This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Summit 2011 Working Sessions"

From OWASP
Jump to: navigation, search
Line 6: Line 6:
 
Click on the working session name to see more details about that particular session. During the Summit these working session pages will be used to document discussions and outcomes.
 
Click on the working session name to see more details about that particular session. During the Summit these working session pages will be used to document discussions and outcomes.
 
<br>
 
<br>
==Track 1: Browser Security==
+
==[[:Working Sessions Browser Working Group|Track 1: Browser Security]]==
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Summit_2011_Working_Sessions/Session001 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session001 | Summit_2011_Working_Sessions/Rows}}
Line 19: Line 19:
 
|}
 
|}
  
==Track 2: Cross-Site Scripting Eradication==
+
==[[:Working Sessions XSS Eradication|Track 2: Cross-Site Scripting Eradication]]==
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Summit_2011_Working_Sessions/Session009 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session009 | Summit_2011_Working_Sessions/Rows}}
Line 30: Line 30:
 
|}
 
|}
  
==Track 3: University Outreach, Education, and Training==
+
==[[:Working Sessions University Outreach|Track 3: University Outreach, Education, and Training]]==
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Summit_2011_Working_Sessions/Session012 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session012 | Summit_2011_Working_Sessions/Rows}}
Line 40: Line 40:
 
|}
 
|}
  
==Track 4: No Fluff, Just Stuff==
+
==[[:Working Sessions No Fluff Just Stuff|Track 4: No Fluff, Just Stuff]]==
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Summit_2011_Working_Sessions/Session025 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session025 | Summit_2011_Working_Sessions/Rows}}
Line 57: Line 57:
 
{{:Summit_2011_Working_Sessions/Session038 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session038 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session039 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session039 | Summit_2011_Working_Sessions/Rows}}
 
 
  
 
|}
 
|}
  
==Track: OWASP==
+
==[[:Working Sessions Global Committees|Track: OWASP]]==
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Template:Summit_2011_Working_Sessions/Columns}}
 
{{:Summit_2011_Working_Sessions/Session013 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session013 | Summit_2011_Working_Sessions/Rows}}
Line 71: Line 69:
 
{{:Summit_2011_Working_Sessions/Session018 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session018 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session019 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session019 | Summit_2011_Working_Sessions/Rows}}
 +
|}
 +
 +
 +
==Track: To Be Determined==
 
{{:Summit_2011_Working_Sessions/Session020 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session020 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session021 | Summit_2011_Working_Sessions/Rows}}
 
{{:Summit_2011_Working_Sessions/Session021 | Summit_2011_Working_Sessions/Rows}}

Revision as of 23:14, 13 December 2010

Return to the Global Summit 2011 Home Page
Return to the Global Summit 2011 Schedule


Click on the working session name to see more details about that particular session. During the Summit these working session pages will be used to document discussions and outcomes.

Track 1: Browser Security

Name of Working Session Objective(s) Outcome(s) / Deliverable(s) Owner/Leader Members/Attendees
view
edit
DOM Sandboxing
  1. Attenuated versions of existing apis to sandboxed code.
  2. Client side sandboxed apps maintaining state and authentication.
  3. Create a standard for modifying a sandboxed environment
  4. Deprecate and discourage standards which ambiently or undeniably pass credentials.
  5. Create a standard for authentication within a sandboxed environment (maybe interfacing with existing auth without passing creds like 0Auth works)
  1. Browser Security Report
  2. Browser Security Priority List
Jasvir Nagra
Gareth Heyes @
Email John Wilander if you are unable to edit the Wiki and would like to sign up! @

Michael Coates

Eduardo Vela @

Stefano Di Paola

Isaac Dawson

Chris Eng @

Alexandre Miguel Aniceto @

view
edit
HTML5 Security
  1. Handle autofocus in a unified and secure way.
  2. Discuss necessity and capability for the HTML5 form controls.
  3. Initiate and create documentation and references for developers that address security issues.
  4. Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags.
  5. Long Term Goal(s): Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier.
  1. Browser Security Report
  2. Browser Security Priority Report
Mario Heiderich
Gareth Heyes @
John Wilander @

