This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP NYC AppSec 2008 Conference"

From OWASP
Jump to: navigation, search
Line 26: Line 26:
 
<br>  
 
<br>  
 
''OWASP Foundation: [[Contact | Jeff Williams]], [[Contact | Dinis Cruz]], [[Contact | Dave Wichers]], [[Contact | Tom Brennan]], [[Contact | Sebastien Deleersnyder]]'' <br>
 
''OWASP Foundation: [[Contact | Jeff Williams]], [[Contact | Dinis Cruz]], [[Contact | Dave Wichers]], [[Contact | Tom Brennan]], [[Contact | Sebastien Deleersnyder]]'' <br>
 +
[http://video.google.com/videoplay?docid=-228977859802026041&hl=en VIDEO] /
 
[http://www.owasp.org/images/b/b7/AppSecNYC08-Delivering_AppSec_Info.ppt Dave Wichers's SLIDES]
 
[http://www.owasp.org/images/b/b7/AppSecNYC08-Delivering_AppSec_Info.ppt Dave Wichers's SLIDES]
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 10:00-10:45 || style="width:30%; background:#BC857A" align="center" |  '''[[AppSecEU08_Trends_in_Web_Hacking_Incidents:_What%27s_hot_for_2008 | Analysis of the Web Hacking Incidents Database (WHID)]]''' <br>
 
| style="width:10%; background:#7B8ABD" | 10:00-10:45 || style="width:30%; background:#BC857A" align="center" |  '''[[AppSecEU08_Trends_in_Web_Hacking_Incidents:_What%27s_hot_for_2008 | Analysis of the Web Hacking Incidents Database (WHID)]]''' <br>
 
''[http://blog.shezaf.com Ofer Shezaf]''<br>
 
''[http://blog.shezaf.com Ofer Shezaf]''<br>
−
[http://video.google.com/videoplay?docid=-5720864613313370961 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=1130960689238372157&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''[http://www.webappsecroadmap.com Web Application Security Road Map]'''<br>
 
'''[http://www.webappsecroadmap.com Web Application Security Road Map]'''<br>
 
''[http://joesecurity.blogspot.com Joe White]''<br>
 
''[http://joesecurity.blogspot.com Joe White]''<br>
−
[http://video.google.com/videoplay?docid=-1779454916843226992 VIDEO] / [https://sites.google.com/a/webappsecroadmap.com/main/announcements/owasp-appsec-2008-presentation-has-been-uploaded SLIDES]
+
[http://video.google.com/videoplay?docid=-237406228011458703&hl=en VIDEO] / [https://sites.google.com/a/webappsecroadmap.com/main/announcements/owasp-appsec-2008-presentation-has-been-uploaded SLIDES]
 
| style="width:30%; background:#99FF99" align="center" |
 
| style="width:30%; background:#99FF99" align="center" |
 
'''[https://buildsecurityin.us-cert.gov/swa/acqwg.html DHS Software Assurance Initiatives]'''<br>
 
'''[https://buildsecurityin.us-cert.gov/swa/acqwg.html DHS Software Assurance Initiatives]'''<br>
 
''[http://www.linkedin.com/pub/0/ab/3b7 Stan Wisseman] & [http://www.linkedin.com/pub/1/439/923 Joe Jarzombek]''<br>
 
''[http://www.linkedin.com/pub/0/ab/3b7 Stan Wisseman] & [http://www.linkedin.com/pub/1/439/923 Joe Jarzombek]''<br>
−
[http://video.google.com/videoplay?docid=1622760378697749199 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-6505795148329572484&hl=en VIDEO] / SLIDES
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 11:00-11:45 || style="width:30%; background:#BC857A" align="center" |  
 
| style="width:10%; background:#7B8ABD" | 11:00-11:45 || style="width:30%; background:#BC857A" align="center" |  
 
'''Http Bot Research'''<br>
 
'''Http Bot Research'''<br>
 
''[http://www.shadowserver.org/wiki/pmwiki.php?n=Shadowserver.Mission Andre M. DiMino - ShadowServer Foundation]''<br>
 
