Summit 2011 Working Sessions

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	DOM Sandboxing	Attenuated versions of existing apis to sandboxed code. Client side sandboxed apps maintaining state and authentication. Create a standard for modifying a sandboxed environment Deprecate and discourage standards which ambiently or undeniably pass credentials. Create a standard for authentication within a sandboxed environment (maybe interfacing with existing auth without passing creds like 0Auth works)	Browser Security Report Browser Security Priority List	Jasvir Nagra Gareth Heyes @	Email John Wilander if you are unable to edit the Wiki and would like to sign up! @ Michael Coates Eduardo Vela @ Stefano Di Paola Isaac Dawson Chris Eng @ Alexandre Miguel Aniceto @
view edit	HTML5 Security	Handle autofocus in a unified and secure way. Discuss necessity and capability for the HTML5 form controls. Initiate and create documentation and references for developers that address security issues. Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags. Long Term Goal(s): Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier.	Browser Security Report Browser Security Priority Report	Mario Heiderich Gareth Heyes @	John Wilander @ Michael Coates @ Tony UcedaVelez @ Stefano Di Paola Isaac Dawson Chris Eng @ Nishi Kumar @ Elke Roth-Mandutz @ Giorgio Fedon Paolo Perego @ Eduardo Vela @ Abraham Kang @ Nuno Loureiro @ Alexandre Miguel Aniceto @
view edit	EcmaScript 5 Security	Fix the problems with Object.defineProperty() and property unsealing / double-freezing. Raise awareness for the power or object freezing in a security context. Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented. Long Term Goal: Discuss the possibility of vendor supported client side security mechanisms.	Browser Security Report Browser Security Priority List	Mario Heiderich TBC	John Wilander @ Michael Coates @ Stefano Di Paola Isaac Dawson Abraham Kang Gareth Heyes
view edit	Enduser Warnings	Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.	Browser Security Report Browser Security Priority List	John Wilander @	John Wilander @ Michael Coates @ Vishal Garg @
view edit	Site Security Policy		Browser Security Report Browser Security Priority List	John Wilander @ Michal Coates @	John Wilander @ Michael Coates @ Stefano Di Paola Tobias Gondrom @ Alexandre Miguel Aniceto @
view edit	Securing Plugins		Browser Security Report Browser Security Priority List		John Wilander @ Michael Coates @ Giorgio Fedon
view edit	Blacklisting		Browser Security Report Browser Security Priority List		John Wilander @ Michael Coates @
view edit	OS Integration		Browser Security Report Browser Security Priority List		John Wilander @ Michael Coates @
view edit	XSS and the Frameworks	Work on how OWASP can engage with the major web frameworks to move towards a "secure by default" stance Work on OWASP resources to provide patches/design approaches in conjunction with the frameworks	OWASP statement/Press release to publicly ask the frameworks to build security in Engagement plan on how we'd work with (if at all) a framework to get ESAPI or similar functionality integrated White paper or standard for what we want the web frameworks to provide in terms of XSS defenses. Turning the XSS Prevention Cheat Sheet into a standard/metric for frameworks would be great. OWASP Standard defining an appraisal methodology for a framework’s XSS prevention capability based on the other deliverable.	Justin Clarke @	Chris Eng @ Abraham Kang Tony UcedaVelez @ Fred Donovan @ Juan Jose Rider @
view edit	XSS - Awareness, Resources, and Partnerships	Work on what partners we can reach, and what resources they can provide us access to Work on who we can work with to reach a maximum amount of developers writing web applications Plan engagement with identified organizations Plan a call to action for OWASP chapters for identified XSS resources	A concrete, specific business plan for investing OWASP Funds in a campaign designed to ensure that every developer knows about XSS and what to do to prevent it. The plan should have specific goals, measures, and targets over time so we know if it is on track.	Justin Clarke @	Chris Eng @ Abraham Kang Sherif Koussa @
view edit
view edit	University Outreach	Estimation of Security prorams currently exist in university settings around the world How can OWASP participate and influence the curricula of these educational programs? How can we foster relationships between OWASP and universities? How can the relationship between OWASP and universities be standardized? What can OWASP offer universities and what can they, in turn, expect from each other?	A study with facts, numbers, and other metrics about application secuirity in academia. The OWASP Academic State of the World. A white paper with strategies for infiltrating academia with our priorities.	Martin Knobloch @	Nishi Kumar @ Cecil Su @ Elke Roth-Mandutz @ Heiko Richler @ Lucas C. Ferreira @ Jason Taylor @ Carlos Serrão @ Konstantinos Papapanagiotou @ Mateo Martinez @ L. Gustavo C. Barbato @ Edward Bonver @ Ricardo Melo @ Alexandre Agustini @
