Difference between revisions of "OWASP EU Summit 2008 Working Sessions"

Working Session Lead: Dave Wichers
Working Session Team: Jeff Williams
Working Sessions Organization Model: "Everybody is a Participant" or "Invited Participants + Attendees"
Objectives:

• Discuss current Top10 structure and objectives
• Define methodology to collect attacks statistics

Projected Outcomes:

• Propose the revised OWASP Top 10 for 2009

Working Session Lead: OWASP Board
Working Session Team: OWASP Board, Kate & Paulo
Working Sessions Organization Model: "Everybody is a Participant" or "Invited Participants + Attendees"
Objectives:

• OWASP Governance
• Projects organization and rating
• Procedures for OWASP Standardization
• Chapter Governance
• OWASP Past, Present and Future
• Global Community Outreach (PR Issues, Pro Bono opportunities)

Projected Outcomes:

• Action Plan for 2009
• Strategies and recommendation for current projects

Working Session Lead: Sebastien Deleersnyder
Working Session Team: Martin Knobloch + TBD
Working Sessions Organization Model: "Everybody is a Participant"
Objectives:

• How to improve knowledge transfer from OWASP projects towards the community
• How to create training material (lessons, classes, courses) from OWASP project material?
• How to set up an OWASP education baseline
• How to setup an OWASP Boot Camp
• How to connect to organisation to promote OWASP education content: e.g. universities, other non-profit (or profit?) education organisations
• How to organize the OWASP / Conference trainings to make them the best in the world?
• Can we integrate this into OWASP certification projects?
• How to setup an OWASP Boot Camp?
• How to create lessons, classes, courses from OWASP project material?

Additional Details: There is plenty of knowledge available inside the OWASP community. This is spread via the OWASP AppSec Conferences and the local chapter meetings, not to forget the books available now. Another, very important way to distribute the available knowledge is to teach! In plenty presentations knowledge is put into slides to share it. The next step is to reuse the information of those presentations and create training material. In a Boot Camp for example, it's not only about telling how to break stuff, but let the attendees break it themselves. Also let them fix the problems, with guidance of the experienced!

Projected Outcomes:

• Educational Support on Winter of Code 2008
• Guildeline about creating training material

Working Session Lead: Paulo Coimbra
Working Session Team: TBD
Working Sessions Organization Model: "Everybody is a Participant"
Objectives:

• Define the operation model for the next OWASP Season of Code (the Winter of Code 08)
• Identify which areas should receive priority selection
• Create 'virtual teams' from the attendees and allocate them to key projects
• Discuss sponsoring models

Projected Outcomes:

• OWASP Winter of Code 08 plan
• # of projects for immediate approval (assuming the delivery team is all set)

Working Session Lead: Jeff Williams
Working Session Team: Arshan Dabirsiaghi
Working Sessions Organization Model: "Invited Participants + Attendees"
Objectives:

• Introduce everyone to the idea and cost-benefits of an ESAPI

Projected Outcomes:

• A volunteer to lead the 'marketing' campaign for ESAPI
• Prioritized list of marketing ideas for the ESAPI concept
• Prioritized list of ideas for improving the API

Working Session Lead: Arshan Dabirsiaghi
Working Session Team: TBD
Working Sessions Organization Model: "Invited Participants + Attendees"
Objectives:

• Discuss ongoing HTML5 security research
• Discuss further ramifications of HTML5 (cross-site XHR, Access-Control, client storage, etc.)
• Take a look at security critical areas and discuss possible browser improvements

Additional Details: ISWG = Intrinsic Security Working Group
Browsers to invite: IE, FF, Safari, Opera and Chrome
Projected Outcomes:

• OWASP Top 10 Browser Wishlist
• Actionable advice and technical arguments for HTML5 featureset
• Establish OWASP points-of-contact for W3C

Agenda:

Time: 30 mins
Introduction

Time: 2 hrs 30 mins
Action Item: Identify 5 Key Browser Risks and select the top 3 

Time: 2 hrs 30 mins
Address issues in the current HTML 5 specifications

Time: 1 hr 30 mins
Build a proposal to target key players in the industry and ask for their support
 
Time: 30  mins 
Assign point leads, roles and responsibilities

Working Session Lead:Arshan Dabirsiaghi
Working Session Team: TBD
Working Sessions Organization Model: "Invited Participants + Attendees"
Objectives:

• Discuss gaps and patterns in gaps in security coverage across frameworks
• Discuss possible solutions for security areas

Additional Details: ISWG = Intrinsic Security Working Group
Frameworks to invite: .NET, J2EE, Spring, Struts, ASP.NET MVC, RoR, PHP, etc.
Projected Outcomes:

• Actionable advice for each individual frameworks
• Identify points-of-contact for frameworks

Agenda:

Time: 30 mins
Introduction

Time: 2 hrs 30 mins
Action Item: Discuss current security issues with common Web Programming Languages such as:

PHP, Java,  Ruby ...

