Belgium

= Local News =

Block your agenda's for our next chapter meeting on January 25th in Brussels. More details to follow.

Structural Sponsors 2011/2012
OWASP Member affiliated to the Belgium chapter:

OWASP Belgium thanks its structural chapter supporters for 2011 and the OWASP BeNeLux Day 2011:

http://www.owasp.org/images/e/e6/Zionsecurity.jpg http://www.owasp.org/images/d/df/SAIT_Zenitel.jpg https://www.owasp.org/images/f/f6/Bnl11-Barracuda_Logo-4C.png https://www.owasp.org/images/f/fd/AppSec_Research_2010_sponsor_F5_logo.jpg

If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]

Belgium

= Chapter Meetings =

WHEN
25th of January 2012 18h-21h00

WHERE
TBD sponsors the location: Brussels

PROGRAM
The agenda:


 * 18h00 - 18h30: Welcome &amp; Sandwiches
 * 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
 * 18h45 - 19h45: devops, secops, devsec or *ops ? A gentle introduction to Devops (by Kris Buytaert, Inuits)
 * This talk will summarize the different ideas behind devops, and will show that this goes beyond tooling and becomes a way of thinking, where ultimately everybody will stand together to support the business.
 * Some call this phenomenon devops, others hate the word and want to call it *ops or ops*, truth is that agile techniques used in development have an impact on the way operations organizes it work.  Similar, operations and sysadmins are becoming programmers because of the virtualization and automation trend where everything is managed through an API.    And security is imvolved everywhere.
 * Kris Buytaert is a long time Linux and Open Source Consultant. He's one of instigators of the devops movement, currently working for Inuits. Kris is the Co-Author of Virtualization with Xen, used to be the maintainer of the openMosix HOWTO and author of different technical publications. He is frequently speaking at, or organizing different international conferences. He spends most of his time working on Linux Clustering (both High Availability, Scalability and HPC), Virtualisation and Large Infrastructure Management projects hence trying to build infrastructures that can survive the 10th floor test, better known today as the cloud while actively promoting the devops idea ! His blog titled "Everything is a Freaking DNS Problem" can be found at http://www.krisbuytaert.be/blog/


 * 19h45 - 20h00: Break
 * 20h00 - 21h00: TBD (by Erwin Geirnaert, Zion Security)
 * During this presentation we give an overview of how we can harden web applications against different types of attacks used by malware to bypass the existing security controls in the web application. We discuss the OWASP Top 10 and how malware can abuse these attacks and how the developer must implement a different strategy. We explain why (mobile) browser security is an important aspect of web application hardening and most importantly that the battle against malware is an ongoing battle. For every countermeasure the security industry develops to protect web applications and is used by a lot of companies today we will show how malware is being developed to bypass these solutions. To finalize we give some advice on how to protect against these malware attacks, using pro-active and detective controls.
 * Erwin Geirnaert founded ZION SECURITY in 2005 to help companies to protect against the latest threats, attacks against web applications. ZION SECURITY is nowadays a Belgian market leader in the field of security testing, vulnerability management, penetration testing and banking security. Erwin has more than 10 years of experience in web security, graduating with a Master of Science in Software Development from the University of Ghent. Erwin executes different types of projects for a lot of international software companies, financial institutions, telecom and web agencies. Specialist in executing code reviews in different development languages for critical applications, executing continuous penetration tests of their infrastructure and Internet applications. A specialist in J2EE security, .NET security and web services security. Erwin architects secure e-business projects for web agencies and software companies. He is a recognized application security expert and speaker at international events like Javapolis, OWASP, Eurostar,

REGISTRATION
Please register via TBD

WHEN
16th of June 2011 18h-21h00

WHERE
Deloitte sponsors the location: Berkenlaan 8, 1831 diegem Google Maps link

There will be access to the parking at building 7. The gate between building 7 and 8 will be open.

