Difference between revisions of "AppSecAsiaPac2013"

From OWASP
Jump to: navigation, search
(Adding Training Course Info)
Line 11: Line 11:
  
 
|}
 
|}
 +
 +
 +
<font size=5pt>Conference Registration is now open! '''[http://sl.owasp.org/apac13_register Click Here to Register].'''</font>
  
  
Line 21: Line 24:
 
| style="width: 95%; color: rgb(0, 0, 0);" |  
 
| style="width: 95%; color: rgb(0, 0, 0);" |  
 
<font size=2pt>
 
<font size=2pt>
 
 
<font size=5pt>Conference Registration is now open! '''[http://sl.owasp.org/apac13_register Click Here to Register].'''</font>
 
 
 
'''About the Event:'''
 
  
 
We are pleased to announce that the [http://www.owasp.org/index.php/South_Korea OWASP South Korea chapter] will host the OWASP AppSec APAC 2013 conference in Jeju, South Korea at the Hyatt Regency Jeju. The event will be composed of 2 days of training (February 19-20), followed by 2 days of conference talks (February 21-22).   
 
We are pleased to announce that the [http://www.owasp.org/index.php/South_Korea OWASP South Korea chapter] will host the OWASP AppSec APAC 2013 conference in Jeju, South Korea at the Hyatt Regency Jeju. The event will be composed of 2 days of training (February 19-20), followed by 2 days of conference talks (February 21-22).   
Line 76: Line 73:
 
= Training  =
 
= Training  =
 
<font size=2pt>
 
<font size=2pt>
 +
 +
'''Overview of the training classes:'''  Scroll down for details on each course and trainer bios.
 +
 +
 +
{|border="0" class="FCK__ShowTableBorders" style="width: 85%;"
 +
|-
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | <font size=2pt>'''Course Name''' </font><br>
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | <font size=2pt>'''Trainer''' </font><br>
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | <font size=2pt>'''Course Length''' </font><br>
 +
| align="center" style="width: 15%; background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | <font size=2pt>'''Course Date(s)''' </font><br>
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | <font size=2pt>'''Language''' </font><br>
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(64, 88, 160); color: white;" | <font size=2pt>'''Price'''</font>
 +
|-
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Advanced Android and iOS Hands-on Exploitation Course
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Aditya Gupta and Subho Halder (XYSec)
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | 2 Days
 +
| align="center" style="width: 15%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Tuesday and Wednesday, Feb 19-20
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | English
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | $800 USD
 +
|-
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | HACKED - The OWASP Top 10 - Incident Response
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Chris Pogue (Trustwave Spiderlabs)
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | 2 Days
 +
| align="center" style="width: 15%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Tuesday and Wednesday, Feb 19-20
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | English
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | $800 USD
 +
|-
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | CISO training: Managing Web & Application Security for senior manager
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Tobias Gondrom (Thames Stanley)
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | 1 Day
 +
| align="center" style="width: 15%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Wednesday, Feb 20
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | English
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | $400 USD
 +
|-
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | HTML 5
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Kim TI (Core Security)
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | 1 Day
 +
| align="center" style="width: 15%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Wednesday, Feb 20
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Korean
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | $400 USD
 +
|-
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Developer Workshop: Approaching Secure Code – Where do I start?
 +
| align="center" style="width: 20%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Jim Manico
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | 1/2 Day (4 hours)
 +
| align="center" style="width: 15%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | Wednesday, Feb 20
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | English
 +
| align="center" style="width: 10%; background: none repeat scroll 0% 0% rgb(194, 194, 194);" | FREE
 +
|-
 +
|}
 +
 +
  
 
== Two Day Training Courses ==
 
== Two Day Training Courses ==
Tuesday & Wednesday, February 19-20, 2013
+
Two day training courses will take place on Tuesday & Wednesday, February 19-20, 2013. Training will run from 9am to 5pm each day with a 1 hour break for lunch.
 +
 
 +
 
 +
===Advanced Android and iOS Hands-on Exploitation Course===
 +
 
 +
'''Trainers:''' Aditya Gupta and Subho Halder (XYSec) <br>
 +
'''Audience:''' Management, Technical, DevOps, Developers <br>
 +
'''Level:''' Basic, Intermediate <br>
 +
'''Language:''' Training will be conducted in '''English'''
 +
 