''[http://www.shadowserver.org/wiki/pmwiki.php?n=Shadowserver.Mission Andre M. DiMino - ShadowServer Foundation]''<br>
−
[http://video.google.com/videoplay?docid=2497951893063269839 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=1400503643786264015&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''OWASP "Google Hacking" Project'''<br>
 
'''OWASP "Google Hacking" Project'''<br>
 
''[http://www.linkedin.com/in/ChristianHeinrich Christian Heinrich]''<br>
 
''[http://www.linkedin.com/in/ChristianHeinrich Christian Heinrich]''<br>
−
[http://video.google.com/videoplay?docid=-52323203011607769 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=5419982525671711780&hl=en VIDEO] / SLIDES
 
| style="width:30%; background:#99FF99" align="center" |  
 
| style="width:30%; background:#99FF99" align="center" |  
 
'''MalSpam Research'''<br>
 
'''MalSpam Research'''<br>
 
'' [http://www.knujon.com/bios.html Garth Bruen]''<br>
 
'' [http://www.knujon.com/bios.html Garth Bruen]''<br>
−
[http://video.google.com/videoplay?docid=-5258350405868786488 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-8813268235790993111&hl=en VIDEO] / SLIDES
 
|-
 
|-
 
  | style="width:10%; background:#7B8ABD" | 12:00-13:00 || colspan="3" style="width:80%; background:#F2F2F2" align="center" | [[OWASP_NYC_AppSec_2008_Conference/ctf | Capture the Flag]] Sign-Up
 
  | style="width:10%; background:#7B8ABD" | 12:00-13:00 || colspan="3" style="width:80%; background:#F2F2F2" align="center" | [[OWASP_NYC_AppSec_2008_Conference/ctf | Capture the Flag]] Sign-Up
Line 59: Line 60:
 
'''Get Rich or Die Trying - Making Money on The Web, The Black Hat Way'''<br>
 
'''Get Rich or Die Trying - Making Money on The Web, The Black Hat Way'''<br>
 
''[http://www.linkedin.com/in/treyford Trey Ford], [http://www.linkedin.com/in/tombrennan Tom Brennan], [http://www.linkedin.com/pub/0/205/77a Jeremiah Grossman]''<br>
 
''[http://www.linkedin.com/in/treyford Trey Ford], [http://www.linkedin.com/in/tombrennan Tom Brennan], [http://www.linkedin.com/pub/0/205/77a Jeremiah Grossman]''<br>
−
[http://video.google.com/videoplay?docid=-5017192788997757423 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-7209323310151363553&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''Framework-level Threat Analysis: Adding Science to the Art of Source-code review'''<br>
 
'''Framework-level Threat Analysis: Adding Science to the Art of Source-code review'''<br>
 
''[[OWASP_NYC_AppSec_2008_Conference-rohit-sethi | Rohit Sethi]] & [[OWASP_NYC_AppSec_2008_Conference-sahba-kazerooni | Sahba Kazerooni]]''<br>
 
''[[OWASP_NYC_AppSec_2008_Conference-rohit-sethi | Rohit Sethi]] & [[OWASP_NYC_AppSec_2008_Conference-sahba-kazerooni | Sahba Kazerooni]]''<br>
−
[http://video.google.com/videoplay?docid=-5173141565449551205 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=8935251380629216945&hl=en VIDEO] / SLIDES
 
| style="width:30%; background:#99FF99" align="center" |  
 
| style="width:30%; background:#99FF99" align="center" |  
 
'''Automated Web-based Malware Behavioral Analysis'''<br>
 
'''Automated Web-based Malware Behavioral Analysis'''<br>
 
''[http://www.linkedin.com/pub/3/359/b1a Tyler Hudak]''<br>
 
''[http://www.linkedin.com/pub/3/359/b1a Tyler Hudak]''<br>
−
[http://video.google.com/videoplay?docid=1242822225444892511 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=4204600308807371535&hl=en VIDEO] / SLIDES
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 13:00-13:45 || style="width:30%; background:#BC857A" align="center" |  
 
| style="width:10%; background:#7B8ABD" | 13:00-13:45 || style="width:30%; background:#BC857A" align="center" |  
 
'''[http://blogs.adobe.com/psirt/2008/09/thanks_to_jeremiah_grossman_an.html New 0-Day Browser Exploits: Clickjacking - yea, this is bad...]'''<br>
 