Michael Coates @

Tony UcedaVelez @

Stefano Di Paola

Isaac Dawson

Chris Eng @

Nishi Kumar @

Elke Roth-Mandutz @

Giorgio Fedon

Paolo Perego @

Eduardo Vela @

Abraham Kang @

Nuno Loureiro @

Alexandre Miguel Aniceto @

view
edit
EcmaScript 5 Security
  1. Fix the problems with Object.defineProperty() and property unsealing / double-freezing.
  2. Raise awareness for the power or object freezing in a security context.
  3. Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented.
  4. Long Term Goal: Discuss the possibility of vendor supported client side security mechanisms.
  1. Browser Security Report
  2. Browser Security Priority List
Mario Heiderich
TBC
John Wilander @

Michael Coates @


Stefano Di Paola

Isaac Dawson

Abraham Kang

Gareth Heyes

view
edit
Enduser Warnings
  1. Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.
  1. Browser Security Report
  2. Browser Security Priority List
John Wilander @

John Wilander @

Michael Coates @


Vishal Garg @

view
edit
Site Security Policy
  1. Browser Security Report
  2. Browser Security Priority List
John Wilander @
Michal Coates @
John Wilander @

Michael Coates @


Stefano Di Paola

Tobias Gondrom @

Alexandre Miguel Aniceto @

view
edit
Securing Plugins
  1. Browser Security Report
  2. Browser Security Priority List


John Wilander @

Michael Coates @

Giorgio Fedon

view
edit
Blacklisting
  1. Browser Security Report
  2. Browser Security Priority List


John Wilander @

Michael Coates @

view
edit
OS Integration
  1. Browser Security Report
  2. Browser Security Priority List


John Wilander @

Michael Coates @

view
edit


Track 2: Cross-Site Scripting Eradication

Name of Working Session Objective(s) Outcome(s) / Deliverable(s) Owner/Leader Members/Attendees
view
edit
XSS and the Frameworks
  1. Work on how OWASP can engage with the major web frameworks to move towards a "secure by default" stance
  2. Work on OWASP resources to provide patches/design approaches in conjunction with the frameworks
  1. OWASP statement/Press release to publicly ask the frameworks to build security in
  2. Engagement plan on how we'd work with (if at all) a framework to get ESAPI or similar functionality integrated
  3. White paper or standard for what we want the web frameworks to provide in terms of XSS defenses. Turning the XSS Prevention Cheat Sheet into a standard/metric for frameworks would be great.
  4. OWASP Standard defining an appraisal methodology for a framework’s XSS prevention capability based on the other deliverable.
Justin Clarke @

Chris Eng @

Abraham Kang

Tony UcedaVelez @

Fred Donovan @

Juan Jose Rider @

view
edit
XSS - Awareness, Resources, and Partnerships
  1. Work on what partners we can reach, and what resources they can provide us access to
  2. Work on who we can work with to reach a maximum amount of developers writing web applications
  3. Plan engagement with identified organizations
  4. Plan a call to action for OWASP chapters for identified XSS resources
  1. A concrete, specific business plan for investing OWASP Funds in a campaign designed to ensure that every developer knows about XSS and what to do to prevent it. The plan should have specific goals, measures, and targets over time so we know if it is on track.
Justin Clarke @

Chris Eng @

Abraham Kang

Sherif Koussa @

view
edit
WAF Mitigations for XSS
  1. Improve XSS Attack Payload Detection Techniques
  2. Identifying Improper Output Handling Flaws in Web Apps
  3. Feasibility of Profile Page Scripts/Iframes
  4. Testing Injection of JS Sandbox Code in Responses
  1. White paper describing “Next Generation WAF Capabilities” such as the ones described above. Include areas requiring additional research and funding.
Ryan Barnett @

Lucas C. Ferreira @

Achim Hoffmann @

Justin Clarke @

Giorgio Fedon

Abraham Kang

Mario Heiderich

Gareth Heyes

Eduardo Vela @

Stefano Di Paola

David Lindsay

Juan Jose Rider @

view
edit


view
edit



Track 3: University Outreach, Education, and Training

Name of Working Session Objective(s) Outcome(s) / Deliverable(s) Owner/Leader Members/Attendees
view
edit
University Outreach
  1. Estimation of Security prorams currently exist in university settings around the world
  2. How can OWASP participate and influence the curricula of these educational programs?
  3. How can we foster relationships between OWASP and universities?
  4. How can the relationship between OWASP and universities be standardized?
  5. What can OWASP offer universities and what can they, in turn, expect from each other?
  1. A study with facts, numbers, and other metrics about application secuirity in academia. The OWASP Academic State of the World.
  2. A white paper with strategies for infiltrating academia with our priorities.
Martin Knobloch @

Nishi Kumar @

Cecil Su @

Elke Roth-Mandutz @

Heiko Richler @

Lucas C. Ferreira @

Jason Taylor @

Carlos Serrão @

Konstantinos Papapanagiotou @

Mateo Martinez @

L. Gustavo C. Barbato @

Edward Bonver @

Ricardo Melo @

Alexandre Agustini @

view
edit
OWASP Academies
  1. Presentation of the discussion had in January – what were we looking for, what conclusions were reached and why;
  2. The OWASP Academic Portal Project – what is it, advantages, contributors, roadmap;
  3. Alternative ways of working with Universities when possible – Summer School proposal (ISCTE);
  4. OWASP Appsec Tutorial Series – How to best disseminate it and use it.
  1. Deliver the above as a fundable business plan complete with financial and resource requirements, timelines, metrics, etc…
Sandra Paiva @

Martin Knobloch @

Paulo Coimbra @

Dinis Cruz @

Nishi Kumar @

Cecil Su @

Heiko Richler @

Lucas C. Ferreira @

Jason Taylor @

Mateo Martinez @

Konstantinos Papapanagiotou @

Carlos Serrão @

Matteo Meucci @

Elke Roth-Mandutz @

Daniel Brzozowski @

L. Gustavo C. Barbato @

Ricardo Melo @

Alexandre Agustini @

view
edit
OWASP Training
  1. Presentation of the OWASP Training Model;
  2. How to keep the initiative alive – people, methodologies, contents, materials;
  3. Trainers Database – assessment of quality;
  4. Connection with the Paid Training Model;
  5. Set up a strategy to apply for currently available state European funding.
  1. Deliver the above as a fundable business plan complete with financial and resource requirements, timelines, metrics, etc…
  2. Team and Model to apply for currently available state European funding.
Sandra Paiva @

Martin Knobloch @

Paulo Coimbra @

Dinis Cruz @

Nishi Kumar @

Cecil Su @

Heiko Richler @

Lucas C. Ferreira @

L. Gustavo C. Barbato @

Jason Taylor @

Achim Hoffmann @

Mark Bristow @

Mateo Martinez @

Carlos Serrão @

Konstantinos Papapanagiotou @

Vishal Garg @

Matteo Meucci @

Jeremy Long @

Seba Deleersnyder @

Ralph Durkee @

Ricardo Melo @

view
edit
Developer's Security Training Package
  1. To create an organized package that can be used by companies for the purposes of educating developers on securely coding web applications and web services
  1. A curriculum for the above based on OWASP materials and a plan to build it out.
Brad Causey @

Martin Knobloch @

Nishi Kumar @

Jason Taylor @

Carlos Serrão @

Konstantinos Papapanagiotou @

Daniel Brzozowski @

L. Gustavo C. Barbato @

Keith Turpin @

Ralph Durkee @

Mikko Saario @

Ricardo Melo @

Mateo Martinez @

Tobias Gondrom @

Alexandre Agustini @

Sherif Koussa @


Track 4: No Fluff, Just Stuff

Name of Working Session Objective(s) Outcome(s) / Deliverable(s) Owner/Leader Members/Attendees
view
edit
Applying ESAPI Input Validation
  1. Serial Decomp: Decode, canonicalize, filter
  2. Structured data (SSN, CC, etc.)
  3. Unstructured data (comments, blogs, etc.)
  4. Other input exaples (ws-, database, etc.)
  1. A clear and concise user guide for getting ESAPI input validation up and running.
Chris Schmidt @