This gate will provide you access to building 8B, but the meeting room is at building 8C, you are asked to go directly to building 8C

PROGRAM
The agenda:


 * 18h00 - 18h30: Welcome &amp; Sandwiches
 * 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
 * 18h45 - 19h45: The OWASP AppSensor Project (by Colin Watson, Watson Hall Ltd)
 * The OWASP AppSensor Project defines a conceptual framework and methodology that offers prescriptive guidance to implement attack detection and automated response into an existing application. The talk will provide an overview why conventional defences do not work, and how application-specific detection can be used to identify, and respond to, attackers before they are able to find a flaw to exploit. Implementations will be described that have been tested against security scanning tools, manual attackers and how the technique could be used to defend against an application worm.
 * Colin Watson is co-founder of Watson Hall Ltd, based in London, where his work involves the management of application risk, designing defensive measures, building security & privacy in to systems development and keeping abreast of relevant international legislation and standards. He holds a BSc in Chemical Engineering from Heriot-Watt University in Edinburgh, and an MSc in Computation from the University of Oxford.  He contributes to a number of OWASP projects and is a member of the OWASP Global Industry Committee.


 * 19h45 - 20h00: Break
 * 20h00 - 21h00: How to become Twitter's admin: An introduction to Modern Web Service Attacks (by Andreas Falkenberg, RUB)
 * Web Services are the cornerstone of inter-application communication in today's IT infrastructure. They are used in distributed systems ranging from huge B2B applications to Cloud APIs (e.g. Amazon EC2). Despite their wide usage, even in critical infrastructures, Web Service security is not fully understood yet. In addition to "classic" web application attacks, such as SQLi and XSS, the use of Web Services opens a whole new realm of attack vectors not found anywhere else.
 * This talk will give an introduction to current attack techniques for Web Services that have been found in today's Web Services implementation stacks. As a hands on example, the attack technique of the "XML Signature Wrapping" attack is explained in detail. This attack enables an attacker to arbitrarily modify the content of a signed SOAP message with almost no effort.
 * Based on the XML Signature Wrapping attack, an attack scenario is shown that enables an attacker to become admin of the famous Twitter service, based on a real-life XML Signature Wrapping Attack performed by researchers at our university in 2010.
 * The last part of the talk gives an overview of other Web Service specific attacks and countermeasures, based on the information given at the WS-Attacks.org website.
 * Andreas is currently seeking a Master's degree in IT Security at the Ruhr University of Bochum, Germany. Besides being busy writing exams, Andreas works for the Chair for Network- and Data-Security having fun with Cloud- and Web Service-Security.

Previous Meeting (23th of May 2011) in Brussels
Read @xme's review of the meeting on /dev/random blog

WHEN
23th of May2011 18h-21h00

WHERE
LCM, Haachtsesteenweg 579 1031 Brussel

PROGRAM
The agenda:


 * 18h00 - 18h30: Welcome &amp; Sandwiches
 * 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
 * 18h45 - 19h00: ISSA Update (by Clement Herssens)
 * 19h00 - 19h45: Non-convential Attacks: Things your security scanners won't find (by Tom Van Der Mussele, Verizon)
 * This presentation will handle non-conventional attacks, such as:
 * Attacking XML Streams
 * Context escaping
 * Session Time-outs
 * Tom Van der Mussele is a Lead Security Analyst for the Governance, Risk & Compliance Programs in EMEA for Verizon Business Security Solutions. Prior to joining the Governance, Risk & Compliance Programs, Tom worked as Penetration tester. In this role, he specialized in security audits, including penetration testing and web application vulnerability assessments for major financials and governmental organizations.


 * 19h45 - 20h30: The Ghost of XSS Past, Present and Future – A Defensive Tale (by Jim Manico, Infrared Security)
 * This talk will discuss the past methods used for XSS defense that were only partially effective. Learning from these lessons, will will also discuss present day defensive methodologies that are effective, but place an undue burden on the developer. We will then finish with a discussion of future XSS defense mythologies that shift the burden of XSS defense from the developer to various frameworks. These include auto-escaping template technologies, browser-based defenses such as Content Security Policy, and Javascript sandboxes such as the Google CAJA project and JSReg.
 * Jim Manico is a managing partner of Infrared Security with over 15 years of professional web development experience. Jim is also the chair of the OWASP connections committee, one of the project managers of the OWASP ESAPI project, a participant and manager of the OWASP Cheatsheet series, the producer and host of the OWASP Podcast Series, the manager of the OWASP Java HTML Sanitizer project and the manager of the OWASP Java Encoder project. When not OWASP'ing, Jim lives on of island of Kauai with his lovely wife Tracey.


 * 20h30 - 21h00: Discussion: How CERT.be & OWASP can improve web application security in Belgium (by Christian Van Heurck, CERT.be)
 * CERT.be presentation and group discussion

WHEN
March 1st 2011 18h-21h30

WHERE
Hosted by Distrinet Research Group (K.U.Leuven).

Address: Department of Computer Science (auditorium 00.225) Celestijnenlaan 200 A 3001 Heverlee

Routemap: http://distrinet.cs.kuleuven.be/about/route/

PROGRAM
The agenda:


 * 18h00 - 18h30: Welcome &amp; Sandwiches
 * 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
 * 18h45 - 19h45: The Thinking Person's Guide to the Cloud. HOWTO: Keep your head in the clouds and your feet on the ground (by Gunnar Peterson, Arctec Group)
 * “Everything we think of as a computer today is really just a device that connects to the big computer that we are all collectively building"-Tim O'Reilly
 * My friend Chris Hoff asked this question in a recent podcast - "why is the OWASP Top Ten the same year after year? why don't these things gets fixed?"[1]. The reason is that software security and security architecture and design is nowhere near as a high priority as it needs to be.
 * If you look at the evolution of software over the years, you will see a history of more and more systems and data being connected together. Beginning with the Web through to component based application and then to Web services, at each step the common theme is more connectivity, more integration. Software is a rapidly changing universe
 * Unfortunately, Information Security has not kept up. Our field started out promisingly in the mid-90s with network firewalls and SSL for security mechanisms to defend websites, but that is about as far it got. In 1999 when SOAP emerged as a firewall-friendly protocol designed for the explicit reason to go through the firewall, that should have been a wake up call to Information Security that the "firewall + SSL" security architecture was past its prime, but here 10 years later we are still hitting the snooze button.
 * My view is that as technology is deployed we need security mechanisms that form fit to those new technologies, instead what we have is security technologies that form fit to auditor's excel spreadsheets.
 * Gunnar Peterson is a Managing Principal at Arctec Group. He is focused on distributed systems security for large mission critical financial, financial exchanges, healthcare, manufacturer, and insurance systems, as well as emerging start ups. Mr. Peterson is an internationally  recognized software security expert, frequently published, an Associate Editor for IEEE Security & Privacy Journal on Building Security In, a contributor to the SEI and DHS Build   Security In portal on software security, a Visiting Scientist at Carnegie Mellon Software Engineering Institute, and an in-demand speaker at security conferences. He maintains a popular informationsecurity blog at http://1raindrop.typepad.com.


 * 19h45 - 20h00: Break
 * 20h00 - 21h30: Threat modeling (by John Steven, Cigital)
 * How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management. Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.
 * John Steven is Senior Director of Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted adviser to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine and speaks with regularity at conferences and trade shows. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.
 * John leads the Virginia OWASP Northern Virginia (NoVA) chapter.

Past Events

 * Events held in 2010
 * Events held in 2009
 * Events held in 2008
 * Events held in 2007
 * Events held in 2006
 * Events held in 2005

= Belgium OWASP Chapter Leaders =

The BeLux Chapter is supported by the following board:


 * Erwin Geirnaert, Zion Security
 * Philippe Bogaerts, F5
 * André Mariën, Inno.com
 * Lieven Desmet, K.U.Leuven
 * Joël Quinet, Telindus
 * Sebastien Deleersnyder, Zenitel
 * Bart De Win, Ascure

Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.