This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Summit 2011

From OWASP
Revision as of 01:22, 15 November 2010 by Tara Causey (talk | contribs)

Jump to: navigation, search


Welcome

OWASPGlobalSummitLogo-3THISONEHASTHEMOSTVOTESSOFAR.jpg

Dear OWASP Leaders and appsec community,


The Summit will be held February 8th-11th in (Cascais) Lisbon, Portugal. This will be the place where appsec experts meet, discuss, work, socialize, and set the roadmap for OWASP in coming years.

The Summit Activates *You*

Whereas the OWASP AppSec conferences are great places to listen to interesting talks, go for training, and meet with OWASP people, the Global Summit is the place where we all sit down together and take the time to discuss and work out plans, projects and solutions for the appsec future.

Examples of topics:

  • How should we support the OWASP projects?
  • How can we work with browser vendors to enhance security (see "Browser Day" tab above)?
  • How should the community reach out to developers and education institutions?
  • How often should we publish the OWASP Top 10?
  • How can OWASP support your chapter?

Organizing Committee

Lorna Alamri, Brad Causey, Justin Clarke, Paulo Coimbra, Dinis Cruz, Martin Knobloch, Dave Wichers, John Wilander, Jason Li, Tara Causey, Sarah Baso .

Who's Invited?

As an OWASP leader you are automatically invited to the summit, but we also welcome leading experts from industry and academia. Together we can create a more secure web. Check the "How Do I Join?" tab above for more info.


Operational guidelines

Following the first meeting of the Summit 2011 Organizational team, here are the current proposed operational guidelines:

  1. the summit is an annual event
  2. outside OWASP conference
  3. the summit should take place in January not later then begin of February
  4. the summit takes 3 to 4 days
  5. budget aim is US$ 150'000 US$ where 50'000 from OWASP and US$100'000 from sponsors
  6. attendees targets are:
    1. OWASP Funded:
      1. Board
      2. Committee Members
    2. Chapter / sponsor Funded:
      1. Chapter Leaders
    3. Project Leaders
  7. venue / location criteria (no decision on the venue)
    1. 1 key organizer in close contact with the venue
    2. hosting 30 to 100 people
    3. US$2'000 a head (flight/accommodation/food/beers)
    4. conference facilities
      1. multiple meeting rooms
      2. one big meeting room e.g. auditorium
      3. hotel with the conference facilities or conference venue within walking distance
      4. apartments if possible (to share apartments/rooms and save money)
      5. 4 to 5 star hotel
      6. local food supplier for apartment crashing
      7. has to be negotiated with the hotel
      8. max 50 km's form international airport
      9. sufficient Internet access!

Success factors (what indicates the summit as success)

  1. break even
  2. the summits are the place to go to discus about and working on Web Application Security
  3. review of the past year
  4. working sessions on committees, projects and industry sectors (e.g. browsers and frameworks)
    1. universities / education sessions
    2. committee member election
    3. board election
    4. strategic OWASP issues
    5. road map and action plans for the next 12 month

Other local Summit(s):

  • The conferences are free to organize small, conference bound summit
  • this are not sponsored by OWASP of OWASP summit budget


Agenda (draft)

Browser Day

One of the great challenges of application security is browser security. The browser is becoming our de facto runtime platform for applications and it comprises a whole ecosystem of plugins and web technologies.Therefore we will spend a full day working together with the leading browser vendors to penetrate current problems, new ideas, and how security fits in alongside other requirements from developers and endusers.Do not miss this chance to influence what's important in browser security in the coming years.

  • Sandboxing. Is sandboxing the right way forward? Can sandboxing be harmonized with the origin policies for cookies, scripting, and ajax – i e share the same compartmentalization? How should we apply sandboxing to plugins?
  • Securing plugins. Should browsers ship with default plugins? Should plugins be auto-updated? Can plugins or versions of plugins be blacklisted centrally?
  • Enduser warnings. How should browsers signal invalid SSL certs to the enduser? Are we helping security right now? What to do about 50 % of users clicking through warnings?
  • Blacklisting. Can we cooperate better on blacklisting? Does it work between cultures, i e can we have the same process for reporting throughout the world?
  • OS integration. More and more features in browsers get integrated with the underlying operating system. Processes, fonts, filesystem, 3D graphics. How do we secure this?
  • JavaScript. How do we secure the universally deployed web application language? Much focus has been on execution performance but what about security? Will EcmaScript 5 strict-mode be supported anytime soon (currently no support)? Are (more) secure "dialects" such as FBJS and Caja the way to go? What's happening in EcmaScript Harmony?
  • New HTTP headers. Are new opt-in HTTP headers the right way to add security features? For example Strict Transport Security, x-frame-options, origin and Content Security Policy.

