Tampa

Welcome to the OWASP Tampa Local Chapter
Anyone in our area interested in information security is welcome to attend. Our meetings are informal and encourage open discussion of all aspects of application security. We invite attendees to give short presentations about specific topics.

We have a mailing list at: https://lists.owasp.org/mailman/listinfo/owasp-tampa

If you have any questions about the Tampa chapter, please send an email to the chapter leaders Jonathan Singer, Brian Beaudry, and Sunny Wear via the above mailing list.

The Tampa chapter is sponsored by GuidePoint Security and ISC2.

Join the OWASP Tampa LinkedIn group here.

A reminder that CISSPs can earn 1 CPE credit for every hour of attendance at OWASP meetings.

Next Meeting
Our next meeting will be held on Thursday, December 10th, 2015 from 6PM to 8PM.

Our first speaker will be Benjamin Watson from GuidePoint Security. Benjamin will be presenting Reverse Engineering Android for Pride and Glory. His abstract and bio are below.

Our second speaker will be Sunny Wear from FIS Global. Sunny will be presenting Care & Feeding of Programmers: Addressing App Sec Gaps with HTTP Headers. Her abstract and bio are below.

This will be my final Chapter Meeting as Chapter Leader. We will discuss the transition during the meeting as well.

Presentations
Benjamin Watson, Reverse Engineering Android for Pride and Glory

Abstract This presentation will serve as an introduction for those who want to dive into the art of reverse engineering Android applications and firmware. We will explore the inner workings of the Android architecture, traverse the landscape of reverse engineering tools and techniques, and propose some practical methodologies and workflows for all your bug hunting needs.

Bio Benjamin Watson has over 7 dedicated years in application and mobile security. Prior to joining GuidePoint Security, Ben has been solving mobile & application security problems for cutting edge companies in the financial services, eCommerce, and medical industries. Often Ben has been sought after for building application security programs from the ground up. This is due to his experience in not only developing testing methodologies, tools, and techniques, but his understanding and perspective around what it requires to build secure products. Ben has managed and lead efforts in large mobile application security service initiatives, and is also an experienced mobile security researcher. He currently focuses his efforts around discovering new exploitable vulnerability patterns in Android and iOS. He also has multiple published zero day vulnerabilities effecting various Android web browsers, and is the creator and curator of the Android assessment toolkit called Lobotomy.

Sunny Wear, Care & Feeding of Programmers: Addressing App Sec Gaps with HTTP Headers

Abstract Ever found persistent gaps in your web application despite your programmers BEST efforts to mitigate them? Ever wondered if the seemingly endless list of vulnerabilities in your application would ever stop and how you will ever have all of the time and budget to address them all? Though there are no silver bullets, there may be some simple steps programmers can do to cover some of the inadvertent gaps left behind when addressing application security vulnerabilities. Join us at the OWASP December meeting for the talk entitled “Care and Feeding of Programmers: Addressing App Sec Gaps with HTTP Headers” as we look into possible solutions to address such gaps.

Bio Sunny Wear is an application security architect. Her breadth of experience includes network, data, application and security architecture as well as programming across multiple languages and platforms. In her 20 years of professional experience, she has participated in the design and creation of many enterprise applications as well as the security testing aspects of platforms and services. She is the author of several security-related books including her most recent entitled Secure Coding Field Manual: A Programmer's Guide to OWASP Top 10 and CWE/SANS Top 25, which assists programmers in more easily finding mitigations to commonly-identified vulnerabilities within applications. She conducts security talks and classes including “Web App Pentesting using BurpSuite” by ISC2 and is recently been an invited speaker for BSides Tampa.

Meeting Location
Our next meeting will be held at the GuidePoint Security office in Downtown Saint Petersburg. The address is:

146 2nd Street North, Suite 106, Saint Petersburg, FL 33701

Cash only parking is available across the street in the Muvico parking lot.

