This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP EU Summit 2008 Working Sessions"
(→WORKING SESSIONS - November 4rd & 5th (Tue & Wed) (DETAILS)) |
(→WORKING SESSIONS - November 4rd & 5th (Tue & Wed) (DETAILS)) |
||
Line 87: | Line 87: | ||
* How to setup an OWASP Boot Camp? | * How to setup an OWASP Boot Camp? | ||
* How to create lessons, classes, courses from OWASP project material? | * How to create lessons, classes, courses from OWASP project material? | ||
− | '''Additional Details:''' | + | '''Additional Details:''' |
There is plenty of knowledge available inside the OWASP community. This is spread via the OWASP AppSec Conferences and the | There is plenty of knowledge available inside the OWASP community. This is spread via the OWASP AppSec Conferences and the | ||
local chapter meetings, not to forget the books available now. Another, very important way to distribute the available knowledge is to teach! In plenty presentations knowledge is put into slides to share it. | local chapter meetings, not to forget the books available now. Another, very important way to distribute the available knowledge is to teach! In plenty presentations knowledge is put into slides to share it. | ||
Line 93: | Line 93: | ||
'''Projected Outcomes:''' | '''Projected Outcomes:''' | ||
− | * | + | * Educational Support on Winter of Code 2008 |
* Guildeline about creating training material | * Guildeline about creating training material | ||
|- | |- | ||
Line 99: | Line 99: | ||
! align="center" style="background:#4058A0; color:white" | | ! align="center" style="background:#4058A0; color:white" | | ||
− | ==== <font color="white"> Winter Of Code | + | ==== <font color="white"> Winter Of Code 2008 </font>==== |
|- | |- | ||
Line 110: | Line 110: | ||
* Identify which areas should receive priority selection | * Identify which areas should receive priority selection | ||
* Create 'virtual teams' from the attendees and allocate them to key projects | * Create 'virtual teams' from the attendees and allocate them to key projects | ||
− | + | * Discuss sponsoring models | |
− | |||
'''Projected Outcomes:''' | '''Projected Outcomes:''' | ||
* OWASP Winter of Code 08 plan | * OWASP Winter of Code 08 plan | ||
Line 128: | Line 127: | ||
'''Objectives:''' | '''Objectives:''' | ||
* Introduce everyone to the idea and cost-benefits of an ESAPI | * Introduce everyone to the idea and cost-benefits of an ESAPI | ||
− | |||
− | |||
− | |||
− | |||
'''Projected Outcomes:''' | '''Projected Outcomes:''' | ||
* A volunteer to lead the 'marketing' campaign for ESAPI | * A volunteer to lead the 'marketing' campaign for ESAPI | ||
* Prioritized list of marketing ideas for the ESAPI concept | * Prioritized list of marketing ideas for the ESAPI concept | ||
* Prioritized list of ideas for improving the API | * Prioritized list of ideas for improving the API | ||
− | |||
− | |||
|- | |- | ||
{| style="width:80%" border="0" align="center" | {| style="width:80%" border="0" align="center" | ||
Line 186: | Line 179: | ||
* Discuss gaps and patterns in gaps in security coverage across frameworks | * Discuss gaps and patterns in gaps in security coverage across frameworks | ||
* Discuss possible solutions for security areas | * Discuss possible solutions for security areas | ||
− | |||
'''Additional Details:''' | '''Additional Details:''' | ||
ISWG = Intrinsic Security Working Group<br/> | ISWG = Intrinsic Security Working Group<br/> | ||
Line 193: | Line 185: | ||
* Actionable advice for each individual frameworks | * Actionable advice for each individual frameworks | ||
* Identify points-of-contact for frameworks | * Identify points-of-contact for frameworks | ||
− | |||
− | |||
<br/> | <br/> | ||
'''Agenda:''' | '''Agenda:''' | ||
Line 220: | Line 210: | ||
| style="background:#F2F2F2" | | | style="background:#F2F2F2" | | ||
'''Working Session Lead:'''Mark Roxberry<br/> | '''Working Session Lead:'''Mark Roxberry<br/> | ||
− | '''Working Session Team:''' | + | '''Working Session Team:''' TBD<br/> |
'''Working Sessions Organization Model''': "Everybody is a Participant" <br/> | '''Working Sessions Organization Model''': "Everybody is a Participant" <br/> | ||
'''Objectives:''' | '''Objectives:''' | ||
Line 227: | Line 217: | ||
* Discuss .NET and Mono SDL Best Practices and OWASP tools and documentation | * Discuss .NET and Mono SDL Best Practices and OWASP tools and documentation | ||
* Discuss Vulnerability Research in the .NET and Mono Ecosystem | * Discuss Vulnerability Research in the .NET and Mono Ecosystem | ||