Nishi Kumar @


Justin Clarke @

John Steven @

view
edit
Defining AppSensor Detection Points
  1. Understand AppSensor Fundamentals
  2. Define AppSensor Detection Points applicable to most applications
  3. Implement detection points into code
  1. Status of AppSensor Whitepaper including AppSensor Roadmap
  2. Updated AppSensor-Tutorial code with new lessons and lesson structure enhancements
  3. Updated Getting Started Guide for new adopters and developers leveraging feedback from session
Michael Coates @

Ryan Barnett @

Colin Watson

Chris Schmidt @

view
edit
Contextual Output Encoding
  1. Increase coverage and functionality of existing Output Encoding Codecs
  2. Create new codecs to cover more output encoding contextual needs
  3. Introduce these codecs in a way that doesn't interfere with ESAPI Modularization Tasks
  4. Draft an implementation guide for Application Framework Developers to implement ESAPI Output Encoding into their Application Frameworks
  1. Increase coverage and functionality of existing Output Encoding Codecs
  2. New drop in set of codecs for the ESAPI Encoder to use for additional contexts
  3. Implementation Guide for Framework Developers to integrate Output Encoding into their Application Framework. This should be a simple guide that can be distributed en masse to framework developers as a push to get them involved in making their frameworks more secure by eliminating XSS.
Chris Schmidt @

Justin Clarke @

Abraham Kang

view
edit
Protecting Information Stored Client-Side
  1. Produce an informal threat model for each development scenario
  2. Impart clear and simple shared understanding of threats associated with each development scenario (and dispel common misunderstandings/idioms)
  3. Define solution that resists defined attacks
  4. Deliver solution implementation (snippets) to https://code.google.com/p/secure-coding-workshop/
  1. (see objectives) Threat Models
  2. (see objectives) Code Snippets
  3. Plan and Extra-summit work-items for exercises in Phone and RIA contexts during next summit
John Steven @

Elke Roth-Mandutz @

Jim Manico @

Chris Schmidt @

Justin Clarke @

Neil Matatall @

Tony UcedaVelez @

Fred Donovan @

Alexandre Miguel Aniceto @

Antonio Fontes @

view
edit
Protecting Against CSRF
  1. A practical guideline for protecting against CSRF in the real world.
  2. A concise, clear standard for determining whether an application is vulnerable to CSRF.


Chris Schmidt @

Achim Hoffmann @

Ryan Barnett @

Mark Thomas @

Vishal Garg @

view
edit
Providing Access to Persisted Data
  1. Create design and code examples for protecting access to database tables and rows by role
  2. Create design and code examples for protecting access to data when 'auto-wiring' and marshalling
  3. Create design and code examples for protecting sensitive data at rest
  1. A short reference architecture/coding examples type of guideline that clearly explains positive and negative examples of accessing persisted data.
Dan Cornell @

Chris Schmidt @

Justin Clarke @

Dan Cornell @

John Steven @

Ralph Durkee @

Alexandre Miguel Aniceto @

view
edit
The Future of the OWASP Secure Coding Workshop
  1. Determine how to scale the idea
  2. Determine how to get funding for it
  3. Schedule at least two following OWASP Secure Coding Workshop days in 2011
  1. A business plan for OSCW to be evaluated by the community at large. What is the investment, schedule, metrics, benefit…
John Steven @
Chris Schmidt @

Justin Clarke @

Jeremy Long @Summit 2011 Working Sessions/Session032

view
edit
ESAPI for Ruby
  1. Define which APIs needs to be implemented
  2. Define the module's namespace inside the gem
  3. Write cucumber scenarios to define overall integration tests
  4. Write rspec contexts for each API for fine grain test
  5. (hopefully: implementing at least 5% of APIs starting from their rspecs)
  1. Cucumber scenarios
  2. Rspec context for each API choosen
  3. 5% of APIs being implemented
Paolo Perego @

view
edit
ESAPI-CORE
  1. Build ESAPI-core version 1 for Java 1.5+
  2. Document planning phase and design decisions around ESAPI-core
  3. Produce library usage documentation
  1. Build a design plan for ESAPI core.
  2. Deploy the first version of the ESAPI-core Jar.
Jim Manico @