 +
 
 +
'''Course Summary:'''<br>
 +
This fast-paced workshop will get you familiar with the various Android as well as iOS exploitation techniques, and bypassing most of the existing security models in both of the platforms. We will also discuss about a framework, which we have made for Android Exploitation, named as the Android Framework for Exploitation, which will help security researchers to perform automated and in-depth analysis of bug hunting and security assessment of Android Application and platforms.
 +
 
 +
For iOS, we will be looking into the application security assessment, creating a pentest environment, present sandboxing model, and much more.
 +
We will also be looking into Android rooting and iOS jailbreaking exploits, and recreate the scenario from the scratch.
 +
 
 +
'''[https://www.owasp.org/images/5/51/MobileHackingTrainingCourseStructure-Aditya_Subho.pdf Course Outline PDF]
 +
 
 +
 
 +
 
 +
'''Aditya Gupta''' is a renowned mobile security expert and information security researcher. Also being the lead developer and co-creator of Android Framework for Exploitation, he has done a lot of in-depth research on the security of mobile devices including Android, iOS and Blackberry.
 +
 
 +
He has also discovered serious security flaws in websites such as Google, Apple, Microsoft, Adobe, Skype and many more. In his work with XYSEC, he is committed to perform VAPT and Mobile Application Security Analysis. He has also been working with government clients and intelligence agencies in India, as well as providing them trainings and services on Malware Analysis, Exploit Development and Advanced Web App Hacking.
 +
 
 +
He has also previously spoken at a bunch of conferences including BlackHat, Toorcon, ClubHack, Nullcon, THC, Defcon India Chapter and many more.
 +
 
 +
 
 +
'''Subho Halder''' is a Programmer, Security Researcher and Penetration Tester. He loves writing exploits and programming in PHP, Java, Perl and Python. He is well equipped and has a deep understanding of Android and Blackberry frameworks.
 +
 
  
  
Line 104: Line 181:
  
  
===Advanced Android and iOS Hands-on Exploitation Course===
 
  
'''Trainers:''' Aditya Gupta and Subho Halder (XYSec) <br>
+
== One Day Training Courses ==
'''Audience:''' Management, Technical, DevOps, Developers <br>
+
One Day Training Courses will take place on Wednesday, February 20, 2013. Training will run from 9am to 5pm with a 1 hour break for lunch.
'''Level:''' Basic, Intermediate <br>
+
 
 +
 
 +
===CISO training: Managing Web & Application Security for senior managers===
 +
 
 +
'''Trainer:''' Tobias Gondrom (Thames Stanley)<br>
 +
'''Audience:''' Management<br>
 +
'''Level:''' Basic, Intermediate, Advanced <br>
 
'''Language:''' Training will be conducted in '''English'''
 
'''Language:''' Training will be conducted in '''English'''
  
  
 
'''Course Summary:'''<br>
 
'''Course Summary:'''<br>
This fast-paced workshop will get you familiar with the various Android as well as iOS exploitation techniques, and bypassing most of the existing security models in both of the platforms. We will also discuss about a framework, which we have made for Android Exploitation, named as the Android Framework for Exploitation, which will help security researchers to perform automated and in-depth analysis of bug hunting and security assessment of Android Application and platforms.  
+
Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. How to use and leverage OWASP and other common best practices to improve your security programs and organization. The workshop will also discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation. The author has extensive experience of managing his own secure development organization as well as advising to improve a number of global secure development organisations and processes.
  
For iOS, we will be looking into the application security assessment, creating a pentest environment, present sandboxing model, and much more.
+
Topics:
We will also be looking into Android rooting and iOS jailbreaking exploits, and recreate the scenario from the scratch.
+
  
'''[https://www.owasp.org/images/5/51/MobileHackingTrainingCourseStructure-Aditya_Subho.pdf Course Outline PDF]
+
*Managing Web & Application Security in large global organisations
 +
*OWASP Top-10 and OWASP projects - how to use within your organisation
 +
*Risk management and threat modeling methods (OWASP risk analysis, ISO-27005,...)
 +
*Benchmarking & Maturity Models
 +
*Organisational Design and managing change for global information security programs
 +
*Secure SDLC
 +
*Training: OWASP Secure Coding Practices - Quick Reference Guide, Development Guide, Training tools for developers
 +
*Measuring & Verification: ASVS (Application Security Verification Standard) Project, Code Review Guide, Testing Guide
 +
*Development & Operation: Frameworks and Tools, e.g. AppSensor
  
  
 +
All discussion and issues raised by participants at the workshop will be under the confidentiality under the Chatham House Rule (http://en.wikipedia.org/wiki/Chatham_House_Rule).
  
