Difference between revisions of "AppSec Brasil 2009"

From OWASP
Jump to: navigation, search
(Conference Dates)
 
(47 intermediate revisions by 6 users not shown)
Line 3: Line 3:
 
'''Para a versão em português, veja em [[AppSec Brasil 2009 (pt-br)]]'''
 
'''Para a versão em português, veja em [[AppSec Brasil 2009 (pt-br)]]'''
  
=International Conference on Application Security=
+
= International Conference on Application Security =
  
[http://www.ticontrole.gov.br TI-Controle] and the Computing Centre of the [http://www.camara.gov.br Deputy Chamber] present the '''First International Conference on Application Security''' that will happen in [http://en.wikipedia.org/wiki/Brasília Brasilia, Capital of Brazil] with the support of OWASP [[Brazilian]] Chapter. The Conference consists of two days of training sessions, followed by a two-day conference on a single track.
+
[http://www.ticontrole.gov.br TI-Controle] and the Computing Centre of the [http://www.camara.gov.br Deputy Chamber] present the '''First International Conference on Application Security''' that will happen in [http://en.wikipedia.org/wiki/Brasília Brasilia, Capital of Brazil] with the support of OWASP [[Brazilian]] Chapter. The Conference consists of two days of training sessions, followed by a two-day conference on a single track. [[Image:Brasilia Panorama.jpg]]  
[[Image:Brasilia Panorama.jpg]]
+
  
=== Conference Dates ===
+
== Conference Dates ==
  
The conference will happen from October 27th, 2009 to October 30th, 2009. The first two days will be tutorial days (see below). Plenary sessions will be held on October 29th and 30th.
+
The conference will happen from October 27th, 2009 to October 30th, 2009. The first two days will be tutorial days (see below). Plenary sessions will be held on October 29th and 30th.  
  
<span style="color:red;font-style:italic;font-weight:bold;font-size: 120%;">
+
== Conference's Slides and Videos  ==
Warning: the email appsec.brasil@camara.gov.br had a few issues receiving messages from Gmail in the last weeks. If you sent a proposal but haven't received a confirmation from us, please try again.
+
</span>
+
  
 +
The Presentations' slides and videos are available under the [http://www.owasp.org/index.php/AppSec_Brasil_2009#tab=Presentation_Abstracts Presentation Abstracts tab].
  
==== Call for Presentations ====
+
The Training Sessions' slides are available under the [http://www.owasp.org/index.php/AppSec_Brasil_2009#tab=Training_Sessions Training Sessions tab]
'''CALL FOR PRESENTATIONS'''
+
  
OWASP is currently soliciting presentations for the OWASP AppSec Brasil 2009 Conference that will take place at Câmara dos Deputados in Brasília, DF on October 27th through 30th of 2009.  There will be training courses on October 27th and 28th followed by plenary sessions on the 29th and 30th with each day having one single track. The conference will be organized and supported by the TI-Controle Community (www.ticontrole.gov.br) and the Deputy Chamber (www2.camara.gov.br/english).
+
<br>
  
We are seeking people and organizations that want to present on any of the following topics (in no particular order):
+
==== Sponsorship  ====
:* Application Threat Modeling
+
:* Business Risks with Application Security
+
:* Hands-on Source Code Review
+
:* Metrics for Application Security
+
:* OWASP Tools and Projects
+
:* Privacy Concerns with Applications and Data Storage
+
:* Secure Coding Practices (J2EE/.NET)
+
:* Starting and Managing Secure Development Lifecycle Programs
+
:* Technology specific presentations on security such as AJAX, XML, etc
+
:* Web Application Security countermeasures
+
:* Web Application Security Testing
+
:* Web Services-, XML- and Application Security
+
;* Anything else relating to OWASP and Application Security
+
  
To make a submission you must include :
+
This conference is promoted by [http://www.ticontrole.gov.br TI-Controle] Community and organized by Computing Centre of [http://www.camara.gov.br/ Brazilian Deputy Chamber].
:* Presenter name
+
:* Additional author(s) name(s)
+
:* Presenter(s) Email and/or Phone number(s)
+
:* Presenter(s) bio(s) and, optionally, bios of the other authors
+
:* Title
+
:* Abstract
+
:* Presentation outline, defining all topics that will be covered by the presentation
+
:* Any supporting research/tools (will not be released outside of CFP committee)
+
  
Each presenter will have 45 minutes for the presentation, followed by 10 minutes reserved for questions from the audience. The presentations must respect the restrictions of the OWASP Speaker Agreement.
+
The conference is supported by OWASP [[Brazilian|Brazilian Chapter]], as content provider (talks selection, trainings and schedule grid).  
  
