Italy OWASP Day 4

Back to the Italian Chapter



WELCOME
Introduction

Welcome to the OWASP Day IV Italy Conference for 2009. Following on from the great success of last OWASP Days, the new conference has takne place in November 2009 in Milan.

Organization and goals:


 * The event showed several points of discussion: we presented the state of the art of the Secure Software Initiatives and technical speeches about the new researches in Application Security.
 * As conclusion of the day, we organized a round table discussing the most interesting subjects came out during the event.
 * Conference goal is creating a debate on which will be the evolution of the research for the Web Application Security, and how to start a secure software initiative.

References:

"Avete finito di imbottire le vostre reti di firewall e altre diavolerie simili? Allora è tempo di cambiare prospettiva e rendersi conto che oggi, dopo aver messo in sicurezza il perimetro dei nostri sistemi informativi, le minacce più serie provengono dalle nostre stesse applicazioni che, a volte, non sono progettate ed implementate, tenendo conto delle migliori pratiche di sviluppo di software sicuro. In questo campo l’OWASP rappresenta un punto di riferimento costante ed una miniera di informazioni e strumenti, ed al Ministero dell’Istruzione, Università e Ricerca abbiamo imparato ad apprezzarne i materiali e le informazioni disponibili sul suo sito web, nell’ambito del nostro gruppo che si occupa di sicurezza del sistema informativo. Per conoscere le iniziative dell’OWASP, avere un’anteprima delle principali novità in tema di sicurezza del software, incontrare i maggiori esperti in questo settore, partecipate all’OWASP DAY – ITALY IV il 6 novembre prossimo a Milano, sarà un’occasione utilissima di approfondimento." Paolo De Santis – Dirigente della Direzione Generale per gli Studi, la Statistica ed i Sistemi Informativi del MIUR

“L’OWASP Day è il luogo e il momento per incontrare altri professionisti e appassionati del settore. E’ un’opportunità per conoscere direttamente dai protagonisti le metodologie, le tecniche e gli ambiti di ricerca nel mondo della sicurezza applicativa divenuto ormai il fattore principale, insieme a quello umano, nel campo dell’Information Security. “ Massimo Trevisani—CSO IWBank

"Le conferenze OWASP in Italia rappresentano un momento importante di awareness sulla sicurezza applicativa. L'evento rappresenta un punto di riferimento in cui i professionisti dell'IT possono valutare nuovi approcci allo sviluppo sicuro del software e alla difesa delle proprie applicazioni on-line" Marco Bavazzano—CISO Telecom Italia

Key Speakers:

Marco Morana — CISO Citigroup Marco Morana serves the OWASP organization by leading the USA Cincinnati chapter  and he is a key contributor of many OWASP projects. Marco works as Technology Information Security Officer for a large financial organization in North America with responsibilities in the definition of the software security coding standards, management of security assessments during the SDLC related to application security. The aim of this presentation is help application security practitioners such as project managers and information security officers to make business cases for software security initiatives. The presentation will first introduce the need to position the organization’s Software Security Initiatives with respect to software security models such as BSIMM and SAMM. In order to create the business case for software security it is essential to make the case for business (e.g. costs) as well as security (e.g. engineering, vulnerability management).

Tobias Christen — CTO, DSwiss Ltd Tobias began his career  in a research team of a swiss bank specializing in new internet technologies. He then went on to join a leading international security-software company - Stonesoft - where he served as Head of R&D, Head of Product Management, and CTO of the company. For several years Tobias was working at Zurich Financial Services where he built up a new security architecture, and developing their IT risk strategy. In early 2008 Tobias joined DSwiss as CTO. In this presentation we look at some typical usability versus security mistakes. We see examples where lack of usability in security controls resulted in work arounds from users, and we also see typical examples where lack of security is blindly accepted. We discuss what is considered "acceptable" security by the general audience and discuss technologies that have a better usability versus security tradeoff.

Official invitation

Sponsors
If you want to become a Sponsor of the Initiative, please drop an email to: [mailto:matteo.meucci@owasp.org Matteo Meucci]

Gold Sponsors: http://www.owasp.org/images/b/b2/FortifyNew.JPG http://www.owasp.org/images/8/84/IBM.pnghttp://www.owasp.org/images/8/8e/Rational.gif http://www.owasp.org/images/c/cb/Vasco.jpg

Silver Sponsors: