Belgium

Local News
Block your agenda's for the next chapter meeting in Brussels on the 16th of June, 18h-21h with:
 * The OWASP AppSensor Project (by Colin Watson, Watson Hall Ltd)
 * tbd (by tbd)

Structural Sponsors 2010
OWASP Member affiliated to the Belgium chapter:

OWASP Belgium thanks its structural chapter supporters for 2010 and the OWASP BeNeLux Day 2010:

http://www.owasp.org/images/7/7e/50px-F5_50px.jpg http://www.owasp.org/images/e/e6/Zionsecurity.jpg http://www.owasp.org/images/8/82/Rad_logo.gif http://www.owasp.org/images/d/df/SAIT_Zenitel.jpg

If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]

Belgium

WHEN
16th of June 2011 18h-21h00

WHERE
TBD

PROGRAM
The agenda:


 * 18h00 - 18h30: Welcome &amp; Sandwiches
 * 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
 * 18h45 - 19h45: The OWASP AppSensor Project (by Colin Watson, Watson Hall Ltd)
 * More details to follow


 * 19h45 - 20h00: Break
 * 20h00 - 21h30: TBD (by TBD)
 * More details to follow

REGISTRATION
Please register via RegOnline: registration will open once location is known.

WHEN
March 1st 2011 18h-21h30

WHERE
Hosted by Distrinet Research Group (K.U.Leuven).

Address: Department of Computer Science (auditorium 00.225) Celestijnenlaan 200 A 3001 Heverlee

Routemap: http://distrinet.cs.kuleuven.be/about/route/

PROGRAM
The agenda:


 * 18h00 - 18h30: Welcome &amp; Sandwiches
 * 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
 * 18h45 - 19h45: The Thinking Person's Guide to the Cloud. HOWTO: Keep your head in the clouds and your feet on the ground (by Gunnar Peterson, Arctec Group)
 * “Everything we think of as a computer today is really just a device that connects to the big computer that we are all collectively building"-Tim O'Reilly
 * My friend Chris Hoff asked this question in a recent podcast - "why is the OWASP Top Ten the same year after year? why don't these things gets fixed?"[1]. The reason is that software security and security architecture and design is nowhere near as a high priority as it needs to be.
 * If you look at the evolution of software over the years, you will see a history of more and more systems and data being connected together. Beginning with the Web through to component based application and then to Web services, at each step the common theme is more connectivity, more integration. Software is a rapidly changing universe
 * Unfortunately, Information Security has not kept up. Our field started out promisingly in the mid-90s with network firewalls and SSL for security mechanisms to defend websites, but that is about as far it got. In 1999 when SOAP emerged as a firewall-friendly protocol designed for the explicit reason to go through the firewall, that should have been a wake up call to Information Security that the "firewall + SSL" security architecture was past its prime, but here 10 years later we are still hitting the snooze button.
 * My view is that as technology is deployed we need security mechanisms that form fit to those new technologies, instead what we have is security technologies that form fit to auditor's excel spreadsheets.
 * Gunnar Peterson is a Managing Principal at Arctec Group. He is focused on distributed systems security for large mission critical financial, financial exchanges, healthcare, manufacturer, and insurance systems, as well as emerging start ups. Mr. Peterson is an internationally  recognized software security expert, frequently published, an Associate Editor for IEEE Security & Privacy Journal on Building Security In, a contributor to the SEI and DHS Build   Security In portal on software security, a Visiting Scientist at Carnegie Mellon Software Engineering Institute, and an in-demand speaker at security conferences. He maintains a popular informationsecurity blog at http://1raindrop.typepad.com.


 * 19h45 - 20h00: Break
 * 20h00 - 21h30: Threat modeling (by John Steven, Cigital)
 * How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management. Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.
 * John Steven is Senior Director of Advanced Technology Consulting at Cigital with over a decade of hands-on experience in software security. John's expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, John has provided strategic direction as a trusted adviser to many multi-national corporations. John's keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine and speaks with regularity at conferences and trade shows. John holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.
 * John leads the Virginia OWASP Northern Virginia (NoVA) chapter.

Past Events

 * Events held in 2010
 * Events held in 2009
 * Events held in 2008
 * Events held in 2007
 * Events held in 2006
 * Events held in 2005

Belgium OWASP Chapter Leaders
The BeLux Chapter is supported by the following board:


 * Erwin Geirnaert, Zion Security
 * Philippe Bogaerts, F5
 * André Mariën, Inno.com
 * Lieven Desmet, K.U.Leuven
 * Joël Quinet, Telindus
 * Sebastien Deleersnyder, Zenitel
 * Bart De Win, Ascure

Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.