'''Important Dates:'''
+
The conference is supported by the [http://www.unb.br University of Brasilia] (UnB) [[Image:Unb.gif|60px]]
:  Submission deadline is July 11th 2009 at 11:59 PM (UTC/GMT -3).
+
:  Notification of acceptance is August 7th 2009.
+
: Final version is due September 5th 2009.
+
  
Proposals must be sent by email to '''appsec.brasil (at) camara.gov.br''' 
+
The conference is sponsored by [http://www.conviso.com.br Conviso IT Security] [[Image:CorVersao BR Small.jpg|100px]] and [http://www.leadcomm.com.br LeadComm] [[Image:LeadComm Logo Screen.jpg|100px]]
  
For more information, please see the following web pages:
+
<br>
:  Conference Website: https://www.owasp.org/index.php/AppSec_Brasil_2009
+
:  FAQ: https://www.owasp.org/index.php/AppSec_Brasil_2009_-_FAQ
+
:  OWASP Speaker Agreement: http://www.owasp.org/index.php/Speaker_Agreement
+
:  TI-Controle: http://www.ticontrole.gov.br
+
:  Deputy Chamber: http://www2.camara.gov.br/english
+
  
==== Call for Training Provider ====
+
==== Keynotes  ====
'''CALL FOR TRAINING SESSIONS'''
+
  
OWASP is currently soliciting training proposals for the OWASP AppSec Brasil 2009 Conference which will take place at Câmara dos Deputados (Deputy Chamber) in Brasília, DF, on October 27th through October 30th 2009.  There will be training courses on October 27th and 28th followed by plenary sessions on the 29th and 30th with one single track per day. The conference will be organized and supported by the TI-Controle Community (www.ticontrole.gov.br) and the Deputy Chamber (www2.camara.gov.br/english).
+
[[Image:GaryMcGraw.JPG|left|60px]] '''Gary McGraw'''
  
We are seeking training proposals on the following topics (in no particular order):
+
CTO, [http://www.cigital.com Cigital]
:* Application Threat Modeling
+
:* Business Risks with Application Security
+
:* Hands-on Source Code Review
+
:* Metrics for Application Security
+
:* OWASP Tools and Projects
+
:* Privacy Concerns with Applications and Data Storage
+
:* Secure Coding Practices (J2EE/.NET)
+
:* Starting and Managing Secure Development Lifecycle Programs
+
:* Technology specific presentations on security such as AJAX, XML, etc
+
:* Web Application Security countermeasures
+
:* Web Application Security Testing
+
:* Web Services-, XML- and Application Security
+
:* Anything else relating to OWASP and Application Security
+
  
Proposals on topics not listed above but related to the conference (i.e. which are related to Application Security) may also be accepted.
+
''Title:'' '''The Building Security In Maturity Model (BSIMM)'''
  
There may be 1 or 2-day courses. The proposals must respect the restrictions of the OWASP Speaker Agreement. The conference sponsors will provide lodging and domestic (within Brazil) air travel for one presenter per course, no other compensation is available. If you require a different arrangement, please contact the conference organization team at the email address bellow.  
+
''Bio:'' Gary McGraw is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C. area. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Java Security, Building Secure Software, Exploiting Software, Software Security, and Exploiting Online Games; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 100 peer-reviewed scientific publications, authors a monthly security column for informIT, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean's Advisory Council for the School of Informatics. Gary served on the IEEE Computer Society Board of Governors, produces the monthly Silver Bullet Security Podcast for IEEE Security &amp; Privacy magazine (syndicated by informIT), and produces the Reality Check Security Podcast for CSO Online.  
  