'''Aditya Gupta''' is a renowned mobile security expert and information security researcher. Also being the lead developer and co-creator of Android Framework for Exploitation, he has done a lot of in-depth research on the security of mobile devices including Android, iOS and Blackberry.
 
  
He has also discovered serious security flaws in websites such as Google, Apple, Microsoft, Adobe, Skype and many more. In his work with XYSEC, he is committed to perform VAPT and Mobile Application Security Analysis. He has also been working with government clients and intelligence agencies in India, as well as providing them trainings and services on Malware Analysis, Exploit Development and Advanced Web App Hacking.
+
'''Tobias Gondrom''' is Managing Director of Thames Stanley, a CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany. He has fifteen years of experience in software development, application security, cryptography, electronic signatures and global standardisation organisations working for independent software vendors and large global corporations in the financial, technology and government sector, in America, EMEA and APAC. As the Global Head of the Security Team at Open Text (2005-2007) and from 2000-2004 as the lead of the Security Task Force at IXOS Software AG, he was responsible for security, risk and incident management and introduced and implemented a secure SDLC used globally by development departments in the US, Canada, UK and Germany.  
  
He has also previously spoken at a bunch of conferences including BlackHat, Toorcon, ClubHack, Nullcon, THC, Defcon India Chapter and many more.  
+
Since 2003 he is the chair of working groups of the IETF (www.ietf.org) in the security area, member of the IETF security directorate, and since 2010 chair of the formed web security WG at the IETF, and a former chapter lead of the German OWASP chapter from 2007 to 2008, and currently board member of OWASP London and member of the OWASP Global Industry Committee. Tobias is the author of the international standards RFC 4998 and RFC 6283 (Evidence Record Syntax) and co-author and contributor to a number of internet standards and papers on security and electronic signatures, as well as the co-author of the book „Secure Electronic Archiving“ (ISBN 3-87081-427-6) and the OWASP CISO guide and frequent presenter at conferences and publication of articles (e.g. AppSec, IETF, ISSE, Moderner Staat, VOI-booklet “Electronic Signature“, iX).
  
  
'''Subho Halder''' is a Programmer, Security Researcher and Penetration Tester. He loves writing exploits and programming in PHP, Java, Perl and Python. He is well equipped and has a deep understanding of Android and Blackberry frameworks.
+
===HTML 5===
 +
 
 +
'''강사명:''' Kim TI (Core Security)  김태일 (코어시큐리티) <br>
 +
'''교육 참가자:''' 기술, 개발 및 운영, 개발자 <br>
 +
'''참가자의 기술 요구 수준:''' 중간 단계 <br>
 +
'''가능한 언어: 한국어'''
 +
 
 +
 
 +
'''교육 요약:'''<br>
 +
HTML5 에서 새롭게 추가된 기능들을 이용하여 웹 어플리케이션에서 발생할 수 있는 보안 위협/ 대응 및 완화 방법.
 +
 
 +
*XHR Level2 를 이용한 CSRF & CORS 우회
 +
*HTML5 에 새롭게 추가된 테그 및 속성을 이용한 XSS
 +
*자바스크립트를 이용한 Web Storage 정보 추출
 +
*자바스크립트를 이용한 WebSQL 정보 추출
 +
 
 +
 
 +
 
 +
'''교육 경험:'''
 +
 
 +
실무 / 강의 경력 13년
 +
 
 +
정보보안 기술교육을 중심으로 공공기관, 기업, 대학 강의
 +
 
 +
CEH /CHFI 해킹 및 컴퓨터포렌식 국제공인강사
 +
 
 +
IPv6 프로토콜 변환기 개발 참여 (2001년, I2Soft)
 +
 
 +
주민번호대체수단 I-PIN 모의해킹 수행 (2007년 한국정보보호진흥원)
 +
 
 +
 
 +
 
 +
現 ㈜코어시큐리티 대표이사 (CEO)
 +
 
 +
現 경찰수사연수원 외래교수
 +
 
 +
前 ㈜FSK시큐리티 지식사업부 부장
 +
 
 +
前 SH Information System 기술연구소 지식사업팀
 +
 
 +
前 보안 프리랜서 강사
 +
 
 +
 
 +
 
 +
[보유자격증]
 +
 
 +
CEH / CHFI /ECSA /LPT / CEI
 +
 
 +
 
 +
 
 +
== Half Day Developer Workshop ==
 +
This 4 hour developer workshop will take place on Wednesday, February 20, from 1pm-5pm.  The Workshop is complementary for Conference Attendees.
 +
 
