Boston

Local News
Boston

To find out more about the Boston chapter, just join the OWASP Boston mailing list.

Local Chapter Information --- Our Sixth Year
The chapter shipping/mailing address is:

OWASP Boston 35 Wachusett Dr Lexington, MA. 02421

Reviews
Reviews of security podcasts

Chapter Meetings
We usually meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm.

Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.

Information for meeting updates about this and other Boston area user groups can also be found at BostonUserGroups.

Location
The Boston OWASP Chapter meets the FIRST WEDNESDAY of every month ( Unless a speaker can only present another night), 6:30 pm at the Microsoft offices at the Waltham Weston Corporate Center, 201 Jones Rd., Sixth Floor Waltham, MA.

From Rt. 128 North take exit 26 toward Waltham, East up the hill on Rt. 20. From Rt 128 South take exit 26 but go around the rotary to get to 20 East to Waltham. Follow signs for Rt. 117 (left at the second light). When you get to 117 turn left (West). You will cross back over Rt. 128. Jones Rd. (look for the Waltham Weston Corporate Center sign) is the second left, at a blinking yellow light, on Rt. 117 going west about 0.1 miles from Rt. 128 (I95). The office building is at the bottom of Jones Rd. Best parking is to turn right just before the building and park in the back. Knock on the door to get the security guard to open it. The room is MPR C.

Next Meeting   Wed. Feb. 3  STARTING OUR SIXTH YEAR
Agenda: 6:30 - 7 - what's happening in OWASP and how it might be useful to you, general Q+A, networking

7 - 9 Main Presentations

'''Main Presentation - New Technology, Same Old Vulnerabilities Rob Cheyne of Safelight Security Advisors

Technology often creates new, exciting and more efficient ways of doing business. The added efficiency and lower costs frequently drives a strong desire to implement the latest and greatest technology. The down side is that we often jump into new technology without fully considering the security implications, and inadvertently implement the same old vulnerabilities time and again.

Web services are a great example of this. Web services are a means of adding a web-based programming interface to nearly any legacy enterprise application, and they are being implemented across many industries at a rapid pace. In many cases we have seen that the implementers are not considering security at all, but merely functionality. This leads to a wealth of subtle security vulnerabilities.

In this talk, Rob Cheyne of Safelight Security Advisors will explore some ways that we consistently add risk to our organizations, uncover some ticking time bombs, and discuss some ways to improve the situation. He will explore ways that we can better apply security in the development lifecycle when implementing new technologies. Along the way, he will provide examples of classical vulnerabilities that show up in new technologies.

Bio Rob Cheyne is founder and CEO of Safelight Security Advisors, a leading information security training company. He is an application security expert who has taught security training classes to over 10,000 developers, architects, and managers, and executives. He has 20 years of information technology experience and has been working in information security since 1998. Rob has a solid combination of business and technical expertise, and over the years, he has played the role of software developer, systems integrator, security expert, consultant, trainer and entrepreneur. Rob's ability to bridge the communication gap between business and technology has led to him consulting for some of the largest and most respected global brands. He has worked for many top-tier organizations in the financial services, health care, retail and government sectors. As a security educator, he has made significant improvements to information security training techniques, incorporating accelerated learning into security courses to significantly increase their effectiveness. Prior to Safelight, Rob was a co-founder of @stake, a highly regarded pioneer in information security consulting. In this role, he led and conducted secure architecture and design reviews, secure code reviews, application penetration tests, and security audits for numerous Fortune 500 companies. He helped develop@stake's application security assessment methodologies, and led @stake's Application Security Center of Excellence for two years. Rob was also a co-author of the award-winning L0phtCrack password auditing software and he worked on @stake's SmartRisk Analyzer team, which was successfully spun-off as Veracode.  