view edit	OWASP Board/Committee Governance	Universal Committee Governance Document/Policies Review Board Governance and By-Laws (Including Board composition/elections) Committee alignment to OWASP Goals/Mission including Authorities, Individual Missions and Areas of Responsibility (AoR). Providing budgets to committees for direct oversight and spending in their AoR Additional transparency in OWASP accounting (Expenditures, Expense Reports for Officers/Committee Members.....)	Universal Committee Governance Document and operating Policies Proposed updated OWASP By-Laws Committee mission clarifications and delineation of areas of responsibility New model for funding OWASP activities New policies to enhance transparency	Mark Bristow @ Jason Li @ Tom Brennan @	Jim Manico @ Nishi Kumar @ Joe Bernik Matthew Chalmers @ Sarah Baso @ Doug Wilson @ Kate Hartmann @ John Steven @ Seba Deleersnyder @
view edit	OWASP Projects	Review changes made in the last 2 years Discuss the high level steps of a project life-cycle Approve the OWASP GPC Governance Document Streamline project initialization process to make it easier for new projects Implement project governance change approved by the Board to limit use of "OWASP" brand name to projects of certain maturity	Initial draft for an RFP for a centralized OWASP project hosting solution A project lifecycle flow chart to identify the necessary steps to improving the visibility of a project's health An envisioned structure for the future of OWASP Projects	Brad Causey @ Jason Li @	Seba Deleersnyder @ Nishi Kumar @
view edit	OWASP Industry Outreach		The OWASP 2011 Industry Plan. To discuss plans for working with industry in a closer manner. The plan should contain specific activities, commitments, dates, and expected outcomes.	Eoin Keary @ Colin Watson	Lorna Alamri @ David Campbell Eoin Keary Matt Tesauro Joe Bernik Nishi Kumar @ Lucas C. Ferreira @ Tobias Gondrom @ Vehbi Tasar Colin Watson Jason Taylor @ Sarah Baso @ Mateo Martinez @ Konstantinos Papapanagiotou @
view edit	Membership	Develop a plan for reaching out to other organizations in order to expand OWASP's exposure to the larger security and developer communities. Create a budget and funding plan for the Membership Committee Be ready to conduct a survey of new and existing OWASP Members and Supporters. Develop survey questions and specifics for the implementation.	The OWASP 2011 Membership Plan – describing the membership program and recommendations, marketing plans. The plan should contain specific membership targets for all membership classes and detailed strategies for achieving the goals.	Dan Cornell @	Michael Coates @ Mateo Martinez @ Dan Cornell @ Tony UcedaVelez @ Ofer Maor @
view edit	Connections	Define the mission of the Connections Committee Agree engagement/working patterns with the other global committees	The OWASP 2011 Connection Plan – describing the current connections program and detailing the specifics for what will happen in 2011. The plan should contain specific goals and strategies for achieving the goals.	Jim Manico @ Justin Clarke @	Achim Hoffmann @ Doug Wilson @ Andre Gironda @
view edit	Chapters	Challenges and solutions to run a successful OWASP chapter	The OWASP 2011 Chapter Plan – describing the current state of OWASP chapters worldwide and identifying what will happen in 2011 to grow the number of chapters and improve their quality.	Seba @	Mandeep Khera Matthew Chalmers @ Matteo Meucci @ Mateo Martinez @ Ferdinand Vroom @ Helen Gao @ L. Gustavo C. Barbato @ Ofer Maor @ Wojciech Dworakowski @ Martin Knobloch @ Vlatko Kosturjak @ Antonio Fontes @
view edit	Education	Estimate how the past achievements do support the current educational developments Evaluate how we can get the projects involved in developing (or at least reviewing) training material Define new goals for the upcoming period Define success factors for the upcoming period	The OWASP 2011 Education Plan – describing the specific plans for education in 2011 with schedule, targets, action plans, etc…	Martin Knobloch @	Nishi Kumar @ Cecil Su @ Jason Taylor @
view edit	Conferences - Improving Conference Planner Support	Discuss the GCC's current 2011 Plan of action and new initiatives Review comments provided in the Conference Planner Survey Discuss mechanisms to improve Planner/Operational Support Discuss mechanisms to improve event marketing/sponsorships Discuss Global Conference Sponsorship Plan	The OWASP 2011 Conference Plan – describing the plan for continuing to make our conferences even better, specifically defining the various tiers of conferences, naming, partnering with other entities, and other challenges.	Mark Bristow @	Lorna Alamri @ Nishi Kumar @ Lucas C. Ferreira @ Ralph Durkee @ Matthew Chalmers @ Matteo Meucci @ Mateo Martinez @ Neil Matatall @ Seba Deleersnyder @ L. Gustavo C. Barbato @
view edit	OWASP Around the World	Internationalization Global Job Board New OWASP chapters in parts of the world where we have not spread much yet	A white paper with specific recommendations on how we can ensure the greatest amount of access and involvement with OWASP for all people everywhere.		Matthew Chalmers @ Mateo Martinez @ Cecil Su @