XSS Eradication

We will have a half day working session on Cross Site Scripting - specifically how OWASP can make 2011 the year of XSS... going away. How we help bring this about through contributing our knowledge to cornerstone projects, how we can raise the awareness through advocacy, and what we can do to ensure that OWASP and other freely available resources and made available to the wider community, and that they are aware of them.

Enterprise Web Defense Roundtable

How are enterprises defending web applications. Discussion of best practices, effective methods, and new ideas to enhance web application defense. (Session Leader: Michael Coates, Mozilla)

University Outreach

This summit will be the place to bring OWASP Educational Supporters together! What security major and minor educations are out there? How can OWASP participate and influence their curricula? How can the relationship between Universities and OWASP be standardized? What does OWASP have to offer Universities and what can they, in turn, expect from each other?

OWASP Projects

We will have a session on how OWASP should support, grow, and manage projects. This includes:
-Assessment criteria
-Orphaned projects
-Funding
-Marketing
-Commercial services


OWASP Around the World

OWASP is a fast growing global community. How should we support and manage this growth? During this session we'll look into issues of:

More Topics

You know how OWASP works – it's all up to you. Please edit this tab and enter topics we should cover during the Global Summit 2011! If you want you can add your name after each suggestion and we can work out the details with you.

  • Discussion on Douglas Crockford's bold statement that we should stop HTML5 development, fix XSS, and then start over. Is he right? How is OWASP active in the HTML5 development? Check this webcast, jump to 20:50 to hear the XSS part. /John Wilander
  • [Your topic here]

How Do I Join? / Mailing list

As an OWASP leader you are automatically invited to the summit.

The first thing to do is to join the Summit 2011 mailing list.

On the mailing list you'll get first hand information on how to register, exact dates, updates to the agenda, funding for your trip etc.

If you are a leading appsec expert from industry or academia but not yet an OWASP leader you can just contact John.Wilander at owasp.org and we'll try to get you in.

Social Events

It goes without saying – the summit is all about meeting people. So there will be a constant mixture of workshops, dinners, beers and wine. We like to think of the summit as a very social event in itself.

Venue

A Day in Lisbon, Portugal:

Cascais2.jpg

Click this link to see all the City of Lisbon has to offer, which is only a short train ride from the resort.
http://www.golisbon.com/portugal/cities/cascais.html
or
http://www.travel-in-portugal.com/Cascais/
Lisbon - Spreading out along the right bank of the Tagus, its downtown, the Baixa, is located in the 18th-century area around Rossio. East of the arcade Praça do Comércio, are the medieval quarters of Alfama and Mouraria, crowned by the magnificent St. George's Castle. To the west lie Bairro Alto and Madragoa, with their typical streets, and on the western extreme is Belém, with its Belém Tower, (the sentinel over the Tagus river that protects the entrance into Lisbon), the Jerónimos Monastery (masterpieces of Manueline architecture and classified in UNESCO's International Heritage list) and the Cultural Center of Belém.
Museums:
Ancient Art, Chiado (Contemporary Art), Tile, Archaeology, Ethnology, Coach, Costume, Theater, Maritime, Military, City, Gulbenkian, Modern Art Center, and the Ricardo Espirito Santo Silva Foundation. Palaces open to the public: Ajuda and Fronteira. Churches: Cathedral (with Treasury); São Vicente de Fora; Conceição Velha (Manueline), São Roque and Sacred Art; Madre Deus; Santa Engrácia Pantheon (Baroque), and the Estrela Basilica.
Shopping: Downtown; Avenida de Roma, Praça de Londres, Avenida Guerra Junqueiro, and Amoreiras.
Nightlife: Bairro Alto and Avenida 24 de Julho.
Guided Tours


Sponsoring

We will welcome a few sponsors of this very special event, typically organization that participate in the summit. If you are interested in supporting the global summit, please contact Lorna.Alamri at owasp.org.


Attendees that qualify to be sponsored by OWASP
Some leaders that are active within OWASP may qualify to have all or partial transportation and lodging paid for by OWASP.
To be considered for qualification, you must meet one or more of the following criteria:

  1. Member of the OWASP Board
  2. Active member of a Global Committee (as determined by the OWASP Board)
  3. Operational personnel that are necessary for the operation of the Summit

Current sponsorship budget is $50,000 for the Summit.