 +
 
 +
===Approaching Secure Code – Where do I start?===
 +
 
 +
'''Trainer:''' Jim Manico<br>
 +
'''Audience:''' Developers (dev managers welcome, assign people from your team to attend). Bring yourself, no materials required. <br>
 +
'''Level:''' Basic <br>
 +
'''Language:''' Training will be conducted in '''English'''
 +
 
 +
 
 +
'''Course Summary:'''<br>
 +
Regardless of your chosen/mandated framework for building web applications: Spring, Struts, Rails, PHP, Python, etc., you want to make your life easier, and potentially less embarrassing. Don’t be the one who left the door open for hackers. Learn handy tips from one of the world’s leading AppSec experts.
  
  
 +
'''Jim Manico''' is an OWASP volunteer who leads the OWASP Cheat Sheet Series and produces the OWASP Podcast Series. Jim is also the VP of Security Architecture at WhiteHat Security. Jim provides secure coding and developer awareness training for WhiteHat Security using his 8+ years of experience delivering developer-training courses for SANS, Aspect Security and others. He brings 16 years of database-driven Web software development and analysis experience to WhiteHat and OWASP.
  
  

Revision as of 20:28, 2 January 2013




Owasp banner 7b.jpg


Conference Registration is now open! Click Here to Register.


[edit]

We are pleased to announce that the OWASP South Korea chapter will host the OWASP AppSec APAC 2013 conference in Jeju, South Korea at the Hyatt Regency Jeju. The event will be composed of 2 days of training (February 19-20), followed by 2 days of conference talks (February 21-22).


The Global AppSec APAC 2013 Conference will be a reunion of Information Security Asia-Pacific leaders, and will present cutting-edge ideas. OWASP events attract a worldwide audience interested in “what’s next”. The conference is expected to draw 200-250 technologists from Government, Financial Services, Media, Pharmaceuticals, Healthcare, Technology, and many other verticals.


Who Should Attend Global AppSec APAC 2013:

  • Application Developers
  • Application Testers and Quality Assurance
  • Application Project Management and Staff
  • Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff
  • Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance
  • Security Managers and Staff
  • Executives, Managers, and Staff Responsible for IT Security Governance
  • IT Professionals Interested in Improving IT Security


If you have any questions, please email the conference committee: AppSecAPAC2013@owasp.org




                                                                                                                              Owasp social icon.jpg

Use the #AppSecAsia hashtag for your tweets for AppSec APAC 2013 (What are hashtags?)

@AppSecAsia Twitter Feed (follow us on Twitter!)


Overview of the training classes: Scroll down for details on each course and trainer bios.


Course Name
Trainer
Course Length
Course Date(s)
Language
Price
Advanced Android and iOS Hands-on Exploitation Course Aditya Gupta and Subho Halder (XYSec) 2 Days Tuesday and Wednesday, Feb 19-20 English $800 USD
HACKED - The OWASP Top 10 - Incident Response Chris Pogue (Trustwave Spiderlabs) 2 Days Tuesday and Wednesday, Feb 19-20 English $800 USD
CISO training: Managing Web & Application Security for senior manager Tobias Gondrom (Thames Stanley) 1 Day Wednesday, Feb 20 English $400 USD
HTML 5 Kim TI (Core Security) 1 Day Wednesday, Feb 20 Korean $400 USD
Developer Workshop: Approaching Secure Code – Where do I start? Jim Manico 1/2 Day (4 hours) Wednesday, Feb 20 English FREE


Two Day Training Courses

Two day training courses will take place on Tuesday & Wednesday, February 19-20, 2013. Training will run from 9am to 5pm each day with a 1 hour break for lunch.


Advanced Android and iOS Hands-on Exploitation Course

Trainers: Aditya Gupta and Subho Halder (XYSec)
Audience: Management, Technical, DevOps, Developers
Level: Basic, Intermediate
Language: Training will be conducted in English


Course Summary:
This fast-paced workshop will get you familiar with the various Android as well as iOS exploitation techniques, and bypassing most of the existing security models in both of the platforms. We will also discuss about a framework, which we have made for Android Exploitation, named as the Android Framework for Exploitation, which will help security researchers to perform automated and in-depth analysis of bug hunting and security assessment of Android Application and platforms.