'''[http://blogs.adobe.com/psirt/2008/09/thanks_to_jeremiah_grossman_an.html New 0-Day Browser Exploits: Clickjacking - yea, this is bad...]'''<br>
 
''[http://jeremiahgrossman.blogspot.com Jeremiah Grossman] & [http://ha.ckers.org/blog/about Robert "RSnake" Hansen]''<br>
 
''[http://jeremiahgrossman.blogspot.com Jeremiah Grossman] & [http://ha.ckers.org/blog/about Robert "RSnake" Hansen]''<br>
−
[http://video.google.com/videoplay?docid=-1023253423246814538 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-5747622209791380934&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''Web Intrusion Detection with ModSecurity'''<br>
 
'''Web Intrusion Detection with ModSecurity'''<br>
 
''[http://www.breach.com/company/executive-team/ Ivan Ristic]''<br>
 
''[http://www.breach.com/company/executive-team/ Ivan Ristic]''<br>
−
VIDEO / [[Media:OWASP_NYC_2008-Web_Intrusion_Detection_with_ModSecurity.pdf|SLIDES]]
+
[http://video.google.com/videoplay?docid=-7391448618249578180&hl=en VIDEO] / [[Media:OWASP_NYC_2008-Web_Intrusion_Detection_with_ModSecurity.pdf|SLIDES]]
 
| style="width:30%; background:#99FF99" align="center" |  
 
| style="width:30%; background:#99FF99" align="center" |  
 
'''Using Layer 8 and OWASP to Secure Web Applications'''<br>
 
'''Using Layer 8 and OWASP to Secure Web Applications'''<br>
 
''[http://www.linkedin.com/in/davidstern2000 David Stern] & [http://www.linkedin.com/in/romangarber Roman Garber]''<br>
 
''[http://www.linkedin.com/in/davidstern2000 David Stern] & [http://www.linkedin.com/in/romangarber Roman Garber]''<br>
−
[http://video.google.com/videoplay?docid=5266888637212683476 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-3883297889781954509&hl=en VIDEO] / SLIDES
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 14:00-14:45 || style="width:30%; background:#BC857A" align="center" | '''Industry Outlook Panel:'''<br>
 
| style="width:10%; background:#7B8ABD" | 14:00-14:45 || style="width:30%; background:#BC857A" align="center" | '''Industry Outlook Panel:'''<br>
Line 93: Line 94:
 
[http://www.linkedin.com/pub/5/658/872 Tom King] CISO, Barclays Capital <br>
 
[http://www.linkedin.com/pub/5/658/872 Tom King] CISO, Barclays Capital <br>
 
Moderator: [http://www.linkedin.com/in/mahidontamsetti  Mahi Dontamsetti]''
 
Moderator: [http://www.linkedin.com/in/mahidontamsetti  Mahi Dontamsetti]''
 +
[http://video.google.com/videoplay?docid=-7051719323294878516&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''[http://www.owasp.org/index.php/Security_Assessing_Java_RMI Security Assessing Java RMI] '''<br>
 
'''[http://www.owasp.org/index.php/Security_Assessing_Java_RMI Security Assessing Java RMI] '''<br>
 
''[http://www.linkedin.com/in/adamboulton Adam Boulton]''<br>
 
''[http://www.linkedin.com/in/adamboulton Adam Boulton]''<br>
−
[http://video.google.com/videoplay?docid=4135644338377752676 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=1673714450539106400&hl=en VIDEO] / SLIDES
 
| style="width:30%; background:#99FF99" align="center" |  
 
| style="width:30%; background:#99FF99" align="center" |  
 
'''JBroFuzz 0.1 - 1.1: Building a Java Fuzzer for the Web'''<br>
 
'''JBroFuzz 0.1 - 1.1: Building a Java Fuzzer for the Web'''<br>
 
''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Yiannis_Pavlosoglou | Yiannis Pavlosoglou]]''<br>
 