− | |||
− | |||
'''Additional Details:'''<br/> | '''Additional Details:'''<br/> | ||
* Objective 1: Establish purpose and audience of the OWASP .NET project. There are lots of resources and tools, why do we need OWASP .NET, who are our audiences, how do we reach them. | * Objective 1: Establish purpose and audience of the OWASP .NET project. There are lots of resources and tools, why do we need OWASP .NET, who are our audiences, how do we reach them. | ||
* Objective 2: Statement to OWASP .NET's purpose. As we work closely with Microsoft folks, they've discussed providing content, which is great, but we need to clearly state OWASP .NET's neutrality. The Summit is a good place for this action. I will have a draft for discussion prior to the working session | * Objective 2: Statement to OWASP .NET's purpose. As we work closely with Microsoft folks, they've discussed providing content, which is great, but we need to clearly state OWASP .NET's neutrality. The Summit is a good place for this action. I will have a draft for discussion prior to the working session | ||
* Objective 3: OWASP sponsored vulnerability research / web application review / guidance on .NET/Mono projects, like Sharepoint, Silverlight, Community Server, Wikipedia Search (Mono), DekiWiki (Mono) etc. | * Objective 3: OWASP sponsored vulnerability research / web application review / guidance on .NET/Mono projects, like Sharepoint, Silverlight, Community Server, Wikipedia Search (Mono), DekiWiki (Mono) etc. | ||
− | |||
− | |||
'''Projected Outcomes:''' | '''Projected Outcomes:''' | ||
− | * | + | * OWASP .NET Project Roadmap for 2009 |
− | |||
− | |||
|- | |- | ||
Line 252: | Line 236: | ||
'''Working Sessions Organization Model''': "Everybody is a Participant" <br/> | '''Working Sessions Organization Model''': "Everybody is a Participant" <br/> | ||
'''Objectives:''' | '''Objectives:''' | ||
− | * | + | * Discuss next version of code review guide. |
− | * | + | * Discuss industry requirements for code review. |
− | * | + | * Discuss academic versus practical rammifications of guide. |
− | * | + | * Brainstorm: Ideas for integration with other projects and tools. |
− | * | + | * Develop a roadmap for the code review guide: Technologies, approaches |
'''Additional Details:'''<br/> | '''Additional Details:'''<br/> | ||
...<br/> | ...<br/> | ||
'''Projected Outcomes:''' | '''Projected Outcomes:''' | ||
− | * | + | * Develop a roadmap for the code review guide: Technologies, |
− | + | Approaches | |
− | + | ||
|- | |- | ||
{| style="width:80%" border="0" align="center" | {| style="width:80%" border="0" align="center" | ||
Line 277: | Line 261: | ||
* Discuss whether there should be OWASP Awards | * Discuss whether there should be OWASP Awards | ||
* Discuss options for undertaking an awards process | * Discuss options for undertaking an awards process | ||
− | * | + | * Opportunities for public relations, marketing and sponsorship |
+ | * Avail possible risks of running an award event | ||
'''Additional Details:'''<br/> | '''Additional Details:'''<br/> | ||
Should OWASP run an awards event?<br/> | Should OWASP run an awards event?<br/> | ||
Line 288: | Line 273: | ||
* Identify actions to progress if decision is "yes" or "maybe" | * Identify actions to progress if decision is "yes" or "maybe" | ||
* List of further information required | * List of further information required | ||
− | + | ||
|- | |- | ||
{| style="width:80%" border="0" align="center" | {| style="width:80%" border="0" align="center" | ||
Line 301: | Line 286: | ||
'''Working Sessions Organization Model''': "Everybody is a Participant" <br/> | '''Working Sessions Organization Model''': "Everybody is a Participant" <br/> | ||
'''Objectives:''' | '''Objectives:''' | ||
− | * | + | * Identify top reasons and driving factors to work with Government of |
− | * | + | different countries |
− | * | + | * Identify potential areas where OWASP and Government can work |
− | + | together | |
− | + | * Discuss Measurable benefits | |
+ | * Identify possible ways on how to approach this initiative | ||
'''Projected Outcomes:''' | '''Projected Outcomes:''' | ||
− | * | + | * Mission or goal statement |
− | * | + | * Prioritized list of potential areas where OWASP can work with |
− | * | + | Government |
+ | * Roadmap / Model to approach this initiative | ||
+ | * Identify Team / committee to lead this initiative | ||
|- | |- | ||
|} | |} | ||
Line 323: | Line 311: | ||