'''Important Dates:'''
+
<br>
:  Submission deadline is July 11th 2009 at 11:59 PM (UTC/GMT -3).
+
:  Notification of acceptance is August 7th 2009.
+
:  Final version is due September 5th 2009.
+
  
To make a proposal, please fill the form (http://www.owasp.org/images/4/4b/OWASP_AppSec_Brazil_09_CFT.docx) and send it by email to appsec.brasil (at) camara.gov.br   
+
'''Jason Li''' and '''Jerry Hoff'''
  
For more information, please see the following web pages:
+
[http://www.aspectsecurity.com Aspect Security]
:  Proposal form as a zipped RTF file: http://www.owasp.org/images/e/ea/OWASP_AppSec_Brazil_09_CFT_RTF.zip
+
:  Conference Website: https://www.owasp.org/index.php/AppSec_Brasil_2009
+
:  FAQ: https://www.owasp.org/index.php/AppSec_Brasil_2009_-_FAQ
+
:  OWASP Speaker Agreement: http://www.owasp.org/index.php/Speaker_Agreement
+
:  TI-Controle: http://www.ticontrole.gov.br
+
:  Deputy Chamber: http://www2.camara.gov.br/english
+
  
 +
''Title:'' '''Agile and Secure: Can We Do Both?'''
  
==== FAQ ====
+
''Bio:'' Jason Li is a Senior Application Security Engineer at Aspect Security. Jason has led security architecture reviews, application security code reviews, penetration tests and provided web application security training services for a variety of commercial, financial, and government customers. He is also actively involved in the Open Web Application Security Project (OWASP), serving on the OWASP Global Projects Committee and as a co-author of the OWASP AntiSamy Project (Java version). Jason earned his Post-Master's degree in Computer Science with a concentration in Information Assurance from Johns Hopkins University. He earned his Master's degree in Computer Science from Cornell University, where he also earned his Bachelor's degree, double majoring in Computer Science and Operations Research.
'''Q. Who is promoting the conference?'''
+
  
A. This conference is being supported and organized by the [http://www.ticontrole.gov.br TI-Controle Community] and the [http://www.camara.gov.br Deputy Chamber], with the contents (presentations, keynotes, training, etc) selected by the OWASP [[Brazilian]] Chapter.
+
Jerry Hoff is a Senior Application Security Engineer at Aspect Security. Jerry has led and performed numerous application security code reviews for clients across multiple industries. Jerry also provides training services for clients, and has over 10 years teaching and development experience. Jerry is also involved in the Open Web Application Security Project (OWASP) and was the lead developer of AntiSamy.net project. He has a master's degree in Computer Science from Washington University in St. Louis.  
  
'''Q. What will it cost?'''
+
<br>
  
A. Nothing. Thanks to its sponsor, the conference will be free of charge. However we have limited seats, so please register early.
+
'''Dinis Cruz'''
  
 +
OWASP Board
  
'''''Call For Papers'''''
+
''Title:'' '''To be defined'''  
  
'''Q. What is the Open Web Application Security Project (OWASP)?'''
+
''Bio:'' Coming Soon.  
  
The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work with your support.
+
<br>
  
'''Q. How many speaking slots are there?'''
+
'''Kuai Hinojosa'''  
  
Please see the Conference Agenda in its [http://www.owasp.org/index.php/AppSec_Brasil_2009 main page].
+
OWASP
  
'''Q. What are the submission deadlines?'''
+
''Title:'' '''Deploying Secure Web Applications with OWASP Resources'''  
  
The CFP submission deadline is July 11th, with the final version of the presentation material due September 15th 2009.
+
''Bio:'' Kuai Hinojosa has been developing and securing web applications for about 12 years. He previously worked in the banking industry as a database security administrator for the 5th largest bank in the U.S. where he worked in a small team developing applications that protected company's assets. He now works for New York University as a Web Applications Specialist where he continues to use web application development and application security experience to protect university resources. In his spare time Kuai volunteers his time preaching the application security gospel and leading the Minneapolis OWASP chapter. Kuai is a member of the OWASP (Open Web Application Security Project) Global Education Committee.  
  