''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Yiannis_Pavlosoglou | Yiannis Pavlosoglou]]''<br>
−
[http://video.google.com/videoplay?docid=2546750478041391105 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-1551704659206071145&hl=en VIDEO] / SLIDES
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 15:00-15:45 || style="width:30%; background:#BC857A" align="center" |  
 
| style="width:10%; background:#7B8ABD" | 15:00-15:45 || style="width:30%; background:#BC857A" align="center" |  
 
'''OWASP Testing Guide - Offensive Assessing Financial Applications'''<br>
 
'''OWASP Testing Guide - Offensive Assessing Financial Applications'''<br>
 
'' [[OWASP_NYC_AppSec_2008_Conference-daniel-cuthbert | Daniel Cuthbert]]''<br>
 
'' [[OWASP_NYC_AppSec_2008_Conference-daniel-cuthbert | Daniel Cuthbert]]''<br>
−
[http://video.google.com/videoplay?docid=6800291421728032058 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-3228312539505217121&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''Flash Parameter Injection (FPI)'''<br>
 
'''Flash Parameter Injection (FPI)'''<br>
 
''Ayal Yogev & Adi Sharabani''<br>
 
''Ayal Yogev & Adi Sharabani''<br>
−
[http://video.google.com/videoplay?docid=5602204870320084688 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=7818654218575619118&hl=en VIDEO] / SLIDES
 
| style="width:30%; background:#99FF99" align="center" |
 
| style="width:30%; background:#99FF99" align="center" |
 
'''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Andres_Riancho | w3af - A Framework to own the web]]'''<br>
 
'''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Andres_Riancho | w3af - A Framework to own the web]]'''<br>
 
''Andres Riancho''<br>
 
''Andres Riancho''<br>
−
[http://video.google.com/videoplay?docid=3120471281728221977 VIDEO] / VIDEO
+
[http://video.google.com/videoplay?docid=4354579888802327250&hl=en VIDEO] / VIDEO
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 16:00-16:45 || style="width:30%; background:#BC857A" align="center" |  
 
| style="width:10%; background:#7B8ABD" | 16:00-16:45 || style="width:30%; background:#BC857A" align="center" |  
 
'''OWASP Enterprise Security API [[ESAPI | (ESAPI) Project]]'''<br>
 
'''OWASP Enterprise Security API [[ESAPI | (ESAPI) Project]]'''<br>
 
'' [http://www.aspectsecurity.com/management.htm Jeff Williams]''<br>
 
'' [http://www.aspectsecurity.com/management.htm Jeff Williams]''<br>
−
[http://video.google.com/videoplay?docid=1573692246177088241 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-2912157383449643073&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''Cross-Site Scripting Filter Evasion'''<br>
 
'''Cross-Site Scripting Filter Evasion'''<br>
 
''Alexios Fakos''<br>
 
''Alexios Fakos''<br>
−
[http://video.google.com/videoplay?docid=-7011871449560433816 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-6974576754943514571&hl=en VIDEO] / SLIDES
 
| style="width:30%; background:#99FF99" align="center" |  
 
| style="width:30%; background:#99FF99" align="center" |  
−
'''Case Studies: Exploiting application testing tool deficiencies via "out of band" injection'''<br>
+
'''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-GunterOllmann | Multidisciplinary Bank Attacks]]'''<br>
−
''[http://www.linkedin.com/pub/0/a91/aa2 Vijay Akasapu] & [http://www.linkedin.com/pub/9/279/381 Marshall Heilman]''<br>
+
''Gunter Ollmann''<br>
−
[http://video.google.com/videoplay?docid=-4177461397511303899 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=3041861094296331549&hl=en VIDEO] / SLIDES
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 17:00-17:45 || style="width:30%; background:#BC857A" align="center" |  
 
| style="width:10%; background:#7B8ABD" | 17:00-17:45 || style="width:30%; background:#BC857A" align="center" |  
 
'''Open Discussion On Application Security'''<br>
 
'''Open Discussion On Application Security'''<br>
 
''Joe Bernik & Steve Anton''<br>
 
''Joe Bernik & Steve Anton''<br>
−
[http://video.google.com/videoplay?docid=-2223766382226597617 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=6718671647859572098&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''Mastering PCI Section 6.6'''<br>
 
'''Mastering PCI Section 6.6'''<br>
 
''[http://www.linkedin.com/pub/1/228/6a5 Taylor McKinley] and [http://www.linkedin.com/in/jacobwest Jacob West]''<br>
 
