AppSec USA 2014

=ABOUT= AppSec USA is a world-class software security conference for developers, auditors, risk managers, technologists, and entrepreneurs gathering with the world’s top practitioners to share the latest research and practices, in the high energy atmosphere of Downtown Denver. Why should you attend? Insightful keynote addresses delivered by leading industry visionaries from thought leaders of critical infrastructure. Over 50 sessions across 5 tracks (developer, tester, operations, workshops, and legal) with world-renowned subject matter experts An all-new Legal Track to address industry regulations, privacy laws, liability, and more A hands-all Workshop Track providing instruction on essential security tools and skills Thousands of attendees exclusively focused on Software Security Extensive Capture the Flag competition developed exclusively for AppSec USA 2014 Home-brewed beer competition open to all attendees Convenience of Downtown Denver Who should attend? Developers, Security Auditors, Risk Managers, Executive Management, Government, Press, Law Enforcement, Entrepreneurs If you have any questions, please email the conference committee: [mailto:appsecusa@owasp.org appsecusa@owasp.org]''' =TEAM=

AppSec USA would not be possible without the hard work of the following volunteers and staff: General Conference Chair: Mark Major Wiki: https://www.owasp.org/index.php/User:Mark_Major Email:: mark dot major at owasp dot org Speaker and Trainer Selection Chair: Steve Kosten Wiki: https://www.owasp.org/index.php/User:Steve_Kosten Email: steve dot kosten at owasp dot org Conference Volunteers: Chris Campbell Rob Jepson Sunil Kollipara Brad Carvalho Ann Marie Ronan OWASP Staff Sarah Baso @OWASPgirl LinkedIn: http://www.linkedin.com/pub/sarah-baso/2a/69/53a Kelly Santalucia @KellySantalucia LinkedIn: www.linkedin.com/pub/kelly-santalucia/30/59b/2b3/ Samantha Groves @SamanthaOWASP LinkedIn: http://www.linkedin.com/in/samanthagroves Kate Hartmann @kate_hartmann LinkedIn: http://www.linkedin.com/pub/kate-hartmann/8/968/786/ Laura Grau LinkedIn: http://www.linkedin.com/pub/laura-grau/27/639/461 Alison Shrader LinkedIn: http://www.linkedin.com/pub/alison-shrader/5/328/91b Matt Tesauro @matt_tesauro LinkedIn: http://www.linkedin.com/in/matttesauro

=CALL FOR PRESENTATIONS= The call for presentations (CFP) is currently open. Submit your talks HERE. Dates and deadlines Topics of interest Conference sessions will be divided into four primary tracks and two smaller supporting tracks. Consistent with OWASP, each track will relate in part to web application security. The primary tracks are: The secondary tracks are: We invite all practitioners of application security and those who work or interact with all facets of application security to submit presentations including, but not limited to the following subject areas: Submission Format Only submissions entered into http://cfp.appsecusa.org will be considered. Please have the following information handy. -Presentation overview -Format (lecture, group panel, live demo, audience participation, etc.) -Objectives and outcomes -Previous conference speaking experience -Links to videos of past speaking engagements Judging Criteria All content assessments will be performed blind. Content reviewers will have no knowledge of the presenter’s identity. All uploaded materials must be sanitized of author names and affiliations, email addresses, and other personally-identifiable information. A second evaluation will occur based on speaker experience. The final presentation score will be a composite of the two evaluations. The following criteria will be used during evaluation. -Integration of live demonstrations into the presentation -Free and open distribution of source code, exploits, tools, and other materials relevant to the talk Terms All speakers must provide written agreement to the OWASP Speaker Agreement after notification of acceptance.
 * April 27th, 2014: Submission deadline
 * May 30th, 2014: Notification of acceptance
 * August 4th, 2014: Final materials due for review
 * September 18th – 19th, 2014: Conference proceedings
 * Builders: Targeting developers, testers, and managers involved in the secure software development lifecycle.
 * Breakers: Focusing on matters relevant to penetration testers, researchers, and other security professionals.
 * Defenders: Emphasizing operations issues affecting infrastructure security teams, administrators, support, etc.
 * Policy and Legal: Addressing privacy, compliance, and legal issues affecting development and security communities.
 * OWASP-specific: Status, recruiting, and awareness for OWASP projects; board panels; leadership workshops; etc.
 * Hands-On Skills Lab: Introductory workshops designed to familiarize attendees with critical tools (e.g., “nmap 101″).
 * Secure development: secure coding, static analysis, application threat modelling, web frameworks security, countermeasures, SDLC, DevOps, etc.
 * Mobile security: Development and/or testing devices and the mobile web
 * Cloud security: Offensive and defensive considerations for cloud-based web applications
 * Infrastructure security: Database security, VoIP, hardware, identity management
 * Penetration testing: Methodologies, tools, exploit development, evasion techniques, OSINT, etc.
 * Emerging web technologies and associated security considerations
 * Incident response: Threat detection, triage, malware analysis, forensics, rootkit detection
 * OWASP tools and projects in practice
 * Policy and legal: Legislation, privacy, regulations and compliance, C-level considerations, etc.
 * Cool hacks and other fun stuff: cryptography, social engineering, etc.
 * Presentation title
 * Contact information (speaking name, organizational affiliation, email)
 * Abstract, including the following information:
 * Speaker background, including the following information:
 * Anything else we should know about you or your presentation
 * Strength of presentation
 * Vendor neutrality
 * Topicality (fresh research, innovative solutions, relevance to current events, etc.)
 * Depth of content (deeply technical talks are preferred to high-level talks)
 * Relevance to conference tracks
 * Relevance to industry trends
 * Relevance to OWASP or OWASP projects
 * Presentation length (45-50 minute talks are preferred)
 * Strength of speaker
 * Clarity of submission: Demonstrated speaking ability (previous experience, videos of prior speaking engagements, etc.)
 * Bonus points:

=CALL FOR TRAININGS= The call for training (CFT) is currently open. Submit your talks HERE. Dates and deadlines Topics of interest Training related to web application security will be prioritized. These include, but are not limited to: Submission Format Only submissions entered into http://cft.appsecusa.org will be considered. Please have the following information handy. -Course overview -Target audience (roles, experience, ideal number of participants) -Objectives and outcomes (what results should trainees expect?) -Assumptions -Constraints Terms WASP Foundation obligations: Instructor obligations: Revenue split Courses are priced as follows: Earnings will be split 60/40 (OWASP/Trainer) for each training class. Instructors have the option to donate proceedings to the OWASP Foundation and/or OWASP project of choice, or to receive travel expenses as sole compensation for training and donate the remaining revenue.
 * April 13th, 2014: Submission deadline
 * May 5th, 2014: Notification of acceptance
 * August 5th, 2014: Final materials due for review
 * September 16th – 17th, 2014: Conference training
 * Secure development: secure coding, static analysis, application threat modelling, web frameworks security, countermeasures, SDLC, DevOps, etc.
 * Mobile security: Development and/or testing devices and the mobile web
 * Cloud security: Offensive and defensive considerations for cloud-based web applications
 * Infrastructure security: Database security, VoIP, hardware, identity management
 * Penetration testing: Methodologies, tools, exploit development, evasion techniques, OSINT, etc.
 * Emerging web technologies and associated security considerations
 * Incident response: Threat detection, triage, malware analysis, forensics, rootkit detection
 * OWASP tools and projects in practice
 * Privacy: Legislation, compliance, etc.
 * Course title
 * Course instructor(s) and contact information
 * Abstract, including the following information:
 * Trainer biography (include past training engagements)
 * Additional comments:
 * Anything else we should know about you or this course
 * Course marketing mailing lists and official conference channels
 * Registration services
 * Training room with sufficient seating (e.g. table/chair) for registered attendees
 * Single projector and screen
 * Chalkboards, whiteboards, easels, or other fixtures (on request)
 * One (1) full conference pass
 * One (1) conference pass 50% discount code (not stackable with other offers)
 * One (1) seat in training class at no additional cost
 * Timely payment of instructor fees
 * Feedback from course attendees
 * Status updates on the current number of students enrolled (on request)
 * Course materials for students, including syllabus or other hand-outs
 * Distribution and collection of course evaluation forms
 * Travel and accommodations for instructor(s)
 * Marketing of the training course through normal instructor methods
 * Laptop or other presentation device
 * Completed W-9 for (for US-based trainers)
 * Two (2) seats in training class at no additional cost
 * One-day course: $800
 * Two-day course: $1,600