If you feel you might qualify, please contact Brad Causey or Jason Li. If you do not meet these criteria, and still feel that you should be sponsored, please contact Brad Causey @ or Jason Li @


Applying for Chapter or Project Sponsorship

Application for OWASP Chapter or Project Funding

WorkflowProcesstoApplyforChapterorProjectFunding.png


Confirmed Summit Attendees

Dinis Cruz (Board)
Tom Brennan (Board)
Eoin Keary (Board)
Jeff Williams (Board)
Seba Deleersnyder (Board)
Dave Wichers (Board)
Matt Tesauro (Board)
Paulo Coimbra (OWASP)
Alison Shrader (OWASP)
Kate Hartmann (OWASP)
Larry Casey (OWASP)


Letters and Summit Materials

Summit 2011 Presentation for AppSec DC
Application for OWASP Chapter or Project Funding

Template Letter - 2011 Global Summit Basic Invitation
Template Letter - 2011 Global Summit University Outreach Invitation
Template Letter - 2011 Global Summit Government Invitation
Template Letter - 2011 Global Summit Request for Employer Funding and Sponsorship
Template Letter - 2011 Global Summit Request for Employer Funding, Version 2

Schedule (Draft)

Agenda for Tuesday, February the 8th, 2011
0900 - 1000
Registration, Meet & Greet

Training Sessions
15:00 - 17:00 Securing WebGoat with ModSecurity
Stephen Craig Evans
WebSec Apps for Managers and Executives
Video
Mano Paul
OWASP Testing Guide
Matteo Meucci
OWASP Testing Guide
Matteo Meucci
15:00 - 17:00 Securing WebGoat with ModSecurity
Stephen Craig Evans
WebSec Apps for Managers and Executives
Video
Mano Paul
OWASP Testing Guide
Matteo Meucci
15:00 - 17:00 Securing WebGoat with ModSecurity
Stephen Craig Evans
WebSec Apps for Managers and Executives
Video
Mano Paul
OWASP Testing Guide
Matteo Meucci
19:00 Summit Briefing
Dinis Cruz and Summit Organization Team
20:00 Dinner


Agenda for Tuesday, November 4th, 2008
08:00 Registration
09:00 Summit Keynote
Dinis Cruz and Summit Organization Team

Documents Tools
09:30 OWASP Testing Guide - SoC 08
PowerPoint Presentation
Matteo Meucci
OWASP JSP Testing Tool - SoC 08
Jason Li
09:45 OWASP Code Review Project - SoC 08
PowerPoint Presentation
Eoin Keary
OWASP Orizon Project - SoC 08
PowerPoint Presentation
Paolo Perego
10:00 OWASP Application Security Desk Reference - SoC 08
Leonardo Cavallari Militelli
OWASP Live CD - SoC 08
Matt Tesauro
10:15 OWASP Spanish Project - SoC 08
Juan Carlos Calderon
OWASP WebScarab Project
PowerPoint Presentation
Rogan Dawes
10:30 Coffee Break
10:45 .NET ESAPI
Alex Smolen

11:00 Working Sessions Briefing
Dinis Cruz

Working Sessions

11:15 - 13:00 Documentation Projects/Guides Integration and Unified 4.0 Version
WS Conclusions
Eduardo Neves
OWASP Intrinsic Security Working Group - Browser Security
Arshan Dabirsiaghi
Tools Projects
WS Conclusions
Matt Tesauro
13:00 Lunch

Training Sessions
14:00 The Art and Science of Threat Modeling Web Applications
Video
Mano Paul
Web Server Hardening SELinux
PDF Presentation
Pavol Luptak
Offensive WebApp Hacking
Video - LDAP, XML and SQL injection
Video - LDAP injection demo
XML injection demo
Video - SQL injection demo
Marco Slaviero
15:00 Phishing attack
Video
Matt Teasuro & Brad Causey
Clickjacking
Video
Demonstration
Arshan Dabirsiaghi
16:00 Coffee Break

Working Sessions
16:30 OWASP Enterprise Security API Project (ESAPI)
Video
WS Conclusions
Jeff Williams
18:30 OWASP Application Security Desk Reference - ASDR
Leonardo Cavallari
.NET Project
Dinis Cruz


Agenda for Wednesday, November 5th, 2008
09:15 Daily Briefing
Dinis Cruz

Standards and Education Tools
10:00 OWASP Positive Security Project - SoC 08
Eduardo Neves
OWASP Access Control Rules Tester - SoC 08
PowerPoint Presentation
Andrew Petukhov
10:15 OWASP Education Project - SoC 08
Sebastien Deleersnyder, Martin Knobloch
OWASP Teachable Static Analysis Workbench - SoC 08
PowerPoint Presentation
Dmitry Kozlov
10:30 OWASP Internationalization Project - Soc 08
Juan Carlos Calderon
OWASP AppSensor - SoC 08
PowerPoint Presentation
Michael Coates
10:45 PASSWD Project: Metrics and Vulnerabilities
PowerPoint Presentation
Lucilla Mancini
OWASP Backend Security Project - SoC 08
PowerPoint Prsentation
Carlo Pelliccioni
11:00 OWASP Open Review Project
Dan Cornell
OWASP Application Security Tool Benchmarking Environment and Site Generator Refresh Project - SoC 08
PowerPoint Presentation
Dmitry Kozlov
11:15 OWASP Global Committee Elections
11:30 Coffee Break