''[http://www.linkedin.com/pub/1/228/6a5 Taylor McKinley] and [http://www.linkedin.com/in/jacobwest Jacob West]''<br>
−
[http://video.google.com/videoplay?docid=-148273235293097872 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-2544477786674220116&hl=en VIDEO] / SLIDES
 
| style="width:30%; background:#99FF99" align="center" |  
 
| style="width:30%; background:#99FF99" align="center" |  
−
'''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-GunterOllmann | Multidisciplinary Bank Attacks]]'''<br>
+
'''Case Studies: Exploiting application testing tool deficiencies via "out of band" injection'''<br>
−
''Gunter Ollmann''<br>
+
''[http://www.linkedin.com/pub/0/a91/aa2 Vijay Akasapu] & [http://www.linkedin.com/pub/9/279/381 Marshall Heilman]''<br>
−
VIDEO / SLIDES
+
[http://video.google.com/videoplay?docid=7623989457736720764&hl=en VIDEO] / SLIDES
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 18:00-18:45 || style="width:30%; background:#BC857A" align="center" |  
 
| style="width:10%; background:#7B8ABD" | 18:00-18:45 || style="width:30%; background:#BC857A" align="center" |  
 
'''[http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project Spearfishing and the OWASP Live CD Project]'''<br>
 
'''[http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project Spearfishing and the OWASP Live CD Project]'''<br>
 
''[http://www.linkedin.com/in/packetfocus Joshua Perrymon]''<br>
 
''[http://www.linkedin.com/in/packetfocus Joshua Perrymon]''<br>
−
[http://video.google.com/videoplay?docid=-4921295996586131041 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=-4419524791864555496&hl=en VIDEO] / SLIDES
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
  | style="width:30%; background:#BCA57A" align="center" |  
 
'''Coding Secure w/PHP'''<br>
 
'''Coding Secure w/PHP'''<br>
 
''[http://www.linkedin.com/in/zaunere Hans Zaunere]''<br>
 
''[http://www.linkedin.com/in/zaunere Hans Zaunere]''<br>
−
[http://video.google.com/videoplay?docid=-3909122334473121739 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=3477751371038020741&hl=en VIDEO] / SLIDES
 
| style="width:30%; background:#99FF99" align="center" |  
 
| style="width:30%; background:#99FF99" align="center" |  
 
'''[[Payment_Card_Data_Security_and_the_new_Enterprise_Java | Payment Card Data Security and the new Enterprise Java]]'''<br>
 
'''[[Payment_Card_Data_Security_and_the_new_Enterprise_Java | Payment Card Data Security and the new Enterprise Java]]'''<br>
 
''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Dr._B._V._Kumar | Dr. B. V. Kumar]] & [[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Abhay_Bhargav | Mr. Abhay Bhargav]]''<br>
 
''[[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Dr._B._V._Kumar | Dr. B. V. Kumar]] & [[OWASP_NYC_AppSec_2008_Conference-SPEAKER-Abhay_Bhargav | Mr. Abhay Bhargav]]''<br>
−
[http://video.google.com/videoplay?docid=7304375845684390995 VIDEO] / SLIDES
+
[http://video.google.com/videoplay?docid=4488848043144792234&hl=en VIDEO] / SLIDES
 
|-
 
|-
 
| style="width:10%; background:#7B8ABD" | 19:00-20:00 || style="width:30%; background:#BC857A" align="center" |  
 
| style="width:10%; background:#7B8ABD" | 19:00-20:00 || style="width:30%; background:#BC857A" align="center" |  

Revision as of 22:02, 17 October 2008

2008 OWASP USA, NYC

Last Update: 10/17/2008

Our mission is to make application security "visible," so that people and organizations can make informed decisions about application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work. OWASP is like "public radio" so support our efforts join today as a corporate or individual member learn more CLICK HERE


SEE BELOW FOR VIDEO AND SLIDES - CLICK HERE FOR PHOTOS

Join the OWASP Linked'In Group

2008 OWASP USA, NYC Conference Schedule – Sept 24th - Sept 25th VIDEOS

Day 1 – Sept 24th, 2008

Track 1: BALLROOM Track 2: SKYLINE Track 3: TIMESQUARE
07:30-08:50 Doors Open for Attendee/Speaker Registration

avoid lines come early get your caffeine fix and use free wifi

09:00-09:45 OWASP Version 3.0 who we are, how we got here and where we are going?