'''Q: Who is allowed to submit presentations?'''
+
==== Agenda  ====
  
A: Original authors may submit presentations for consideration. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.
+
'''Conference Program - Day 1 - October 29th 2009 '''
 +
<center>
 +
{| width="80%" class="t"
 +
|-
 +
| height="17" width="14%" align="right" | 08:30 - 09:00
 +
| bgcolor="#8595c2" align="CENTER" | '''Reception Desk Open'''
 +
|-
 +
| height="17" width="14%" align="right" | 09:00 - 10:00
 +
| bgcolor="#eeeeee" align="CENTER" | '''Opening Ceremony'''
 +
|-
 +
| height="49" width="14%" align="right" | 10:00 - 10:30
 +
| bgcolor="#b9c2dc" align="CENTER" | '''Dinis Cruz<br>''' What is OWASP?
 +
|-
 +
| height="32" width="14%" align="right" | 10:30 - 12:30
 +
| bgcolor="#eeeeee" align="CENTER" | '''Gary McGraw (Cigital)<br>''' The Building Security In Maturity Model (BSIMM)
 +
|-
 +
| height="17" width="14%" align="right" | 12:30 - 14:00
 +
| bgcolor="#d98b66" align="CENTER" | '''Lunch Break'''
 +
|-
 +
| height="47" width="14%" align="right" | 14:00 - 14:50
 +
| bgcolor="#b9c2dc" align="CENTER" | '''Dinis Cruz<br>''' OWASP Project Tour
 +
|-
 +
| height="32" width="14%" align="right" | 14:50 - 15:40
 +
| bgcolor="#eeeeee" align="CENTER" | '''Thomas Schreiber<br>''' The Logic and Semantic Layer of Web Application Security
 +
|-
 +
| height="17" width="14%" align="right" | 15:40 - 16:00
 +
| bgcolor="#d98b66" align="CENTER" | '''Break'''
 +
|-
 +
| height="47" width="14%" align="right" | 16:00 - 16:50
 +
| bgcolor="#b9c2dc" align="CENTER" | '''Brian Contos<br>''' Making a Case for Data Security to Network-Centric Peers and Managers and Leveraging Web Application Firewalls (WAF) and Database Activity Monitoring (DAM) to Augment Secure Coding &amp; Review Practices
 +
|-
 +
| height="32" width="14%" align="right" | 16:50 - 17:40
 +
| bgcolor="#eeeeee" align="CENTER" | '''Matt Tesauro<br>''' OWASP ROI: Optimize Security Spending using OWASP
 +
|-
 +
| height="47" width="14%" align="right" | 17:40 - 18300
 +
| bgcolor="#b9c2dc" align="CENTER" | '''Pravir Chandra <br>''' Software Assurance Maturity Model (SAMM)
 +
|-
 +
| height="17" width="14%" align="right" | 18:30 - 18:35
 +
| bgcolor="#cccccc" align="CENTER" | '''End of the First Day Program'''
 +
|}
 +
</center>
 +
<br>
  
'''Q: Why aren't Third Parties such as PR Firms allowed to submit presentations?'''
+
<br> '''Conference Program - Day 2 - October 30th 2009'''
 +
<center>
 +
{| width="80%" class="t"
 +
|-
 +
| height="17" width="14%" align="right" | 08:30 - 09:00
 +
| bgcolor="#8595c2" align="CENTER" | '''Reception Desk Open'''
 +
|-
 +
| height="32" width="14%" align="right" | 09:00 - 10:30
 +
| bgcolor="#b9c2dc" align="CENTER" | '''Jason Li e Jerry Hoff (Aspect Security) '''<br> Agile and Secure - Can we do both?
 +
|-
 +
| height="17" width="14%" align="right" | 10:30 - 10:50
 +
| bgcolor="#d98b66" align="CENTER" | '''Break'''
 +
|-
 +
| height="47" width="14%" align="right" | 10:30 - 11:40
 +
| bgcolor="#eeeeee" align="CENTER" | '''Cassio Goldschmidt'''<br> Praticas e ferramentas fundamentais para o desenvolvimento de software seguro <br> (''Tools and Practices for Secure Software Development'')
 +
|-
 +
| height="32" width="14%" align="right" | 11:40 - 12:30
 +
| bgcolor="#b9c2dc" align="CENTER" | '''Luiz Otávio Duarte'''<br> Abordagem Preventiva para Teste de Segurança em Aplicações Web <br> (''Preventive Approach for Web Application Security Testing'')
 +
|-
 +
| height="17" width="14%" align="right" | 12:30 - 14:00
 +
| bgcolor="#d98b66" align="CENTER" | '''Lunch Break'''
 +
|-
 +
| height="32" width="14%" align="right" | 14:00 - 15:10
 +
| bgcolor="#eeeeee" align="CENTER" | '''Ulisses Castro'''<br>SQL Injection: Amplifying Data Leakeage<br>
 +
|-
 +
| height="32" width="14%" align="right" | 15:10 - 16:00
 +
| bgcolor="#b9c2dc" align="CENTER" | '''Sebastian Cufre'''<br> Automated SQL Ownage Techniques
 +
|-
 +
| height="17" width="14%" align="right" | 16:00 - 16:20
 +
| bgcolor="#d98b66" align="CENTER" | '''Break'''
 +
|-
 +
| height="32" width="14%" align="right" | 16:20 - 17:10
 +
| bgcolor="#eeeeee" align="CENTER" | '''Klaubert Herr da Silveira'''<br> ModSecurity: Firewall OpenSource para Aplicações Web (WAF) <br> (''ModSecurity, Open Source Web Application Firewall'')
 +
|-
 +
| height="32" width="14%" align="right" | 17:10 - 18:00
 +
| bgcolor="#b9c2dc" align="CENTER" | '''Philippe Sevestre'''<br> Programação Segura utilizando Análise Estática <br> (''Secure Programming with Static Analysis'')
 +
|-
 +
| height="17" width="14%" align="right" | 18:00 - 18:30
 +
| bgcolor="#cccccc" align="CENTER" | '''End of the Conference'''
 +
|}
 +
</center>
 +
<br>
  