Time: 2 hrs 30 mins
Action Item: Discuss current security issues with common Web Programming Frameworks such as:

Spring, Struts, Cake, RoR ...

Time: 2 hrs 
Build a matrix of all the security features and possible solutions
 
Time: 30 mins 
Assign point leads, roles and responsibilities to contact leaders of the communities involved and 
work with them to address gaps and patterns discussed.

Working Session Lead:Mark Roxberry
Working Session Team: TBD
Working Sessions Organization Model: "Everybody is a Participant"
Objectives:

• Discuss audience and purpose of the OWASP .NET project
• Prepare OWASP .NET neutrality statement
• Discuss .NET and Mono SDL Best Practices and OWASP tools and documentation
• Discuss Vulnerability Research in the .NET and Mono Ecosystem

Additional Details:

• Objective 1: Establish purpose and audience of the OWASP .NET project. There are lots of resources and tools, why do we need OWASP .NET, who are our audiences, how do we reach them.
• Objective 2: Statement to OWASP .NET's purpose. As we work closely with Microsoft folks, they've discussed providing content, which is great, but we need to clearly state OWASP .NET's neutrality. The Summit is a good place for this action. I will have a draft for discussion prior to the working session
• Objective 3: OWASP sponsored vulnerability research / web application review / guidance on .NET/Mono projects, like Sharepoint, Silverlight, Community Server, Wikipedia Search (Mono), DekiWiki (Mono) etc.

Projected Outcomes:

• OWASP .NET Project Roadmap for 2009

Working Session Lead:Eoin Keary
Working Session Team: TBD
Working Sessions Organization Model: "Everybody is a Participant"
Objectives:

• Discuss next version of code review guide.
• Discuss industry requirements for code review.
• Discuss academic versus practical rammifications of guide.
• Brainstorm: Ideas for integration with other projects and tools.
• Develop a roadmap for the code review guide: Technologies, approaches

Additional Details:
...
Projected Outcomes:

• Develop a roadmap for the code review guide: Technologies,

Approaches

Working Session Lead:Colin Watson
Working Session Team: TBD
Working Sessions Organization Model: "Everybody is a Participant"
Objectives:

• Discuss whether there should be OWASP Awards
• Discuss options for undertaking an awards process
• Opportunities for public relations, marketing and sponsorship
• Avail possible risks of running an award event

Additional Details:
Should OWASP run an awards event?
What are the opportunities for public relations, marketing and sponsorship?
What categories should there be to honour people, projects and products?
Should the swards be a separate event or be part of another event?
What are the risks of running an awards event?
Projected Outcomes:

• Decision whether to progress with OWASP Awards
• Identify actions to progress if decision is "yes" or "maybe"
• List of further information required

Working Session Lead:Dhruv Soi
Working Session Team: Puneet Mehta
Working Sessions Organization Model: "Everybody is a Participant"
Objectives:

• Identify top reasons and driving factors to work with Government of

different countries

• Identify potential areas where OWASP and Government can work

together

• Discuss Measurable benefits
• Identify possible ways on how to approach this initiative

Projected Outcomes:

• Mission or goal statement
• Prioritized list of potential areas where OWASP can work with

Government

• Roadmap / Model to approach this initiative
• Identify Team / committee to lead this initiative

Working Session Lead:Matt Tesauro
Working Session Team: TBD
Working Sessions Organization Model: "Everybody is a Participant"
Objectives:

• Normalize possible confusion over various Live CD projects
• Determine the duration of OWASP branding for follow-on releases of

older projects

• Discuss an OWASP Project Life Cycle for Live CDs

Additional Details:
Googling either "OWASP LiveCD" or "OWASP Live CD" leads to multiple projects both old and new. For someone not familiar with the Live CD history, determining the "real" Live CD is confusing at best. This topic arose from comments by a review of the current Live CD 2008 project here
Projected Outcomes:

• A graceful method to handle current and future OWASP Live CD releases
• Determine the duration of OWASP branding for Live CDs (possibly better scoped for general OWASP projects discussion)
• Determine an OWASP Project Life Cycle for Live CDs (possibly better scoped for general OWASP projects discussion)

Working Session Lead:Leonardo Cavallari Militelli
Working Session Team: {name}
Working Sessions Organization Model: Invited Participants + Attendees
Objectives:

• Discuss project objectives for short and long term
• Interlink process to other projects

Projected Outcomes:

• Project roadmap
• Define potential contributors