OWASP Foundation: Jeff Williams, Dinis Cruz, Dave Wichers, Tom Brennan, Sebastien Deleersnyder
VIDEO / Dave Wichers's SLIDES

10:00-10:45 Analysis of the Web Hacking Incidents Database (WHID)

Ofer Shezaf
VIDEO / SLIDES

Web Application Security Road Map
Joe White
VIDEO / SLIDES

DHS Software Assurance Initiatives
Stan Wisseman & Joe Jarzombek
VIDEO / SLIDES

11:00-11:45

Http Bot Research
Andre M. DiMino - ShadowServer Foundation
VIDEO / SLIDES

OWASP "Google Hacking" Project
Christian Heinrich
VIDEO / SLIDES

MalSpam Research
Garth Bruen
VIDEO / SLIDES

12:00-13:00 Capture the Flag Sign-Up

LUNCH - Provided by event sponsors @ TechExpo

12:00-12:45

Get Rich or Die Trying - Making Money on The Web, The Black Hat Way
Trey Ford, Tom Brennan, Jeremiah Grossman
VIDEO / SLIDES

Framework-level Threat Analysis: Adding Science to the Art of Source-code review
Rohit Sethi & Sahba Kazerooni
VIDEO / SLIDES

Automated Web-based Malware Behavioral Analysis
Tyler Hudak
VIDEO / SLIDES

13:00-13:45

New 0-Day Browser Exploits: Clickjacking - yea, this is bad...
Jeremiah Grossman & Robert "RSnake" Hansen
VIDEO / SLIDES

Web Intrusion Detection with ModSecurity
Ivan Ristic
VIDEO / SLIDES

Using Layer 8 and OWASP to Secure Web Applications
David Stern & Roman Garber
VIDEO / SLIDES

14:00-14:45 Industry Outlook Panel:

Mark Clancy EVP CitiGroup,
Jim Routh CISO DTCC,
Sunil Seshadri CISO NYSE-Euronet,
Warren Axelrod SVP Bank of America,
Joe Bernik SVP, RBS,
Jennifer Bayuk Infosec Consultant,
Philip Venables CISO, Goldman Sachs,
Carlos Recalde SVP, Lehman Brothers,
Tom King CISO, Barclays Capital
Moderator: Mahi Dontamsetti VIDEO / SLIDES

Security Assessing Java RMI
Adam Boulton
VIDEO / SLIDES

JBroFuzz 0.1 - 1.1: Building a Java Fuzzer for the Web
Yiannis Pavlosoglou
VIDEO / SLIDES

15:00-15:45

OWASP Testing Guide - Offensive Assessing Financial Applications
Daniel Cuthbert
VIDEO / SLIDES

Flash Parameter Injection (FPI)
Ayal Yogev & Adi Sharabani
VIDEO / SLIDES

w3af - A Framework to own the web
Andres Riancho
VIDEO / VIDEO

16:00-16:45

OWASP Enterprise Security API (ESAPI) Project
Jeff Williams
VIDEO / SLIDES

Cross-Site Scripting Filter Evasion
Alexios Fakos
VIDEO / SLIDES

Multidisciplinary Bank Attacks
Gunter Ollmann
VIDEO / SLIDES

17:00-17:45

Open Discussion On Application Security
Joe Bernik & Steve Anton
VIDEO / SLIDES

Mastering PCI Section 6.6
Taylor McKinley and Jacob West
VIDEO / SLIDES

Case Studies: Exploiting application testing tool deficiencies via "out of band" injection
Vijay Akasapu & Marshall Heilman
VIDEO / SLIDES

18:00-18:45

Spearfishing and the OWASP Live CD Project
Joshua Perrymon
VIDEO / SLIDES

Coding Secure w/PHP
Hans Zaunere
VIDEO / SLIDES

Payment Card Data Security and the new Enterprise Java
Dr. B. V. Kumar & Mr. Abhay Bhargav
VIDEO / SLIDES