Working Sessions
12:45 Education Project
WS Conclusions
Sebastien Deleersnyder
Testing Guide
Matteo Meucci
Web Application Framework Security
Arshan Dabirsiaghi
14:45 Lunch (During Working Sessions)

Training Sessions
15:00 Flash Player Security
Peleus Uhley
OWASP Top 10
Video
Sebastien Deleersnyder and Martin Knobloch
Uncovering WebScarab's Secret Treasures
PowerPoint Presentation
Rogan Dawes
Hacking the Orizon
PowerPoint Presentation Training Sessions
Paolo Perego
17:00 Coffee Break

Working Sessions
17:30 Code Review Guide
Eoin Keary
EU Funding for OWASP Projects
Carlos Serrao
OWASP Certification
Tom Brennan
Software Assurance Maturity Model
Pravir Chandra
19:00 OWASP Website
WS Conclusions
PPT Presentation
Fabio Cerullo
Metrics & Vulnerabilities
Word Presentation
Lucilla Mancini
OWASP Orizon
Paolo Perego


Agenda for Thursday, November 6th, 2008
09:15 Daily Briefing
Dinis Cruz

Technology Tools
10:00 OWASP Classic ASP Security Project - SoC 08
Juan Carlos Calderon
OWASP Source Code Review - SoC 08
PowerPoint Presentation
James Walden
10:15 OWASP Ruby on Rails Security Project - SoC 08
PDF Presentation
Heiko Webers
OWASP OpenPGP Extensions for HTTP - Enigform and mod openpgp - SoC 08
Arturo Alberto Busleiman
10:30 OWASP Webslayer Project
Christian Martorella
OWASP Securing WebGoat using ModSecurity Project - SoC 08
Stephen Evans and Christian Folini
11:00 OWASP Skavenger Project - SoC 08
Matthias Rohr
OWASP AntiSamy Project - SoC 08
Marcin Wielgoszewski
11:15 Coffee Break

Working Sessions
11:30 OWASP Top 10 - 2009
Dave Wichers
OWASP Intra Governmental Affairs
David Campbell
SAMM v2 OWASP Website
Fabio Cerullo
Handling Web MalWare
13:00 Lunch (During Working Sessions)

Training Sessions
14:00 Ajax Security Auditing Flash Applications
Peleus Uhley
WebApp Assessment
Vicente Aguilera Diaz
Mod Security
Lucas C. Ferreira

Working Sessions
16:30 OWASP Strategic Planning and Business Models compatible with OWASP values
Jeff Williams, Dinis Cruz, Dave Wichers, Sebastien Deleersnyder, Tom Brennan & Kate Hartmann and Paulo Combra
18:30 Two-way Internationalization of OWASP Content
Juan Carlos Calderon & Sebastien Deleersnyder
OWASP Best Practices for Chapter Leaders
WS Conclusions
Georg Hess
OWASP Live CD & DVD
Matt Tesauro
20:00 Gala Dinner
22:00 OWASP Band


Agenda for Friday, November 7th, 2008
10:00 Daily Briefing
Dinis Cruz
10:15 OWASP AppSec Agenda 2009: Working Session Outcomes

Documentation Projects/Guides Integration and Unified 4.0 Version
Eduardo Neves

Browser Security
Arshan Dabirsiaghi

ESAPI
Jeff Williams

Tools Projects
Matt Tesauro

Code Review Guide
Eoin Keary

OWASP Certification
Tom Brennan

Software Assurance Maturity Model
Pravir Chandra

Top 10 2009
Dave Wichers

Intra Governmental Affairs
David Campbell

Best Practices for Chapter Leaders
Georg Hess
11:15 Coffee Break and Vote (put your dots on the wall)
11:30 Live CD & DVD
Matt Tesauro

ADSR
Leonardo Cavallari

Education Project
Sebastien Deleersnyder

Web Application Framework Security
Arshan Dabirsiaghi

Testing Guide
Matteo Meucci

OWASP Censorship
Tom Brennan

EU Funding for OWASP Projects
Carlos Serrao

OWASP Website
Fabio Cerullo

OWASP Orizon
Paolo Perego

Handling Web MalWare

2-Way Internationalization
Juan Carlos Calderon

Portuguese Public & Private Organizations
Carlos Serrao

Winter of Code 2009
Dinis Cruz and Sebastien Deleersnyder
13:00 Lunch
14:00 Board Meeting
17:00 Announcement of Summit Procedings