A: Due to potential copyright and intellectual property liability issues as well as the need for OWASP to have direct contact with potential and selected presenters to expedite selection and deliverable materials, we require that only original authors of presentations submit for the Call for Papers. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.
+
==== Presentation Abstracts  ====
  
'''Q: Are there any restrictions on the content of the presentations?'''
+
'''The Building Security In Maturity Model (BSIMM)'''  
  
A: Yes, all presentations must respect the rules defined in the OWASP [[Speaker Agreement]].
+
''Gary McGraw'', Cigital
  
'''Q: How long will I have to wait before I am notified if I have been accepted or denied?'''
+
As a discipline, software security has made great progress over the last decade. There are now at least 34 large scale software security initiatives underway in enterprises including global financial services firms, independent software vendors, defense organizations, and other verticals. In 2008, Brian Chess, Sammy Migues and I interviewed the executives running nine initiatives using the twelve practices of the Software Security Framework as our guide. Those companies among the nine who graciously agreed to be identified include: Adobe, The Depository Trust and Clearing Corporation (DTCC), EMC, Google, Microsoft, QUALCOMM, and Wells Fargo. The resulting data, drawn from real programs at different levels of maturity was used to guide the construction of the Building Security In Maturity Model (BSIMM). This talk will describe the observation-based maturity model, drawing examples from many real software security programs. A maturity model is appropriate because improving software security almost always means changing the way an organization works ---people, process, and automation are all required. While not all organizations need to achieve the same security goals, all successful large scale software security initiatives share common ideas and approaches. Whether you rely on the Cigital Touchpoints, Microsoft's SDL, or OWASP CLASP, there is much to learn from practical experience. Use the BSIMM as a yardstick to determine where you stand and what kind of software security plan will work best for you.
  
A: Submitters will be notified of the status (acceptance or denial) on August 7th 2009.
+
[http://www.owasp.org/images/b/bd/Bsimm09.pdf Slides]<br> [http://vimeo.com/7476912 Video]
  
'''Q. Is there an honorarium for presenters?'''
+
<br> '''Agile and Secure: Can We Do Both?'''  
  
No.  OWASP is committed to making its conferences available to the widest possible audience.  In order to do this OWASP keeps the entrance free for the AppSec Brazil 2009 to make the conference accessible.  As a result we are unable to provide a monetary honorarium but we welcome our speakers as our guests to the conference where they can network with other security professionals. We will provide lodging and domestic air travel for one presenter for each selected work.
+
''Jason Li and Jerry Hoff'', Aspect Security
  
'''Q: I have been accepted. What are the materials that I have to turn in and what are the deadlines?'''
+
Agile is taking the software development world by storm, but security has been slow to adapt. What can we learn from the Agile movement? Is it possible to achieve security and remain Agile? Jason and Jerry will share Aspect Security's experiences working with Agile teams to gain assurance and save money. They'll compare and contrast traditional waterfall and agile processes and show how we can achieve assurance and security while remaining true to Agile principles.
  
A: The following is a list of materials that are required from each accepted presentation. Failure to proceed these materials by the deadlines set forth for the event the presentation was accepted for will result in cancellation of acceptance.
+
[http://www.owasp.org/images/d/d4/Jerry.Hoff.brazil_presentation.pdf Slides]<br> [http://vimeo.com/7461340 Video]
* A confirmed [[Speaker_Agreement | Speaker Agreement]] (July 15th 2009)
+
* Presentation in PowerPoint or Keynote format using the [http://www.owasp.org/images/5/54/Presentation_template.ppt OWASP Template] (September 15th 2009)
+
* Detailed Bibliography of resources, co-authors, etc. (September 15th 2009)
+
* Optional White Paper for inclusion on CD (September 15th 2009)
+
  
'''Q: Do I have to submit a White Paper?'''
+
<br> '''Deploying Secure Web Applications with OWASP Resources'''  
  
A: No.  We would certainly appreciate any White Papers that can be included on the conference web site but they are not required.  If you have written an existing white paper to go along with your presentation, please submit it with your CFP submission.  Submissions with attached White Papers will receive additional consideration.
+
''Kuai Hinojosa'', NY University and OWASP
   
+
'''Q: What if I have a co-author who is not presenting. How do I cite the person(s)?'''
+
  
A: All co-authors and works that have been used should be cited in a detailed bibliography that will be published on the Conference CD.
+
Universities are key to making application security visible and the need to educate software developers about application security as an aspect of proper software development has never been more important. In this presentation I will share how OWASP resources can be used by universities to develop, test and deploy secure web applications. I will discuss challenges that Universities currently face integrating a pplication security best practices, describe how OWASP tools and resources are currently used at New York University to test for most common web application flaws. I will introduce projects such as the OWASP Enterprise Security API which can be used to mitigate most common flaws in web applications and share initiatives the OWASP Global Education Committee is currently working on. If you are interested in securing web applications, and supporting the OWASP Global Education Committee efforts you don't want to miss this!
  
'''Q: I have been accepted and would like to add co-presenters. Can I still do this?'''
+
<br> '''What is OWASP'''  
  
A: No. Co-presenters should have been added at the time that the Presentation was submitted. They may attend the conference and present if they register as any other participant.
+
''Dinis Cruz'', OWASP
  
'''Q: My PR company/friends/co-workers/family would like to come see me give my presentation. Will they be allowed in for free?'''
+
TBD.  
  
A: Yes, but they need to register on the conference web site as any other conference participant.
+
[http://vimeo.com/7482554 Video]
  
'''Q. I have more questions'''
+
<br> '''OWASP Project Tour'''  
  
A: Email appsec.brasil@camara.gov.br concerning this event.
+
''Dinis Cruz'', OWASP
  
==== Keynotes ====
+
TBD.
  
'''''Gary McGraw'''''
+
[http://vimeo.com/7506297 Video]
  
CTO, [http://www.cigital.com Cigital]
+
<br> '''The Logic and Semantic Layer of Web Application Security'''
  
<br>
+
''Thomas Schreiber'', SecureNet
  
[[Image:GaryMcGraw.JPG|left|60px]]
+
Testing Web Application Security mostly focusses on technical weaknesses only. But there is a huge field of potential weaknesses above the server layer and beyond the implementational aspects. Even if a web application is totally free from security bugs in code and system, it may still be vulnerable to dangerous threats. It is the kind how the business logic is mapped onto software, that gives an attacker a starting point for his bad intents. The presentation shows, illustrated with various real examples, how a clever hacker may reveal sensitive data - including credit card data -, enter into user accounts or conduct a denial-of-service on the whole infrastructure - not only the server - by attacking the logical and semantical layers. The presentation also gives hints on how to avoid these pitfalls.  
  
''Title:'' '''The Building Security In Maturity Model (BSIMM)'''
+
<br> '''Making a Case for Data Security to Network-Centric Peers and Managers and Leveraging Web Application Firewalls (WAF) and Database Activity Monitoring (DAM) to Augment Secure Coding &amp; Review Practices'''  
  
''Bio:''
+
''Brian Contos'', Imperva
Gary McGraw is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C. area. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Java Security, Building Secure Software, Exploiting Software, Software Security, and Exploiting Online Games; and he is editor of the Addison-Wesley Software Security series.  Dr. McGraw has also written over 100 peer-reviewed scientific publications, authors a monthly security column for informIT, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean's Advisory Council for the School of Informatics.  Gary served on the IEEE Computer Society Board of Governors, produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine (syndicated by informIT), and produces the Reality Check Security Podcast for CSO Online.
+
  
 +
Information system security has changed. The days of being focused on network security measures, operating system vulnerabilities, and open ports, while still important, is no longer the main concern for most organizations. Today, the attackers – organized crime, competitors, nation-states, and malicious insiders are going after the assets that process and store data: applications and databases. The criminals are already fighting the fight on this front. In response, organizations are deploying new defenses - adopting application and data security countermeasures that allow them to protect, monitor and respond to nefarious activity.
  