Presentation Archives
OWASP Tampa Day 2014 - Shadow IT Does Not Have To Be Shady - Scott VanWart - Presentation Slides here

OWASP Tampa Day 2014 - Offensive Mobile Forensics - Joey Peloquin - Presentation Slides here

OWASP Tampa Day 2014 - OWASP Top 10 for MVC 4 and Greater - James Davis - Presentation Slides here

OWASP Tampa Day 2014 - Application Centric Mobile Application Security Model - Daniel Bender - Presentation Slides here

OWASP Tampa Day 2014 - Intern down for what? - Tony Turner - Presentation Slides here

2014-Q3 - Do we really know the OWASP Top 10? - Jon Singer - Presentation Slides here

2014-Q1 - Herding Cats - Carl Brothers - Presentation Slides here

2014-Q1 - The Enemy Within - Ramece Cave - Presentation Slides here

OWASP Tampa Day 2013 - Securing Your Applications' Data With Web Application Firewalls - Dennis K. Usle - Presentation Slides here

OWASP Tampa Day 2013 - Bring Your Own Service - Doug Maul - Presentation Slides here

OWASP Tampa Day 2013 - Design Consideration & Guiding Principles for Implementing Cloud Security - Bill Sterns - Presentation Slides here

OWASP Tampa Day 2013 - Let's Get Right To The Endpoint - Mel Pless - Presentation Slides here

OWASP Tampa Day 2013 - Vulnerability Management That Works - Tony Turner - Presentation Slides here

2012-Q3 - Taming the B.E.A.S.T. - Richard Newman - Presentation Slides here

OWASP Tampa Day 2012 - Changing the Game - Jason Kent - Presentation Slides here

OWASP Tampa Day 2012 - MDM Technical Presentation - Keith Katz - Presentation Slides here

OWASP Tampa Day 2012 - Federated Identities in the Real World - Nathan Sargent - Presentation Slides here

OWASP Tampa Day 2012 - Define and Optimize Your Approach to Application Security - Bruce Jenkins - Presentation Slides here

OWASP Tampa Day 2012 - Anonymous: Lessons Learned - Bill Church - Presentation Slides here

2012-Q1 - Protecting Against SQLi in Real-Time - Stuart Hancock - Presentation Slides

2011-Q4 - How Not to Build Android Apps - Jack Mannino - Presentation Slides here

2011-Q4 - Behind Enemy Lines: Practical & Triage Approaches to Mobile Security Abroad - Justin Morehouse - Presentation Slides here

2011-Q3 - Hiding in Plain Sight - Ramece Cave - Presentation Slides here

2011-Q3 - PCI Compliance 2.0 - Kate Mullin - Presentation Slides here

OWASP Tampa Day 2011 - PCI for Developers: Lessons from the Real World - Trevor Hawthorn - Presentation Slides here

OWASP Tampa Day 2011 - Top Website Vulnerabilities: Trends, Business Effects and How to Fight Them - Rinaldi Rampen - Presentation Slides here

OWASP Tampa Day 2011 - How to Defend the Universe from Evil-doers: A Guide for Software Developers and Security Teams - Bruce Jenkins - Presentation Slides here

OWASP Tampa Day 2011 - Analysis of Deadly Combination of XSS and CSRF - Sherif Koussa - Presentation Slides here

2011-Q1 - Real Lessons of Deploying Static Analysis in Development Groups - Jeff LoSapio - Presentation Slides here

2011-Q1 - Intelligence Gathering for Penetration Testers: Opening Doors with Metadata - Chris Patten - Presentation Slides here

2011-Q1 - Vulnerability Management in an IPv6 World - Richard Newman &amp; Brett McKinney - Presentation Slides here

2010-Q4 - Nessus Bridge for Metasploit - Zate Berg - Presentation Slides here

2010-Q2 - Stealing Guests...The VMware Way - Justin Morehouse &amp; Tony Flick - Presentation slides here

2010-Q1 - The New World of Smartphone Security - Trevor Hawthorn - Presentation slides here

2009-Q3 - Hacking the Smart Grid - Tony Flick - Presentation slides here

2009-Q2 - Open SAMM - Zate Berg - Presentation slides here

2009-Q1 - XSS Anonymous Browser - Matt Flick - Presentation slides here

2008-Q4 - Google Code Search : The pitfalls of Copy/Paste - Tony Flick - Presentation slides here