Paolo Perego @

Jim Manico @

view
edit
Building the OWASP Brazilian Leaders Group
  1. Define the members of the group
  2. Define the rules of engagement for the group
  3. Discuss how to fund Brazilian chapters
  4. Discuss the translation of OWASP materials to Portuguse
  5. Define the rules for hosting AppSec Brazil
  1. Objectives and working plan to improve OWASP presence in Brazil
Lucas C. Ferreira @

L. Gustavo C. Barbato @

Eduardo Jorge Feres Serrano Neves @

view
edit
Government Outreach
  1. Determine realistic ways to promote OWASP offerings to governments around the world
  2. Determine what governments are looking for from OWASP
  3. Determine resources that governments could provide that would assist the OWASP mission
  4. Explore the practicality of liaison roles to/from government organizations
  1. A list of suggestions to pass along to the Global Connections Committe for the best ways of engaging government
  2. A high level outline of what OWASP has to offer governments at large
  3. A list of items that government agencies are looking for from OWASP
  4. An outline of strategy for pursuing interaction with different governments in depth
Doug Wilson @

Lucas C. Ferreira @

Mateo Martinez @

Colin Watson

Martin Knobloch @

view
edit
Global Conferences Committee Monthly Meeting
  1. Develop v1 of OWASP Global Sponsorship Model
  2. Develop 2012 Call for AppSec Conferences (and new management system)
  3. Develop messaging plan for new initiatives
Mark Bristow @

Mark Bristow @

Lucas C. Ferreira @

Neil Matatall @

Ralph Durkee @

view
edit


view
edit
OWASP Certification
  1. Determine whether certification would have value for OWASP's Community
  2. Determine a model by which certification based on OWASP materials could succeed
  3. Determine a model for creation and distribution of a CC-licensed certification exam based on OWASP materials
  4. (if agreed) Determine a model for supporting the administration of certification based on OWASP Materials
  1. A business plan for evaluation by the community at large.


Dinis Cruz @

Matthew Chalmers @

Mateo Martinez @

Jeremy Long @

Matteo Meucci @

Seba Deleersnyder @

Daniel Brzozowski @

Paolo Perego @

Edward Bonver @

Ralph Durkee @

Nuno Loureiro @

Ricardo Melo @

Martin Knobloch @

Alexandre Miguel Aniceto @

Track: OWASP

Name of Working Session Objective(s) Outcome(s) / Deliverable(s) Owner/Leader Members/Attendees
view
edit
OWASP Board/Committee Governance
  1. Universal Committee Governance Document/Policies
  2. Review Board Governance and By-Laws (Including Board composition/elections)
  3. Committee alignment to OWASP Goals/Mission including Authorities, Individual Missions and Areas of Responsibility (AoR).
  4. Providing budgets to committees for direct oversight and spending in their AoR
  5. Additional transparency in OWASP accounting (Expenditures, Expense Reports for Officers/Committee Members.....)
  1. Universal Committee Governance Document and operating Policies
  2. Proposed updated OWASP By-Laws
  3. Committee mission clarifications and delineation of areas of responsibility
  4. New model for funding OWASP activities
  5. New policies to enhance transparency
Mark Bristow @
Jason Li @
Tom Brennan @
Jim Manico @

Nishi Kumar @

Joe Bernik

Matthew Chalmers @

Sarah Baso @

Doug Wilson @

Kate Hartmann @

John Steven @

Seba Deleersnyder @

view
edit
OWASP Projects
  1. Review changes made in the last 2 years
  2. Discuss the high level steps of a project life-cycle
  3. Approve the OWASP GPC Governance Document
  4. Streamline project initialization process to make it easier for new projects
  5. Implement project governance change approved by the Board to limit use of "OWASP" brand name to projects of certain maturity
  1. Initial draft for an RFP for a centralized OWASP project hosting solution
  2. A project lifecycle flow chart to identify the necessary steps to improving the visibility of a project's health
  3. An envisioned structure for the future of OWASP Projects
Brad Causey @
Jason Li @
Seba Deleersnyder @