=KEYNOTE SPEAKERS=

Bruce Schneier is an internationally renowned security technologist, called a “security guru” by The Economist. He is the author of 12 books — including Liars and Outliers: Enabling the Trust Society Needs to Thrive — as well as hundreds of articles, essays, and academic papers. His influential newsletter “Crypto-Gram” and his blog “Schneier on Security” are read by over 250,000 people. He has testified before Congress, is a frequent guest on television and radio, has served on several government committees, and is regularly quoted in the press. Schneier is a fellow at the Berkman Center for Internet and Society at Harvard Law School, a program fellow at the New America Foundation’s Open Technology Institute, a board member of the Electronic Frontier Foundation, an Advisory Board Member of the Electronic Privacy Information Center, and the Chief Technology Officer at Co3 Systems, Inc. Keynote speaker Gary McGraw shares his insights on Software Security. Dr. McGraw is CTO of Cigital, Inc., a software security consulting firm for some of the world’s best-known companies. An author of multiple best-selling books, many know of him through his contributions to publications, journals and his monthly security podcast. Gary knows where computer security started and provides valuable insight to where it is going. His advice is sought by company directors, federal government, academia and technologists alike. Gary is firmly rooted in country living. Growing up in the woods of Tennessee, he lives near the Appalachian trail in Virginia.

=VENUE & TRAVEL= Denver Marriott City Center

1701 California St. Denver, CO 80202-3402 Phone: 1-303-297-1300 / 1-800-228-9290 Denver Marriott City Center is centrally located in the heart of Downtown Denver within walking distance of many of the city’s best attractions, to include entertainment, cultural venues and shopping and dining. With views of the Rocky Mountains and easy access to all that Colorado has to offer, your stay at the Denver Marriott City Center is sure to make you fall in love with our fine city!

Hotel Rates

City Attractions and Activities

Coors Field Sports Authority Field at Mile High Denver Convention Center Denver Performing Arts Center Buell Theatre 16th Street Pedestrian Mall Larimer Square LoDo District Denver Mint Cherry Creek Mall Molly Brown House Denver Zoo Denver Museum of Natural History Travel & Transportation

Valet parking, fee: $32 USD daily Off-site parking fee: $15 USD hourly, $32 USD Daily Amtrak-DEN: 1 mile Denver International Airport – DIA

Visit DIA airport website

Hotel direction: 26 mile(s) SW

Driving directions: Take Interstate 70 West to Interstate 25 and follow Interstate 25 South to the 20th Street exit in downtown Denver. Turn left onto 20th Street and continue to Arapahoe Street. Turn right and proceed to 19th Street. Turn left and travel four blocks to Califronia Street. Turn right and the hotel entrance is the first right after 18th Street.

This hotel does not provide shuttle service.

Alternate transportation: SuperShuttle; fee: 23 USD (one way) ;on request Bus service, fee: 11 USD (one way) Estimated taxi fare: 65 USD (one way)

=REGISTRATION=

Registration will soon be opened. Stay tuned!

= SPONSORS =

Want to sponsor this event?


 * Click Here to Access the Sponsorship Prospectus **

Open Web Application Security Project (OWASP) is an open-source, not-for-profit application security organization made up of corporations, educational organizations, and individuals from around the world. Providing free, vendor-neutral, practical, cost-effective application security guidance, the organization is the de-facto standards body for web application security used by developers and organizations globally.

Join 1,500+ attendees. Executives from the Fortune 500, thought leaders, security architects and developers, gather to share cutting-edge ideas, initiatives and technology advancements.

Two days of training and two day conference Keynote addresses by world renowned Industry experts Exhibit area offering solutions to your application security challenges Global Reach: OWASP supports 30,000+ individual participants, more than 65 organizational and 60 academic supporters via 200 local chapters in 75+ countries across 6 continents.

Important to all Industries: Access to key representatives and decision-makers from major Financial Services, Insurance, e-Commerce, Retail, Pharmaceutical, and Government sectors World renowned speakers Conference is exclusively focused on Application Security to provide solutions to your problems Downtown Denver – With views of the Mountains – what more could you ask for? Discounts for OWASP Corporate Supporters