view edit	What is an OWASP Leader?	Define what it means to be an OWASP Leader	Definition of critera for OWASP Leaders A standard defining exactly what characterizes an OWASP Leader, for use in providing benefits and prioritizing support.	Dinis Cruz @	Matthew Chalmers @ Chris Schmidt @ Mark Bristow @ Daniel Brzozowski @ Martin Knobloch @ Vlatko Kosturjak @ Antonio Fontes @
view edit	Overhauling the OWASP Website	Revisit goals from previous working session Identify available Google Apps (e.g. Code Review, Moderator, Short Links, Project Hosting, Groups, etc) that we can leverage to support OWASP Website Infrastructure. Review Website Overhaul Proposal for consideration Decide what elements should be outsourced/contracted to expedite implementation Resolve on schedule for achieving goals	A project plan describing the future of web support for the OWASP ecosystem (think social) that covers all the various constituents, stakeholders, users, leaders, etc…. The plan will define all the steps necessary to get there and provide a rough estimate of the effort to get there. To the maximum extent possible, the plan will be designed to be parallelizable so that parts can be worked independently.	Jason Li @	Larry Casey Achim Hoffmann @ Michael Coates @ Colin Watson Nishi Kumar @ Dinis Cruz @ Matthew Chalmers @ Justin Clarke @ Mark Bristow @ Seba Deleersnyder @
view edit	Computer Crime Laws	Understand the current laws/frameworks in place in relation to computer crime and prevention Discuss ways these laws are currently failing consumers in protecting assets Discuss possible amendments to the laws/frameworks to better protect the public	A study evaluating the existing computer crime laws and how they might be applied to the current set of application security attacks. Recommendations for a new legal framework.	Daniel Cuthbert @	Matthew Chalmers @ Abraham Kang
view edit	Applying ESAPI Input Validation	Serial Decomp: Decode, canonicalize, filter Structured data (SSN, CC, etc.) Unstructured data (comments, blogs, etc.) Other input exaples (ws-, database, etc.)	A clear and concise user guide for getting ESAPI input validation up and running.	Chris Schmidt @	Nishi Kumar @ Justin Clarke @ John Steven @
view edit	Defining AppSensor Detection Points	Understand AppSensor Fundamentals Define AppSensor Detection Points applicable to most applications Implement detection points into code	Status of AppSensor Whitepaper including AppSensor Roadmap Updated AppSensor-Tutorial code with new lessons and lesson structure enhancements Updated Getting Started Guide for new adopters and developers leveraging feedback from session	Michael Coates @	Ryan Barnett @ Colin Watson Chris Schmidt @
view edit	Contextual Output Encoding	Increase coverage and functionality of existing Output Encoding Codecs Create new codecs to cover more output encoding contextual needs Introduce these codecs in a way that doesn't interfere with ESAPI Modularization Tasks Draft an implementation guide for Application Framework Developers to implement ESAPI Output Encoding into their Application Frameworks	Increase coverage and functionality of existing Output Encoding Codecs New drop in set of codecs for the ESAPI Encoder to use for additional contexts Implementation Guide for Framework Developers to integrate Output Encoding into their Application Framework. This should be a simple guide that can be distributed en masse to framework developers as a push to get them involved in making their frameworks more secure by eliminating XSS.	Chris Schmidt @	Justin Clarke @ Abraham Kang
view edit	Protecting Information Stored Client-Side	Produce an informal threat model for each development scenario Impart clear and simple shared understanding of threats associated with each development scenario (and dispel common misunderstandings/idioms) Define solution that resists defined attacks Deliver solution implementation (snippets) to https://code.google.com/p/secure-coding-workshop/	(see objectives) Threat Models (see objectives) Code Snippets Plan and Extra-summit work-items for exercises in Phone and RIA contexts during next summit	John Steven @	Elke Roth-Mandutz @ Jim Manico @ Chris Schmidt @ Justin Clarke @ Neil Matatall @ Tony UcedaVelez @ Fred Donovan @ Alexandre Miguel Aniceto @ Antonio Fontes @
view edit	Protecting Against CSRF		A practical guideline for protecting against CSRF in the real world. A concise, clear standard for determining whether an application is vulnerable to CSRF.		Chris Schmidt @ Achim Hoffmann @ Ryan Barnett @ Mark Thomas @ Vishal Garg @
view edit	Providing Access to Persisted Data	Create design and code examples for protecting access to database tables and rows by role Create design and code examples for protecting access to data when 'auto-wiring' and marshalling Create design and code examples for protecting sensitive data at rest	A short reference architecture/coding examples type of guideline that clearly explains positive and negative examples of accessing persisted data.	Dan Cornell @	Chris Schmidt @ Justin Clarke @ Dan Cornell @ John Steven @ Ralph Durkee @ Alexandre Miguel Aniceto @