Nishi Kumar @

view
edit
OWASP Industry Outreach
  1. The OWASP 2011 Industry Plan. To discuss plans for working with industry in a closer manner. The plan should contain specific activities, commitments, dates, and expected outcomes.
Eoin Keary @
Colin Watson
Lorna Alamri @

David Campbell

Eoin Keary

Matt Tesauro

Joe Bernik

Nishi Kumar @

Lucas C. Ferreira @

Tobias Gondrom @

Vehbi Tasar

Colin Watson

Jason Taylor @

Sarah Baso @

Mateo Martinez @

Konstantinos Papapanagiotou @

view
edit
Membership
  1. Develop a plan for reaching out to other organizations in order to expand OWASP's exposure to the larger security and developer communities.
  2. Create a budget and funding plan for the Membership Committee
  3. Be ready to conduct a survey of new and existing OWASP Members and Supporters. Develop survey questions and specifics for the implementation.
  1. The OWASP 2011 Membership Plan – describing the membership program and recommendations, marketing plans. The plan should contain specific membership targets for all membership classes and detailed strategies for achieving the goals.
Dan Cornell @

Michael Coates @

Mateo Martinez @

Dan Cornell @

Tony UcedaVelez @

Ofer Maor @

view
edit
Connections
  1. Define the mission of the Connections Committee
  2. Agree engagement/working patterns with the other global committees
  1. The OWASP 2011 Connection Plan – describing the current connections program and detailing the specifics for what will happen in 2011. The plan should contain specific goals and strategies for achieving the goals.
Jim Manico @
Justin Clarke @
Achim Hoffmann @

Doug Wilson @

Andre Gironda @

view
edit
Chapters
  1. Challenges and solutions to run a successful OWASP chapter
  1. The OWASP 2011 Chapter Plan – describing the current state of OWASP chapters worldwide and identifying what will happen in 2011 to grow the number of chapters and improve their quality.
Seba @

Mandeep Khera

Matthew Chalmers @

Matteo Meucci @

Mateo Martinez @

Ferdinand Vroom @

Helen Gao @

L. Gustavo C. Barbato @

Ofer Maor @

Wojciech Dworakowski @

Martin Knobloch @

Vlatko Kosturjak @

Antonio Fontes @

view
edit
Education
  1. Estimate how the past achievements do support the current educational developments
  2. Evaluate how we can get the projects involved in developing (or at least reviewing) training material
  3. Define new goals for the upcoming period
  4. Define success factors for the upcoming period
  1. The OWASP 2011 Education Plan – describing the specific plans for education in 2011 with schedule, targets, action plans, etc…
Martin Knobloch @

Nishi Kumar @

Cecil Su @

Jason Taylor @


Track: To Be Determined

|- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Conferences - Improving Conference Planner Support | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Discuss the GCC's current 2011 Plan of action and new initiatives
  2. Review comments provided in the Conference Planner Survey
  3. Discuss mechanisms to improve Planner/Operational Support
  4. Discuss mechanisms to improve event marketing/sponsorships
  5. Discuss Global Conference Sponsorship Plan

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. The OWASP 2011 Conference Plan – describing the plan for continuing to make our conferences even better, specifically defining the various tiers of conferences, naming, partnering with other entities, and other challenges.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Mark Bristow @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Lorna Alamri @

Nishi Kumar @

Lucas C. Ferreira @

Ralph Durkee @

Matthew Chalmers @

Matteo Meucci @

Mateo Martinez @

Neil Matatall @

Seba Deleersnyder @

L. Gustavo C. Barbato @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | OWASP Around the World | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Internationalization
  2. Global Job Board
  3. New OWASP chapters in parts of the world where we have not spread much yet

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. A white paper with specific recommendations on how we can ensure the greatest amount of access and involvement with OWASP for all people everywhere.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Matthew Chalmers @

Mateo Martinez @

Cecil Su @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | What is an OWASP Leader? | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Define what it means to be an OWASP Leader

