This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Spain/Agenda Chapter Meeting"
Line 77: | Line 77: | ||
<td bgcolor="white" valign="top" align="center" height=75px width=80px>[[image:MiguelHernandez-80.png|80px]]</td> | <td bgcolor="white" valign="top" align="center" height=75px width=80px>[[image:MiguelHernandez-80.png|80px]]</td> | ||
<td bgcolor="#d5deed" align="center" valign="top" width=110px>14:30h - 15:30h</td> | <td bgcolor="#d5deed" align="center" valign="top" width=110px>14:30h - 15:30h</td> | ||
− | <td bgcolor="#d5deed" align="justify" valign="top"><i><b>Abuse Cases – from scratch to the hack</b></i><br>Miguel Ángel Hernández Ruíz. - Twitter: [http://www.twitter.com/miguelangelher @miguelangelher]<br>Security Specialist. [http://www.sopra.es Sopra | + | <td bgcolor="#d5deed" align="justify" valign="top"><i><b>Abuse Cases – from scratch to the hack</b></i><br>Miguel Ángel Hernández Ruíz. - Twitter: [http://www.twitter.com/miguelangelher @miguelangelher]<br>Security Specialist. [http://www.sopra.es Sopra Group].<br> |
Firstly this talk offers the motivations on why it is necessary a mechanism to detect possible business logic flaws. | Firstly this talk offers the motivations on why it is necessary a mechanism to detect possible business logic flaws. | ||
Revision as of 12:38, 15 May 2015
Barcelona, 12 de junio de 2015
AGENDA de la jornada:
09:00h - 09:55h | Registro de asistentes | |
10:00h - 10:05h | Bienvenida Josep Maria Ribes. Director d'Enginyeria de La Salle Campus Barcelona. |
|
10:05h - 10:15h | Introducción a la jornada Vicente Aguilera Díaz. vicenteaguileradiaz.com - Twitter: @VAguileraDiaz. OWASP Spain Chapter Leader. Socio y Director Dpto. Auditoría en Internet Security Auditors. |
|
10:15h - 11:15h | TBD TBD. TBD TBD |
|
11:15h - 11:45h | TBD TBD. TBD. TBD |
|
11:45h - 12:45h | Pruebas de seguridad contínuas para DevOps Stephen De Vries. - Twitter: @stephendv. Chief Technology Officer. Continuum Security. Las prácticas de despliegue contínuo (CD) y DevOps están revolucionando el proceso de desarrollo y de negocio. Las prácticas de seguridad y, sobre todo, las pruebas de seguridad, tendrán que adaptarse a este nuevo mundo. Durante este charla se proponen unos métodos para automatizar las pruebas de seguridad para que encajan en un proceso de despliegue contínu sin interrumpir el proceso. La presentación incluirá los siguientes aspectos:
|
|
12:45h - 13:15h | TBD TBD. TBD. TBD |
|
14:30h - 15:30h | Abuse Cases – from scratch to the hack Miguel Ángel Hernández Ruíz. - Twitter: @miguelangelher Security Specialist. Sopra Group. Firstly this talk offers the motivations on why it is necessary a mechanism to detect possible business logic flaws. After that, the next slides present a short story about a developer and a hacker and how the last one is able to find out vulnerabilities even when all security bugs have apparently been fixed. Using the lessons learnt from the previous story, a summary on what we are exactly looking for is performed, introducing the abuse case concept and performing a comparison between use cases and abuse cases. In fourth place the main point of the conference is introduced. A methodological approach to an abuse cases solution is presented as the way to properly drive the business logic vulnerabilities detection. The subsequent slides present how to apply the explained approach to a real scenario regarding the application involved in the hackers’ story previously mentioned. A live approach to the application is performed in the first part of this section and a live hack of the business logic is shown at the end. Finally, the most important challenges to face and the most relevant benefits of using abuse cases as a testing tool are offered. |
|
15:30h - 16:00h | TBD TBD. TBD. TBD |
|
16:00h - 17:00h | TBD TBD. TBD. TBD |
|
17:00h - 17:30h | TBD TBD. TBD |
|
17:30h - 18:00h | Mesa redonda (ponentes e invitados) . |
Si desea participar como ponente, consulte la sección Call for Papers.
Twitter: @OWASPSpain
Hashtag de la jornada: #OWASPSpain9