'''Working Sessions Organization Model''': "Everybody is a Participant" <br/> | '''Working Sessions Organization Model''': "Everybody is a Participant" <br/> | ||
'''Objectives:''' | '''Objectives:''' | ||
− | * | + | * Normalize possible confusion over various Live CD projects |
− | * Determine the duration of OWASP branding for follow-on releases of older projects | + | * Determine the duration of OWASP branding for follow-on releases of |
− | * Discuss an OWASP Project Life Cycle for Live CDs | + | older projects |
+ | * Discuss an OWASP Project Life Cycle for Live CDs | ||
'''Additional Details:'''<br/> | '''Additional Details:'''<br/> | ||
Googling either "OWASP LiveCD" or "OWASP Live CD" leads to multiple projects both old and new. For someone not familiar with the Live CD history, determining the "real" Live CD is confusing at best. This topic arose from comments by a review of the current Live CD 2008 project [http://www.owasp.org/index.php/Project_Information:template_Live_CD_2008_Project_-_Final_Review_-_Second_Reviewer_-_F here]<br/> | Googling either "OWASP LiveCD" or "OWASP Live CD" leads to multiple projects both old and new. For someone not familiar with the Live CD history, determining the "real" Live CD is confusing at best. This topic arose from comments by a review of the current Live CD 2008 project [http://www.owasp.org/index.php/Project_Information:template_Live_CD_2008_Project_-_Final_Review_-_Second_Reviewer_-_F here]<br/> | ||
Line 345: | Line 334: | ||
'''Working Sessions Organization Model''': Invited Participants + Attendees <br/> | '''Working Sessions Organization Model''': Invited Participants + Attendees <br/> | ||
'''Objectives:''' | '''Objectives:''' | ||
− | * | + | * Discuss project objectives for short and long term |
− | * | + | * Interlink process to other projects |
− | |||
− | |||
− | |||
'''Projected Outcomes:''' | '''Projected Outcomes:''' | ||
− | * | + | * Project roadmap |
− | * | + | * Define potential contributors |
− | |||
|- | |- | ||
|} | |} |
Revision as of 02:06, 30 September 2008
- 1 THIS IS STILL under heavy UPDATES (i.e. work in progress)
- 2 WORKING SESSIONS - November 3rd, 4th & 5th (Mon, Tue & Wed)
- 3 WORKING SESSIONS - November 4rd & 5th (Tue & Wed) (DETAILS)
- 3.1 OWASP Top 10 2009
- 3.2 OWASP Strategic Planning
- 3.3 OWASP Education Project
- 3.4 Winter Of Code 2008
- 3.5 Enterprise Security API Project
- 3.6 ISWG: Browser Security
- 3.7 ISWG: Web Application Framework Security
- 3.8 OWASP .NET Project
- 3.9 Code Review (next version)
- 3.10 OWASP Awards
- 3.11 OWASP Intra Governmental Affairs
- 3.12 OWASP CD/DVD
- 3.13 OWASP ASDR
- 4 Draft notes
THIS IS STILL under heavy UPDATES (i.e. work in progress)
WORKING SESSIONS - November 3rd, 4th & 5th (Mon, Tue & Wed)
Monday
- OWASP ISWG: Browser Security (part 1) - 4h . . . (ISWG = Intrinsic Security Working Group)
Tuesday
- Working Sessions Operational model - 1h , ALL to attend
- OWASP Strategic Planning for 2009 - 3h
- OWASP Tool's Projects (consolidation action-plan) - 3h
- OWASP ISWG: Web Application Framework Security (part 1) - 3h . . . (ISWG = Intrinsic Security Working Group)
- OWASP Documentation Projects (consolidation action-plan) - 3h
- Winter Of Code 2009 - 4h
- OWASP .NET Project - 2h
- Two-way Internationalization of OWASP Content - 2h
Wednesday
- OWASP Top 10 2009 - 2h
- OWASP Education Project - 2h
- ESAPI Project - 4h
- Code Review (next version) - 2h
- Testing Guide (next version) -2h
- OWASP Certifications - 2h
- OWASP Application Security Desk Reference (ASDR) - 4h
- OWASP Intra Governmental Affairs - 2h
- OWASP Awards - 2h
- OWASP Website -2h
- OWASP Advisory Board (private presentation) - 2h
- OWASP CD/DVD - 2 h
- OWASP Board Meeting (public session) - 3h
WORKING SESSIONS - November 4rd & 5th (Tue & Wed) (DETAILS)
OWASP Top 10 2009 |
---|
Working Session Lead: Dave Wichers
Projected Outcomes:
|
OWASP Strategic Planning |
---|
Working Session Lead: OWASP Board
Projected Outcomes:
|
OWASP Education Project |
---|
Working Session Lead: Sebastien Deleersnyder
Additional Details: There is plenty of knowledge available inside the OWASP community. This is spread via the OWASP AppSec Conferences and the local chapter meetings, not to forget the books available now. Another, very important way to distribute the available knowledge is to teach! In plenty presentations knowledge is put into slides to share it. The next step is to reuse the information of those presentations and create training material. In a Boot Camp for example, it's not only about telling how to break stuff, but let the attendees break it themselves. Also let them fix the problems, with guidance of the experienced! Projected Outcomes:
|
Winter Of Code 2008 |
---|
Working Session Lead: Paulo Coimbra
Projected Outcomes:
|
Enterprise Security API Project |
---|
Working Session Lead: Jeff Williams
Projected Outcomes:
|
ISWG: Browser Security |
---|
Working Session Lead: Arshan Dabirsiaghi
Additional Details:
ISWG = Intrinsic Security Working Group
Time: 30 mins Introduction |
ISWG: Web Application Framework Security |
---|
Working Session Lead:Arshan Dabirsiaghi
Additional Details:
ISWG = Intrinsic Security Working Group
Time: 30 mins Introduction |
OWASP .NET Project |
---|
Working Session Lead:Mark Roxberry
Additional Details:
Projected Outcomes:
|
Code Review (next version) |
---|
Working Session Lead:Eoin Keary
Additional Details:
Approaches |
OWASP Awards |
---|
Working Session Lead:Colin Watson
Additional Details:
|
OWASP Intra Governmental Affairs |
---|
Working Session Lead:Dhruv Soi
different countries
together
Projected Outcomes:
Government
|
OWASP CD/DVD |
---|
Working Session Lead:Matt Tesauro
older projects
Additional Details:
|
OWASP ASDR |
---|
Working Session Lead:Leonardo Cavallari Militelli
Projected Outcomes:
|
Draft notes
Note: there needs to be a 1h session on the 1st day of working sessions (Tue) to explain the rules of the game, how everything will work and what is expected from each WS (Working Session)
- Working Sessions can meet simultaneously or by some method of time allotment (depends on scheduling and priority)
- Open membership, first order of business is to confirm chair and secretary of group (We can get this setup and discuss on the lists now, so we are running when we get to the Summit)
- Dinis, Paulo suggested that working groups will produce OWASP Initiatives, Statements, Decisions.
- OWASP Initiatives, Statements and Decisions can be distributed in electronic form prior to the Summit or a Working Group assembly.
- Additionally, time should be allocated for anything new at the actual Working Group assembly. (Again, we can get the ball rolling on this now and have discussion and motion at Summit).
- Simple Majority to Pass Motions (I can distribute a Roberts Rules of Order - Lite prior to the meeting to the chair)
- Board Reserves Veto and Tabling Authority at the Summit
- Working Groups:
- OWASP Top 10 2009
- OWASP Governance (e.g. International guidelines, Board member confirmation)
- Projects (e.g. Organize and rate projects, Development plans,Documentation
- Chapter Governance (e.g. Budgets, Activities)
- OWASP Future (e.g. Action Plan for 2009, Investment recommendation, 5 year Outlook)
- Web Vulnerability Assessment (Code Review/Testing)
- Global Community Outreach (PR Issues, Pro Bono opportunities)
- Web Technology (e.g. Browser security wishlist, architectural recommendations, technology recommendations)
Agenda
- Opening Statement
- Motions on the table (1st, 2nd, Vote)
- New Business (new motions, statements for record)
- Closing Statement
- As the first ever of this format, we should invite working group chairs and discuss a potential list of motions to get them started (specifically for
financially related motions, e.g. Dinis mentioned $200K USD investment plan as an example in an earlier e-mail). What kinds of things to start with. Then they can put the ideas to a list or lists for discussion prior to the meeting.
Working Sessions outcomes
- OWASP Initiates: "Spend xyz on Project yyy" , "Plan to organize all OWASP tools / books" , "Stategy to organize and rate ALL OWASP projects", "6 month Development plan for EASPI"
- Public Statements: "Here is the OWASP Top 10 2009", "This is what OWASP's position is on xxx" , "Browser security wish-list for Browsers (IE, Mozilla, Safari and Opera)"
- OWASP Decisions: "Action plan for OWASP in 2009", "Hire x developers to support projects", "next 200k USD investment plan", "OWASP governance and vote of 6th Board Member", "Internaltional OWASP non-profit organizations guidelines",
Summit
- Should a Board Member chair?
- Agenda
- Opening Statement (this is the first Summit, so this is a special thing)
- Overall Summit meeting can be an informational meeting about Working group motions. Board can approve, veto or table motions from Working
Groups. However, if doing this at the Summit, there may be controversial issues where the Board rejects a motion. Each working group has a spot on this agenda.
- OWASP Motions not from Working Groups, allocate time for this.
- Closing Statement