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Definition of critera for OWASP Leaders
  2. A standard defining exactly what characterizes an OWASP Leader, for use in providing benefits and prioritizing support.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Dinis Cruz @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Matthew Chalmers @

Chris Schmidt @

Mark Bristow @

Daniel Brzozowski @

Martin Knobloch @

Vlatko Kosturjak @

Antonio Fontes @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Overhauling the OWASP Website | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Revisit goals from previous working session
  2. Identify available Google Apps (e.g. Code Review, Moderator, Short Links, Project Hosting, Groups, etc) that we can leverage to support OWASP Website Infrastructure.
  3. Review Website Overhaul Proposal for consideration
  4. Decide what elements should be outsourced/contracted to expedite implementation
  5. Resolve on schedule for achieving goals

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. A project plan describing the future of web support for the OWASP ecosystem (think social) that covers all the various constituents, stakeholders, users, leaders, etc…. The plan will define all the steps necessary to get there and provide a rough estimate of the effort to get there. To the maximum extent possible, the plan will be designed to be parallelizable so that parts can be worked independently.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Jason Li @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Larry Casey

Achim Hoffmann @

Michael Coates @

Colin Watson

Nishi Kumar @

Dinis Cruz @

Matthew Chalmers @

Justin Clarke @

Mark Bristow @

Seba Deleersnyder @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Computer Crime Laws | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Understand the current laws/frameworks in place in relation to computer crime and prevention
  2. Discuss ways these laws are currently failing consumers in protecting assets
  3. Discuss possible amendments to the laws/frameworks to better protect the public

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. A study evaluating the existing computer crime laws and how they might be applied to the current set of application security attacks. Recommendations for a new legal framework.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Daniel Cuthbert @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Matthew Chalmers @

Abraham Kang |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Sandboxed Tabs/Domains/Browser | valign="middle" height="30" bgcolor="#EEEEEE" align="left"| | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Browser Security Report
  2. Browser Security Priority List

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | John Wilander @

Michael Coates @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | OWASP Security Refactorings | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Goals and Scope of initial "Security Refactorings"
  2. High level Organization of Code Example Smells
  3. Format to present Security Refactorings
  4. Solutions and Segmenting of work.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. 1. Goals and Scope of initial "Security Refactorings"
  2. 2. High level Organization of Code Example Smells
  3. 3. Format to present Security Refactorings
  4. 4. Solutions and Segmenting of work.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Abraham Kang @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Abraham Kang @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | OWASP Portuguese Language Project | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Kickstart the project
  2. Define leadership and roles
  3. Prioritize documents
  4. List all Portuguese materials available

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. A prioritized action plan for getting OWASP materials created in Portuguese

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Lucas C. Ferreira @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Paulo Coimbra @

Sandra Paiva @

L. Gustavo C. Barbato @

Ricardo Melo @

Alexandre Agustini @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | | valign="middle" height="30" bgcolor="#EEEEEE" align="left"| | valign="middle" height="30" bgcolor="#EEEEEE" align="left"| | valign="middle" height="30" bgcolor="#EEEEEE" align="left" |

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Summit 2011 Working Sessions/Session050 Summit 2011 Working Sessions/Session051 |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | OWASP Testing Guide | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Show the v3, and debating what we need to create an excellent v4

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. An updated outline for the testing guide that is tied into the OWASP common numbering scheme
  2. A short white paper with ideas for revisions to the Testing Guide for evaluation and discussion by the community at large.
  3. A committed project manager who can reach out to experts to get the document completed.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Matteo Meucci @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Nishi Kumar @

Cecil Su @

Lucas C. Ferreira @

Keith Turpin @

Achim Hoffmann @

Tom Neaves @

Vishal Garg @

Giorgio Fedon @

Stefano Di Paola @

Pavol Luptak @

Andre Gironda @

Edward Bonver @

Wojciech Dworakowski @

Vlatko Kosturjak @

Antonio Fontes @

Christian Martorella @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | OWASP Java Project | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Restart the Java project
  2. Find new leadership
  3. Recruit volunteers
  4. Build a new Roadmap for the project

