and Coffee
09:00 - 09:10	Welcome to AppSec 2006 Seattle: Dave Wichers, OWASP Conferences Chair
09:10 - 10:00	Keynote: The Benefits of the SDL initiative to Microsoft and its Customers – Michael Howard, Senior Security Program Manager, Microsoft and coauthor of Writing Secure Code, 2nd Ed., 19 Deadly Sins of Software Security, and the recently released Microsoft Security Development Lifecycle (SDL).
10:00 - 11:10	Tentative: Strengthening the PCI standard to better address application security. Mastercard’s efforts to improve application security and why organizations should support OWASP. Shoon Wong, MasterCard
11:10 - 11:30	Break
11:30 - 12:30	OWASP Application Security Metrics and Assessment Standards Projects Bob Austin, OWASP Application Security Metrics Project Lead President, KoreLogic Security and Cliff Barlow, OWASP Application Security Assessment Standards Project Lead Director Security Services, KoreLogic Security	Why AJAX applications are far more likely to be insecure, Dave Wichers, COO Aspect Security
12:30 - 13:45	Lunch
13:45 - 15:00	TBD	Using Sprajax to Test AJAX Security, Keith Landrus, Director of Technology, Denim Group
15:00 - 15:20	Break
15:20-16:30	Agile and Secure: Can We Be Both?, Dan Cornel, Principal, Denim Group	The OWASP Code review, Testing guide & Live CD, an introduction., Eoin Keary, Sr Security Consultant, Rits (Ireland), OWASP Testing and Code Review Lead
16:30-16:50	Break
16:50 - 18:00	Panel: "Lessons Learned from Major Application Security Initiatives” Moderator: TBD Panelists: TBD
19:00 - 21:00	Social Gathering: Dinner and Drinks at Anthony’s Pier 66
Day 2 - October 18th, 2006
	Track 1: Auditorium 1	Track 2: Auditorium 2
08:00 - 09:00	Coffee
09:00 - 09:50	Keynote: TBD
09:50 - 10:50	TBD
10:50 - 11:10	Break
11:10 - 12:30	Buffer Overflows on the .Net Framework, Dinis Cruz, OWASP .Net Project Lead	TBD
12:30 - 13:45	Lunch
13:45 - 15:10	Advanced Web Services Security and Hacking, Justin Derry, Application Security Practice Leader, b-sec Consulting Pty Ltd (Australia)	TBD
15:10 - 15:30	Break
15:30 - 16:30	Panel: “What is in your application security toolbox?” Moderator: Gunnar Peterson Panelists: Dave Wichers, COO Aspect Security, Brian Chess, CTO Fortify, ?? F5, Danny Allan, Director, Security Research, Watchfire, Michael Howard, Microsoft
16:30 - 16:50	Break
16:50 - 17:30	Conference Wrap Up - Dave Wichers, OWASP Conferences Chair