For iOS, we will be looking into the application security assessment, creating a pentest environment, present sandboxing model, and much more. We will also be looking into Android rooting and iOS jailbreaking exploits, and recreate the scenario from the scratch.

Course Outline PDF


Aditya Gupta is a renowned mobile security expert and information security researcher. Also being the lead developer and co-creator of Android Framework for Exploitation, he has done a lot of in-depth research on the security of mobile devices including Android, iOS and Blackberry.

He has also discovered serious security flaws in websites such as Google, Apple, Microsoft, Adobe, Skype and many more. In his work with XYSEC, he is committed to perform VAPT and Mobile Application Security Analysis. He has also been working with government clients and intelligence agencies in India, as well as providing them trainings and services on Malware Analysis, Exploit Development and Advanced Web App Hacking.

He has also previously spoken at a bunch of conferences including BlackHat, Toorcon, ClubHack, Nullcon, THC, Defcon India Chapter and many more.


Subho Halder is a Programmer, Security Researcher and Penetration Tester. He loves writing exploits and programming in PHP, Java, Perl and Python. He is well equipped and has a deep understanding of Android and Blackberry frameworks.


HACKED - The OWASP Top 10 - Incident Response

Trainer: Chris Pogue (Trustwave Spiderlabs)
Audience: Management, Technical, Operations, DevOps, Law Enforcement
Level: Intermediate, Advanced
Language: Training will be conducted in English


Course Summary:
After completing this course, you will possess the skills to successfully conduct a basic network intrusion investigation that adheres to a formal methodology to ensure the admissibility of evidence in a court of law and ultimately increases the chances of apprehending the intruder. You will engage in hands-­‐on labs and instructor demos of network intrusion concepts in a “real-­‐world” environment. The real-­‐world environment is made possible through the use of Virtual Machines (VMs). Each VM is pre-­‐configured to mimic the different Operating Systems(OSs), network environments and intrusion issues that you may encounter.


Note: Students must furnish their own laptop running a version of Microsoft Windows. VMware Workstation or Server will also be required in order to participate in the hands-­‐on labs. Laptop should have at least 20GB of free space.


Chris Pogue is a Senior Security Analyst for the Spiderlabs Incident Response and Digital Forensics team at Trustwave. He has over ten years of administrative and security experience including three years on the IBM ISS X-Force Emergency Response Services Team, five years with IBM’s Ethical Hacking Team, and 13 years of Active Military service in the US Army Signal Corps.

Chris also has worked with local, state, and federal law enforcement agencies such as the New York Police Department, the Royal Canadian Mounted Police, the Federal Bureau of Investigation, and The United States Secret Service to help pursue the digital evidence left behind by criminals of all types. His efforts have lead to arrests and convictions in Oklahoma, New York, Florida, Albania, and Germany.

Chris holds a Bachelor's Degree in Business Management, a Master’s degree in Information Security, is a Certified Information Systems Security Professional, (CISSP), a Certified Ethical Hacker (CEH), a Certified Reverse Engineering Analyst (CREA), a GIAC Certified Forensics Analyst (GCFA), and a VISA PCI DSS Qualified Security Assessor (QSA).


One Day Training Courses

One Day Training Courses will take place on Wednesday, February 20, 2013. Training will run from 9am to 5pm with a 1 hour break for lunch.


CISO training: Managing Web & Application Security for senior managers

Trainer: Tobias Gondrom (Thames Stanley)
Audience: Management
Level: Basic, Intermediate, Advanced
Language: Training will be conducted in English


Course Summary:
Setting up, managing and improving your global information security organisation using mature OWASP projects and tools. Achieving cost-effective application security and bringing it all together on the management level. How to use and leverage OWASP and other common best practices to improve your security programs and organization. The workshop will also discuss a number of quick wins and how to effectively manage global security initiatives and use OWASP tools inside your organisation. The author has extensive experience of managing his own secure development organization as well as advising to improve a number of global secure development organisations and processes.

Topics:

  • Managing Web & Application Security in large global organisations
  • OWASP Top-10 and OWASP projects - how to use within your organisation
  • Risk management and threat modeling methods (OWASP risk analysis, ISO-27005,...)
  • Benchmarking & Maturity Models
  • Organisational Design and managing change for global information security programs
  • Secure SDLC
  • Training: OWASP Secure Coding Practices - Quick Reference Guide, Development Guide, Training tools for developers
  • Measuring & Verification: ASVS (Application Security Verification Standard) Project, Code Review Guide, Testing Guide
  • Development & Operation: Frameworks and Tools, e.g. AppSensor


All discussion and issues raised by participants at the workshop will be under the confidentiality under the Chatham House Rule (http://en.wikipedia.org/wiki/Chatham_House_Rule).


Tobias Gondrom is Managing Director of Thames Stanley, a CISO and Information Security & Risk Management Advisory based in Hong Kong, United Kingdom and Germany. He has fifteen years of experience in software development, application security, cryptography, electronic signatures and global standardisation organisations working for independent software vendors and large global corporations in the financial, technology and government sector, in America, EMEA and APAC. As the Global Head of the Security Team at Open Text (2005-2007) and from 2000-2004 as the lead of the Security Task Force at IXOS Software AG, he was responsible for security, risk and incident management and introduced and implemented a secure SDLC used globally by development departments in the US, Canada, UK and Germany.

Since 2003 he is the chair of working groups of the IETF (www.ietf.org) in the security area, member of the IETF security directorate, and since 2010 chair of the formed web security WG at the IETF, and a former chapter lead of the German OWASP chapter from 2007 to 2008, and currently board member of OWASP London and member of the OWASP Global Industry Committee. Tobias is the author of the international standards RFC 4998 and RFC 6283 (Evidence Record Syntax) and co-author and contributor to a number of internet standards and papers on security and electronic signatures, as well as the co-author of the book „Secure Electronic Archiving“ (ISBN 3-87081-427-6) and the OWASP CISO guide and frequent presenter at conferences and publication of articles (e.g. AppSec, IETF, ISSE, Moderner Staat, VOI-booklet “Electronic Signature“, iX).


HTML 5

강사명: Kim TI (Core Security) 김태일 (코어시큐리티)
교육 참가자: 기술, 개발 및 운영, 개발자
참가자의 기술 요구 수준: 중간 단계
가능한 언어: 한국어


교육 요약:
HTML5 에서 새롭게 추가된 기능들을 이용하여 웹 어플리케이션에서 발생할 수 있는 보안 위협/ 대응 및 완화 방법.

  • XHR Level2 를 이용한 CSRF & CORS 우회
  • HTML5 에 새롭게 추가된 테그 및 속성을 이용한 XSS
  • 자바스크립트를 이용한 Web Storage 정보 추출
  • 자바스크립트를 이용한 WebSQL 정보 추출


교육 경험:

실무 / 강의 경력 13년

정보보안 기술교육을 중심으로 공공기관, 기업, 대학 강의

CEH /CHFI 해킹 및 컴퓨터포렌식 국제공인강사

IPv6 프로토콜 변환기 개발 참여 (2001년, I2Soft)

주민번호대체수단 I-PIN 모의해킹 수행 (2007년 한국정보보호진흥원)


現 ㈜코어시큐리티 대표이사 (CEO)

現 경찰수사연수원 외래교수

前 ㈜FSK시큐리티 지식사업부 부장

前 SH Information System 기술연구소 지식사업팀

前 보안 프리랜서 강사


[보유자격증]

CEH / CHFI /ECSA /LPT / CEI


Half Day Developer Workshop

This 4 hour developer workshop will take place on Wednesday, February 20, from 1pm-5pm. The Workshop is complementary for Conference Attendees.


Approaching Secure Code – Where do I start?

Trainer: Jim Manico
Audience: Developers (dev managers welcome, assign people from your team to attend). Bring yourself, no materials required.
Level: Basic
Language: Training will be conducted in English


Course Summary:
Regardless of your chosen/mandated framework for building web applications: Spring, Struts, Rails, PHP, Python, etc., you want to make your life easier, and potentially less embarrassing. Don’t be the one who left the door open for hackers. Learn handy tips from one of the world’s leading AppSec experts.


Jim Manico is an OWASP volunteer who leads the OWASP Cheat Sheet Series and produces the OWASP Podcast Series. Jim is also the VP of Security Architecture at WhiteHat Security. Jim provides secure coding and developer awareness training for WhiteHat Security using his 8+ years of experience delivering developer-training courses for SANS, Aspect Security and others. He brings 16 years of database-driven Web software development and analysis experience to WhiteHat and OWASP.


Call for Papers

Submit your Talk Proposal here: Call for Papers Submission Form


발표 주제를 제출해 주시기 바랍니다. : 발표 주제 제출 양식


Please carefully fill out the CFP form to submit your talk for consideration at OWASP AppSec APAC 2013 in Jeju, South Korea.

The talks will be held February 21st and 22nd, 2013 at the Hyatt Regency (training is February 19th and 20th). Talks will be 50 minutes each. We will post your Display Name, Biography, Talk Title, and Talk Abstract to the appsecapac.org site if your talk is selected. If you provide a URL or Twitter handle, we will post that if your talk is selected, too.


The first round submission deadline for this Call for Papers is December 12, 2012. The final submission deadline is December 31, 2012. All talk acceptances will be confirmed by January 4, 2013.


If your talk is selected, we will contact you to confirm, and we will expect that your slides and other material will be sent to us no later than February 13, 2013 for our peer review. We peer review slides and other material for inclusion on the conference website (post-conference) and to verify general conformance to OWASP conference presentation guidelines.


If you would like to submit multiple presentations, please make multiple separate form submissions.


Speakers will receive free admission (nontransferable) to the conference in return for delivering a 50 minute talk.


Speaker Agreement

By submitting your proposal for a talk/paper through our CFP, you are consenting to stay within the guidelines of the speaker agreement: https://www.owasp.org/index.php/Speaker_Agreement


Questions?

Please contact us at appsecAPAC2013@owasp.org with any questions!


OWASP Project Track Opportunities

The AppSec APAC conference organizers, in conjunction with the Global Projects Division, is pleased to announce a Call for Entries for the 2013 OWASP Project Track (OPT).

We are offering a limited number of FREE speaking opportunities to open source projects this year, as well as FREE conference admission for the representatives of the chosen projects. We would like to invite ALL open source projects to apply.


About the AppSec APAC 2013 OWASP Projects Track

This is a great opportunity for OWASP Project Leaders to showcase their project as an official conference presenter. Please note that successful OPT applicants are responsible for developing and presenting in their designated timeslot at the conference.

For an opportunity to present your open source project through the OPT at AppSec APAC 2013, please submit your application using the OSPT APAC 2013 Application.

OWASP AppSec APAC 2013 – OWASP 프로젝트 트랙(CFP)


Sponsorship Opportunities

OWASP Project Leaders have the option of requesting financial assistance from the Foundation to cover travel and hotel expenses ONLY. This funding is only available to projects that have been selected to participate in the OPT at AppSec APAC 2013. Preference will be given to OWASP Project Leaders that are applying to present at the confernce that is closest to their region. Additionally, preference will be given to OWASP Project Leaders that have not presented or participated in the OPT forum.


Date and Times

APPLICATION DEADLINES

OPT Applications are due: December 28, 2012


CONFERENCE DATE

February 19-22, 2013


OPT DATE & TIME

All OPT Talks will be held between February 21-22, 2013.


LOCATION

Hyatt Regency Jeju
114,Jongmoongwangwang-ro 72 beon-gil,Seogwipo-si,
Jeju Special Self-Governing Province
South Korea
Phone: +82 64 733 1234


Questions?

If you have any questions, or if you simply need some more information, please do not hesitate to Contact Us.


To Be Announced.


AppSec APAC 2013 will be held at the Hyatt Regency in Jeju, South Korea.



Conference Registration is now open! Click Here to Register.


OWASP AppSec Asia Pacific features two days of training February 19-20, and two days of talks, February 21-22, 2013

Please note - all prices below appear in USD; however arrangements can be made for payment in South Korean Won.


Conference Registration Fees (not including training)

Ticket Type
Early (until January 18) Regular Price
Non-Member $295 USD $395 USD
Non-Member plus 1-year OWASP Membership! $295 USD $395 USD
Active OWASP Member $275 USD $375 USD
Student $75 USD $100 USD
Training Only (See pricing table below)


Training Fees

Course Length
Course Date(s)
Price
1-Day Class Wednesday, Feb 20 $400 USD
2-Day Class Tuesday and Wednesday, Feb 19-20 $800 USD

Price per attendee. Please note that conference Registration is separate.

For more information on available training courses and trainer bios, please select the "Trainers and Training Schedule" tab.


Optional Conference Events

Item
Date & Time
Price
1/2 Day Developer Workshop Wednesday, Feb 20, 1-5pm Complimentary
Chapter Leader Workshop Wednesday, Feb 20, 6:30-9:30pm Complimentary
Conference Networking Dinner Thursday, Feb 21, 7-9pm $50 USD


Sign up for any of these optional items by registering for the conference.


Group Discounts

10% off for groups of 10-19 20% off for groups of 20-29 30% off for groups of 30 or more

Please Contact Us for more information about registering a group.


Membership Discounts

We are pleased to offer $20 off admission for active OWASP members. Multiple discounts can not be applied.


Registration for Trainers and Speakers

If you have been selected to deliver a training or talk at the conference, you should have received a discount code for complimentary admission.
If you did not receive this code or have questions, please Contact Us.


Registration for OWASP Leaders

Complimentary admission to the conference is offered to active OWASP Chapter and Project Leaders. Additionally, two seats for each of the training courses are available at no cost to active OWASP Chapter and Project Leaders (available on a first come, first serve basis). To register as an active Chapter or Project leader, please select the general event registration option and enter discount code: OWASPLEADER. Please email sarah.baso@owasp.org for a registration discount code to the training courses.


Please note: conference and training registration using the OWASPLEADER discount code will be verified by the conference team and if you are not an active OWASP Chapter or Project Leader, you will be contacted regarding your status and your registration may be subject to cancellation.


We are looking for sponsors for 2013 edition of Global AppSec APAC.


If you are interested to sponsor Global AppSec APAC 2013, please contact the conference team: AppSecAPAC2013@owasp.org


Sponsorship Deadline is January 15, 2013.


To find out more about the different sponsorship opportunities please check the document below:
OWASP AppSec APAC 2013 Sponsorship Options - English
OWASP AppSec APAC 2013 Sponsorship Options - Korean



Accommodation

AppSec APAC 2013 will be held at the Hyatt Regency in Jeju, South Korea. We have secured a room block with the hotel.


Hotel Regency Information Sheet


TBA



The Global Chapter Committee invites all chapter leaders to participate in the upcoming Chapter Leader Workshops at AppSec APAC 2013.

  • AppSec APAC – Jeju, South Korea – February 19-22, 2013

https://www.owasp.org/index.php/AppSecAsiaPac2013


- January 7, 2013 - Appsec APAC Chapters Workshop sponsorships applications due - January 14 - Applicants notified of status


The Chapter Leader Workshop format will continue to follow the Q & A format used during AppSec USA and AppSec LATAM. Questions and discussion will focus on sections of the Chapter Leader Handbook, OWASP Global Chapter resources, and local chapter challenges.

  • If you need financial assistance* to attend the Chapter Leader Workshops please contact us by the application deadline.


  • Priority of sponsorships will be given to those not covered by sponsorship to attend a previous workshop. Additionally, we are looking for new or struggling chapter leaders who need assistance kick starting their chapter.
  • When you apply for funding, please let us know *why we should sponsor you*. While we prefer that chapter leaders use their own chapter's funds before requesting a sponsorship, this is not a requirement for application.
  • If your chapter has fund but will not be using them to sponsor your attendance, please include why you will not be using the funds for this purpose (i.e. what are the other plans for those funds?).


If any questions, please contact us

Kate Hartmann on behalf of the Global Chapters Committee


Contact

Contact Us for more details.


2013 AppSec APAC Conference Volunteer Team

  • Johnny Cho
  • Yune Sung
  • Hyung Geun Park


Do you want to volunteer for AppSec APAC 2013? Click here to sign up


OWASP Staff Support

  • Sarah Baso
  • Samantha Groves
  • Kelly Santalucia
  • Kate Hartmann
  • Alison Shrader


Contact us at appsecAPAC2013@owasp.org



Diamond Sponsor

Pentasecurity logo.png

Platinum Sponsor

Akamai Logo.png

Gold Sponsor

ENsecure Logo AppSecAPAC 2013.png

Architectgroup 130131.png

Silver Sponsor

Checkmarx.jpg
SANS Logo 150x45.jpg

Lanyard Sponsor

Checkmarx.jpg

Supporting Organization

SecurityPlus logo.gif
EC-Council Logo.png
Nahs logo.jpg
Main logo.jpg

Media Sponsor

EHN Logo 150.png