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Action plan for the project
  2. New project leader

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Lucas C. Ferreira @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Mateo Martinez @

Daniel Brzozowski @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Board Structure | valign="middle" height="30" bgcolor="#EEEEEE" align="left"| | valign="middle" height="30" bgcolor="#EEEEEE" align="left"| | valign="middle" height="30" bgcolor="#EEEEEE" align="left" |

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | John Steven @

Michael Coates @

Colin Watson

Martin Knobloch @

Seba Deleersnyder @

Jim Manico @

Mark Bristow @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Risk Metrics | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Quantify business criticality of a deployed application
  2. Translate technical risks into business risks (speak the language of management)
  3. Translate technical risk into approximate financial risk

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Paper describing definitions and formula for determining business criticality
  2. Paper translating technical language and risks into business language and monetary risk

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Chris Wysopal @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Tony UcedaVelez @

Eoin Keary @

Sherif Koussa @

Konstantinos Papapanagiotou @

Vishal Garg @

Mateo Martinez @

Mikko Saario @

Ofer Maor @

Nuno Loureiro @

Wojciech Dworakowski @

Tobias Gondrom @

Juan Jose Rider @

Alexandre Miguel Aniceto @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Tools Interoperability (Data Instrumentation) | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Defining consuming and instrumental tools data

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. A standard schema for describing application security risks of all types, with a place for all relevant information – whether derived statically, dynamically, manually, or architecturally.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Dinis Cruz @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Stefano Di Paola @

Dan Cornell @

Jeremy Long @

Paolo Perego @

Sherif Koussa @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Metrics and Labeling | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Discuss positive security properties that should be tracked
  2. Discuss options for consumer-friendly labeling
  3. Discuss ways to encourage participation in risk labeling

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. White paper sketching out a standard for a software security label and a plan to finalize the standard.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Chris Eng @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |

Vishal Garg @

Doug Wilson @

Alexandre Miguel Aniceto @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Counting and scoring application security defects | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Discuss existing methods for counting and scoring defects, by vendors and practitioners willing to share their methodologies.
  2. Discuss advantages and disadvantages of a standardized approach.
  3. Discuss the CWSS 0.1 draft and how it might be incorporated into a standard.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. White paper sketching out a standard for rating risks that accomodates individual minor defects all the way through architectural flaws (that may represent many individual defects)

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Chris Eng @
Chris Wysopal @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Jason Taylor @

Justin Clarke @

Sherif Koussa @

Vishal Garg @

Matteo Meucci @

Elke Roth-Mandutz @

Mateo Martinez @

Doug Wilson @

Ofer Maor @

Wojciech Dworakowski @

Alexandre Miguel Aniceto @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | Measuring SDLC process performance | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Determine which SDLC activities correlate with more secure software
  2. Determine how to measure the performance of these activities

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Paper describing the SDLC activities that matter and measurement techniques for their performance

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Chris Wysopal @
Chris Eng @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Eoin Keary @

Nishi Kumar @

L. Gustavo C. Barbato @

Jason Taylor @

Matthew Chalmers @

Justin Clarke @

Seba Deleersnyder @

Sherif Koussa @

Vishal Garg @

Giorgio Fedon @

Ofer Maor @

Nuno Loureiro @

Tobias Gondrom @ |- valign="bottom"

| valign="middle" height="30" bgcolor="#EEEEEE" align="center" | view
edit | valign="middle" height="30" bgcolor="#EEEEEE" align="center" | OWASP Quotes | valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. Open letter to governments
  2. Open letter to insurance companies
  3. Tools inoperability
  4. Tools customization by security consultants
  5. Wiki leaks & WebAppSec

| valign="middle" height="30" bgcolor="#EEEEEE" align="left"|

  1. A white paper on how OWASP can use “quotes” effectively to drive awareness and action. The paper will suggest specific strategies for obtaining, vetting, and promoting quotes to achieve our aims.

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" |Dinis Cruz @

| valign="middle" height="30" bgcolor="#EEEEEE" align="left" | Matthew Chalmers @ |}