19:00-20:00

OWASP Chapter Leader / Project Leader working session
OWSAP Board/Chapter Leaders

(ISC)2 Cocktail Hour
All welcome to attend for a special announcement presented by:
W. Hord Tipton, Executive Director of (ISC)2

Technology Movie Night
Sneakers, WarGames, HackersArePeopleToo, TigerTeam
from 19:00 - 23:00

20:00-23:00+ OWASP Event Party/Reception
Event badge required for admission
Food, Drinks w/ New & Old Friends - break out the laptop and play capture the flag for fun and prizes.
Location: HOTEL BALLROOM


Day 2 – Sept 25th, 2008

08:00-10:00 BREAKFAST - Provided by event sponsors @ TechExpo
08:00-08:45

Software Development: The Last Security Frontier
W. Hord Tipton, CISSP-ISSEP, CAP, CISA, CNSS and former Chief Information Officer for the U.S. Department of the Interior Executive Director and member of the Board of Directors, (ISC)²
VIDEO / SLIDES

Best Practices Guide: Web Application Firewalls
Alexander Meisel
VIDEO / SLIDES

The Good The Bad and The Ugly - Pen Testing VS. Source Code Analysis
Thomas Ryan
VIDEO / SLIDES

09:00-09:45

OWASP Web Services Top Ten
Gunnar Peterson
VIDEO / SLIDES

Tiger Team - APPSEC Projects
Chris Nickerson
VIDEO / SLIDES]

OpenSource Tools
Prof. Li-Chiou Chen & Chienitng Lin, Pace Univ
VIDEO / SLIDES

10:00-10:45

Building a tool for Security consultants: A story of a customized source code scanner
Dinis Cruz
VIDEO / SLIDES

"Help Wanted" 7 Things You Need to Know APPSEC/INFOSEC Employment
Lee Kushner
VIDEO / SLIDES

Industry Analyst with Forrester Research
Chenxi Wang
VIDEO / SLIDES

11:00-11:45

CLASP (Comprehensive, Lightweight Application Security Process)
Pravir Chandra
VIDEO / SLIDES

Security in Agile Development
Dave Wichers
VIDEO / SLIDES

Secure Software Impact
Jack Danahy
VIDEO / SLIDES

12:00-12:45

Next Generation Cross Site Scripting Worms
Arshan Dabirsiaghi
VIDEO / SLIDES

Security of Software-as-a-Service (SaaS)
James Landis
VIDEO / SLIDES

Open Reverse Benchmarking Project
Marce Luck & Tom Stracener
VIDEO / SLIDES

12:00-13:00 Capture the Flag Status

LUNCH - Provided @ TechExpo

13:00-13:45

NIST SAMATE Static Analysis Tool Exposition (SATE)
Vadim Okun
VIDEO / SLIDES

Lotus Notes/Domino Web Application Security
Jian Hui Wang
VIDEO / SLIDES

Shootout @ Blackbox Corral
Larry Suto
VIDEO / SLIDES

14:00-14:45

Practical Advanced Threat Modeling
John Steven
VIDEO / SLIDES

The OWASP Orizon Project: towards version 1.0
Paolo Perego
VIDEO / SLIDES

Building Usable Security
Zed Abbadi
VIDEO / SLIDES

15:00-15:45

Off-shoring Application Development? Security is Still Your Problem
Rohyt Belani
VIDEO / SLIDES

OWASP EU Summit Portugal
Dinis Cruz
VIDEO / SLIDES

Code Secrets
Johan Peeters
VIDEO / SLIDES

16:00-16:45

Vulnerabilities in application interpreters and runtimes
Erik Cabetas
VIDEO / SLIDES

Cryptography For Penetration Testers
Chris Eng
VIDEO / SLIDES

Corruption
Dave Aitel
VIDEO / SLIDES

17:00-17:45 Event Wrap-Up / Speaker & CTF Awards and Sponsor Raffles
18:30-19:30 OWASP Foundation, Chapter Leader Meeting - to collect ideas to make OWASP better!

If you could not find it above... check CLICK HERE FOR VIDEOS

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_NYC_AppSec_2008_Conference&oldid=43572"