Boston

Local News
Boston

To find out more about the Boston chapter, just join the OWASP Boston mailing list.

Boston Application Security Conference 2011 --- FREE
Boston Application Security Conference 2011

Boston Application Security Conference 2011 - Call For Papers

Local Chapter Information --- Our Seventh Year
The chapter shipping/mailing address is:

OWASP Boston 35 Wachusett Dr Lexington, MA. 02421

Reviews
Reviews of security podcasts

Past Conferences
Boston Application Security Conference 2010

Upcoming Meetings
We usually meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm.

Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.

Information for meeting updates about this and other Boston area user groups can also be found at BostonUserGroups.

Location
The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month (Unless a speaker can only present another night), 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA.

From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C.

Upcoming Meetings
Wednesday September 7 6:30 pm

Location - Microsoft Waltham - 201 Jones Rd., Sixth Floor Waltham, MA

Adriel Desautels – Differences between Penetration Testing and Vulnerability Scanning

Adriel T. Desautels is the President and CTO of Netragard, LLC. Among other things Adriel specializes in the delivery of advanced, high-threat anti-hacking services and covert network penetration methodologies. Prior to founding Netragard Adriel founded the internationally recognized SNOsoft Research Team, which quickly became the think tank for Secure Network Operations, Inc. Today SNOsoft is owned and operated by Netragard LLC.

Adriel also has extensive experience and expertise in the design and deployment of sophisticated Intrusion Detection and Intrusion Prevention (IDS/IPS) systems. In early 2002 Adriel designed an IDS/IPS technology with powerful event correlation capabilities capable of accurately identifying real events buried in a high volume of noise. That technology was later acquired by a private third party. As a result of his expertise Adriel has acted as an expert witness in U.S. Federal Court.

Today Adriel’s responsibilities at Netragard include but are not limited to the design and management of all of Netragard’s professional services. Adriel’s secondary responsibility is to run and maintain Netragard’s Exploit Acquisition Program (EAP). EAP is designed to acquire bleeding edge, high value research and intelligence from the hacking community

Monday July 25

Location - Microsoft Waltham - 201 Jones Rd., Sixth Floor Waltham, MA

Session 1 - Managing Risk with Threat Modeling

Threat Modeling and Vulnerabilities Assessments are gaining momentum at many companies today because of the recent hacks at Sony, PBS, CIA and other high profile companies that have a mature vulnerability assessment or static analysis process. Traditionally companies have relied on vulnerability assessment or static analysis tools to identify vulnerabilities but recent hacks have proved that it's not enough. The correct approach is to use threat modeling to identify vulnerabilities and vulnerability assessment or static analysis tools should be used to validate if that vulnerability is actually mitigated. More and more organizations have realized that identifying threats in the design phase and planning a mitigation strategy helps them in saving time, money, brand value and generally overall risk. Threat Modeling can help by guiding the Application Development Teams to ensure your Security Policies get properly coded into the Applications at time of Development. By creating pre-approved methods of coding for your development teams, and applying them in a repeatable and scalable process, you can assist your development teams in building a secure application easily and effortlessly.

Session 2 - False Positive, False Negative and False Sense of Security

This interactive session will talk about the pros and cons of using black box testing tools and discuss their effectiveness in building a mature software security program. This session will also mention how companies worry about false positives coming out of a scanner technology but overlooking false negatives leading them in a false sense of security. This half presentation, half Q&A session will highlight what works and what doesn't work in scanner technology and present case studies where companies got hacked even after using scanners on their apps.

Presenter Bio

Anurag Agarwal, the founder of MyAppSecurity, has proven record in providing customers with solutions related to security risk management. Anurag is a former Director of Education Services at WhiteHat Security and has over 17 years of experience designing, developing, managing and securing web applications and has worked for companies like Citigroup, Cisco, HSBC Bank, and GE Medical Systems to name a few. He is an active contributor to the web application security field and has written several articles on secure design and coding for online magazines.

A frequent speaker on web application security at various conferences, Anurag is actively involved with organizations such as the WASC (Web Application Security Consortium) and OWASP (Open Web Application Security Project). He started the project on Web Application Security Scanner Evaluation Criteria and is currently a project leader for OWASP Threat Modeling Methodology. Along with the MyAppSecurity team, he looks forward to transforming the business of application security by offering solutions that every business can easily implement easily and effortlessly.