Past Meeting Notes
November 2009

Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels - Web Application Vulnerability Scanners

Mush Hakhinian, Leader, Application Security Practice, IntraLinks - Secure coding with no money down using SONAR: unleashing the power of open-source code analysis tools

October 2009

Paul Schofield, Senior Security Engineer, Imperva - From Rivals to BFF: WAF & VA Unite

September 2009

Paul Asadoorian, Pauldotcom.com

Alex Horan, CORE Security

May 2009

Joey Peloquin, Fishnet Security, Secure SDLC: The Good, the Bad and the Ugly presentation pdf

March 2009

Sabha Kazerooni, Security Compass - Exploit Me tools; Framework Level Threat Analysis

ExploitMe Document

Framework Level Threat Analysis document

Meeting Pizza Sponsor - Arcot

Arcot is a leader in online fraud prevention, strong authentication and eDocument security. Arcot's solutions are easily deployed, low-cost and extremely scalable, allowing organizations to transparently protect their users from fraud without changing user behavior or requiring expensive hardware.

Arcot can be contacted thru Michael Kreppein, michael.kreppein@arcot.com, 617-467-5200, www.arcot.com

December 2008 Main Speaker - Brian Holyfield, Gothem Digital Science

Tamper Proofing Web Applications http://www.gdssecurity.com/l/b/2008/12/04/

June 2008 Main Speaker - Jeremiah Grossman; Founder and CTO, Whitehat Security

Appetizer - Hacking Intranets from the Outside (Just when you thought your network was safe) Port scanning with JavaScript

Main Topic - Business Logic Flaws: How they put your Websites at Risk

March 2008 Chris Eng; Senior Director, Security Research, Veracode

Description – Attacking crypto in web applications

December 2007 Scott Matsumoto; Principal Consultant, Cigital

Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security

Cigital Presentation

November 2007 Tom Mulvehill Ounce Labs

Description – Tom will share his knowledge and expertise on implementing security into the software development life cycle. This presentation will cover how to bring practicality into secure software development. Several integration models will be explored as well as solutions for potential obstacles

Ounce presentation

October 2007

George Johnson, Principal Software Engineer EMC; CISSP

An Introduction to Threat Modeling.

Feb 2005

Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.

March 2005

Joe Stagner: Microsoft Let's talk about Application Security

April 2005

Jonathan Levin - Of Random Numbers

Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security

May 2005

Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom

June 2005

Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools

July 2005

Mark O'Neill, CTO: Vordel - [http://www.owasp.org/docroot/owasp/misc/MarkOneill.pdf Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security]

September 2005

Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security

October 2005

Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges

Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways

November 2005

Robert Hurlbut, Independent Consultant Threat Modeling for web applications

December 2005

Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled

January 2006

David Low, Senior Field Engineer: RSA Practical Encryption

February 2006

Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source

March 2006

Mateo Meucci; OWASP Italy Anatomy of 2 web attacks

Tom Stracener; Cenzic Web Application Vulnerabilities

April 2006

Dennis Hurst; SPI Dynamics: A study of AJAX Hacking

Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!

May 2006

June 2006 Imperva - Application and Database Vulnerabilities and Intrusion Prevention

Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool

September 2006 Mike Gavin, Forrester Research:   Web Application Firewalls

November 2006

January 2007 Dave Low, RSA the Security Division of EMC:   encryption case studies

March 2007 Jeremiah Grossman,  CTO Whitehat Security:   Top 10 Web Application Hacks of 2006

June 2007 Tool Talk - Jim Weiler - WebGoat and Crosssite Request Forgeries

Danny Allan; Director, Security Research, Watchfire

Topic: Exploitation of the OWASP Top 10: Attacks and Strategies

September 2007

Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century"

Jim Weiler CISSP

Web Application Security and PCI compliance.

Boston OWASP Chapter Leaders
President

[mailto:jim.weiler@starwoodhotels.com Jim Weiler] 781 356 0067

Program Committee

Mark Arnold

[mailto:jim.weiler@starwoodhotels.com Jim Weiler] 781 356 0067