Past Meetings
Thursday June 2

Location - Microsoft NERD - http://microsoftcambridge.com/About/Directions/tabid/89/Default.aspx

Topic - Bringing Sexy Back: Defensive Measures That Actually Work

Presenter - Paul Asadoorian, Founder &amp; CEO, PaulDotCom Enterprises

There is a plethora of information available on how to break into systems, steal information, and compromise users. As a penetration tester, I have performed testing on a regular basis that reveals severe security weaknesses in several organizations, and many of my peers have reported on the same. However, once you "own" the network and report on how you accomplished your goals, now what? Sure, we make defensive recommendations, but consistently it has been proven that security can be bypassed. Not enough focus is given to what works defensively. We have a lot of technology at our disposal: firewalls, intrusion detection, log correlation, but it provides little protection from today's threats and is often not implemented effectively. This talk will focus on taking an offensive look at defense. Applying techniques that are simple, yet break the mold of traditional defensive measures. We will explore setting up "traps" for attackers, slowing them down with simple scripts, using honeypots, planting bugs, and most importantly tying these methods to "enterprise security". This talk will also include real-world examples of the techniques in action from a live, heavily attacked site. Topics will include:


 * Using wireless “attacks” on the attackers
 * Implementing the Metasploit Decloak engine to find the attackers
 * Setting traps to detect web application attacks
 * Integrating results into your enterprise log management tool

The goal of this talk is to make defense “sexy”…

Presenter Bio

Paul Asadoorian is currently the "Product Evangelist" for Tenable Network Security, where he showcases vulnerability scanning and management through blogs, podcasts and videos. Paul is also the founder of PaulDotCom, an organization centered around the award winning "PaulDotCom Security Weekly" podcast that brings listeners the latest in security news, vulnerabilities, research and interviews with the security industry's finest. Paul has a background in penetration testing, intrusion detection, and is the co-author of "WRT54G Ultimate Hacking", a book dedicated to hacking Linksys routers.

Thursday May 26

Location - Microsoft Waltham (201 Jones Rd., Sixth Floor Waltham, MA)

Topic - OWASP Top 10 issue #4 – Insecure Direct Object Reference

Presenter - Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels and President of OWASP Boston

Jim Weiler will discuss threat models, risks and various remediations of issue #4 in the 2010 OWASP Top 10 – Insecure Direct Object References.

Topic - A Web-Application Architecture for Regulatory Compliant Cloud Computing

Presenter - Arshad Noor, StrongAuth

The emergence of cloud-computing as an alternative deployment strategy for IT systems presents many opportunities, yet challenges traditional notions of data-security. The fact that data-security regulations are developing teeth, leaves information technology professionals perplexed on how to take advantage of cloud-computing while proving compliance to regulations for protecting sensitive information.

This presentation presents an architecture for building the next generation of web-applications. This architecture allows you to leverage emerging technologies such as cloud-computing, cloud-storage and enterprise key-management (EKM) to derive benefits such as lower costs, faster time-to-market and immense scalability with smaller investments - while proving compliance to PCI-DSS, HIPAA/HITECH and similar data-security regulations.

Presenter Bio

Arshad Noor is the CTO of StrongAuth, Inc, a Silicon Vally-based company that specializes in enterprise key management. He is the designer and lead-developer of StrongKey, the industry's first open-source Symmetric Key Management System, and the KeyAppliance - the industry's first appliance combining encryption, tokenization, key-management and a cryptographic hardware module at an unprecedented value. He has written many papers and spoken at many forums on the subject of encryption and key-management over the years.

 CANCELLED  

Topic – Secure Application design and Coding -- CANCELLED

Presenter - Josh Abraham, Rapid 7

Speaker Bio 

April 2011

Ed Adams Security Innovation -- the new OWASP Exams Project and the work being done by the OWASP Academies Working Group

March 2011

Josh Abraham, Rapid 7

Owning the world, one mobile app at a time, and web services pen testing.

Febrary 2011

Rob Cheyne, CEO of Safelight Security -

Security Leadership series: Delivering a successful security presentation

December 2010

Application Architecture Security Assessment - Second session

Rob Cheyne, CEO SafeLight Security Advisors

November 2010

Open SAMM – Software Assurance Maturity Model

Shakeel Tufail is the Federal Practice Manager at Fortify, an HP company.

October 2010

Rob Cheyne, CEO SafeLight Security Advisors Overview: In this highly interactive two-part workshop, Rob Cheyne of Safelight Security will show you the basics of conducting a real-world architecture &amp; design review. This workshop draws from Safelight's Security Architecture Fundamentals training course, a two-day course frequently used to teach Fortune 500 companies how to look at their system architectures from both the hacker's and the designer’s point of view.

July 2010

Lightning Talk – Rob Cheyne, CEO Safelight Security Advisors In this installment of the Safelight lightning talks series, Rob will present the basics of a Cross-site Request Forgery (CSRF).

Main Presentation - Drive-by Pharming with MonkeyFist

Joey Peloquin - Director of Application Security, Fishnet Security

June 2010

Rob Cheyne Lightning Talk - topic to be announced

Main Presentation - Ryan Barnett The Web Hacking Incident Database (WHID) is a Web Application Security Consortium project dedicated to maintaining a list of web applications related security incidents. Ryan Barnett is director of application security research at Breach Security where he leads Breach Security Labs.

May 2010

Rob Cheyne Lightning Talk - SQL Injection

Vinnie Liu - Data Exposure, New Approaches to Open Source Intelligence Techniques, and Incident Handling

April 2010

Dan Hestad Security Innovation Dan will be talking about his experiences with PCI and web applications, and answering questions about do's and don'ts of acceptable PCI practices in web applications.

March 2010

Zack Lanier - Disclosure Samsara, or "the endless vulnerability disclosure debate"

http://n0where.org/talks/samsara_20100310.html

http://n0where.org/talks/samsara_20100310.pdf (very large PDF)

February 2010

Rob Cheyne of Safelight Security Advisors; New Technology, Same Old Vulnerabilities

January 2010 at Microsoft NERD, Cambridge

Josh Abraham, Rapid 7 Technologies

December 2009

Eric Bender, Cenzic

November 2009

Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels - Web Application Vulnerability Scanners

Mush Hakhinian, Leader, Application Security Practice, IntraLinks - Secure coding with no money down using SONAR: unleashing the power of open-source code analysis tools

October 2009

Paul Schofield, Senior Security Engineer, Imperva - From Rivals to BFF: WAF &amp; VA Unite

September 2009 at CORE Technologies, Boston

Paul Asadoorian, Pauldotcom.com

Alex Horan, CORE Security

May 2009

Joey Peloquin, Fishnet Security, Secure SDLC: The Good, the Bad and the Ugly presentation pdf

March 2009

Sabha Kazerooni, Security Compass - Exploit Me tools; Framework Level Threat Analysis

ExploitMe Document

Framework Level Threat Analysis document

Meeting Pizza Sponsor - Arcot

Arcot is a leader in online fraud prevention, strong authentication and eDocument security. Arcot's solutions are easily deployed, low-cost and extremely scalable, allowing organizations to transparently protect their users from fraud without changing user behavior or requiring expensive hardware.

Arcot can be contacted thru Michael Kreppein, michael.kreppein@arcot.com, 617-467-5200

December 2008

Brian Holyfield, Gothem Digital Science

Tamper Proofing Web Applications http://www.gdssecurity.com/l/b/2008/12/04/

June 2008

Jeremiah Grossman; Founder and CTO, Whitehat Security

Appetizer - Hacking Intranets from the Outside (Just when you thought your network was safe) Port scanning with JavaScript

Main Topic - Business Logic Flaws: How they put your Websites at Risk

March 2008

Chris Eng; Senior Director, Security Research, Veracode

Description – Attacking crypto in web applications

December 2007

Scott Matsumoto; Principal Consultant, Cigital

Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security

Cigital Presentation

November 2007

Tom Mulvehill Ounce Labs

Description – Tom will share his knowledge and expertise on implementing security into the software development life cycle. This presentation will cover how to bring practicality into secure software development. Several integration models will be explored as well as solutions for potential obstacles

Ounce presentation

October 2007

George Johnson, Principal Software Engineer EMC; CISSP

An Introduction to Threat Modeling.

September 2007

Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century"

June 2007

Tool Talk - Jim Weiler - WebGoat and Crosssite Request Forgeries

Danny Allan; Director, Security Research, Watchfire

Topic: Exploitation of the OWASP Top 10: Attacks and Strategies

March 2007

Jeremiah Grossman, CTO Whitehat Security: Top 10 Web Application Hacks of 2006

January 2007

Dave Low, RSA the Security Division of EMC: encryption case studies

November 2006

September 2006

Mike Gavin, Forrester Research: Web Application Firewalls

June 2006

Imperva - Application and Database Vulnerabilities and Intrusion Prevention

Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool

May 2006

April 2006

Dennis Hurst; SPI Dynamics: A study of AJAX Hacking

Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!

March 2006

Mateo Meucci; OWASP Italy Anatomy of 2 web attacks

Tom Stracener; Cenzic Web Application Vulnerabilities

February 2006

Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source

January 2006

David Low, Senior Field Engineer: RSA Practical Encryption

December 2005

Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled

November 2005

Robert Hurlbut, Independent Consultant Threat Modeling for web applications

October 2005

Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges

Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways

September 2005

Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security

July 2005

Mark O'Neill, CTO: Vordel - [http://www.owasp.org/docroot/owasp/misc/MarkOneill.pdf Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security]

June 2005

Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools

May 2005

Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom

April 2005

Jonathan Levin - Of Random Numbers

Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security

March 2005

Joe Stagner: Microsoft Let's talk about Application Security

Feb 2005

Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.

Boston OWASP Chapter Leaders
President

- [mailto:jim.weiler@owasp.org Jim Weiler] 781 356 0067

Program Committee

- Mark Arnold

Communications Director

- Yolanda Liu