 +
[http://www.owasp.org/images/f/f6/OWASP_Brian_Contos_Making_a_Case_for_Data_Security_to_Network-Centric_Peers_and_Managers_October2009_Final.zip Slides]<br>
 +
[http://vimeo.com/7505808 Video]
  
 +
<br> '''OWASP ROI: Optimize Security Spending using OWASP'''
  
'''''Jason Li'''''
+
''Matt Tesauro''  
  
[http://www.aspectsecurity.com Aspect Security]
+
Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budgetfriendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a notforprofit entity and provides unbiased, practical, costeffective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, OpenSAMM Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study, the company realized a saving of nearly $400,000 in year one.
  
''Title:'' '''Agile and Secure: Can We Do Both?'''
+
[http://www.owasp.org/images/d/db/AppSec_Brazil_OWASP_ROI-mtesauro.pdf Slides]<br> [http://vimeo.com/7461624 Video]
  
Co-author: '''''Jerry Hoff''''', Aspect Security
+
<br> '''Software Assurance Maturity Model (SAMM)'''  
  
''Bio:''
+
''Pravir Chandra'', Fortify
Coming soon.
+
  
====Agenda====
+
The Software Assurance Maturity Model (SAMM) (http://www.opensamm.org) is a flexible and prescriptive framework for building security into a software development organization. Covering more than typical SDLC-based models for security, SAMM enables organizations to self-assess their security assurance program and then use recommended roadmaps to improve in a way that's aligned to the specific risks facing the organization. Beyond that, SAMM enables creation of scorecards for an organization's effectiveness at secure software development throughout the typical governance, development, and deployment business functions. Scorecards also enable management within an organization to demonstrate quantitative improvements through iterations of building a security assurance program. This workshop will introduce the SAMM framework and walk through useful activities such as assessing an assurance program, mapping an existing organization to a recommended roadmap, and iteratively building an assurance program. Time allowing, additional case studies will also be discussed. SAMM is an open a free project and has recently been added under the Open Web Application Security Project (OWASP).
  
Please see the Portuguese version of this page at http://www.owasp.org/index.php/AppSec_Brasil_2009_(pt-br)#tab=Agenda
+
[http://www.opensamm.org/downloads/OpenSAMM-1.0.ppt Slides]<br> [http://vimeo.com/7461495 Video]
  
'''Tutorial Days - October 27-28'''
+
<br>
  
OWASP will host numerous 1 and 2 day tutorial sessions prior to the conference. If you are interested in delivering a tutorial at this event, please see the [http://www.owasp.org/index.php/AppSec_Brasil_2009#tab=Call_for_Training_Provider Call for Training Provider].
+
'''SQL Injection: Amplifying Data Lekeage'''<br>
  
==== Practical Information ====
+
''Ulisses Castro''
  
'''Venue'''
+
Talk about how some SQL Injection techniques works and how they can be more effective when mixin with some available database native functions.
  
[[Image:CongressoNacional.jpg|The Palácio do Congresso building]]
+
The main idea is how you can amplifying the amount of data that is downloaded per request to the web server.<br>
  
The event will be held in Brasília, Brazil's Capital at: Câmara dos Deputados, Anexo II, Praça dos Três Poderes.
 
  
You can check the location at [http://maps.google.com/maps?f=q&source=s_q&hl=pt-BR&geocode=&q=anexo+II,+camara+dos+deputados,+brasilia&sll=37.0625,-95.677068&sspn=43.934478,79.101563&ie=UTF8&t=h&ll=-15.800058,-47.865822&spn=0.01309,0.019312&z=16 Google Maps]
+
[http://www.owasp.org/images/5/5c/Owaspappsecbrazil2009sqlinjectionamplifyingdataleakeage-091118084536-phpapp01.pdf Slides]<br> [http://vimeo.com/7460521 Video]  
  
'''Registration'''
+
<br> '''Automated SQL Ownage Techniques'''  
  
Will be available soon.
+
''Sebastian Cufre'', Core Security
  
 +
This talk is about web application security assessment. In particular, in this talk we set to improve the assessment process for SQL injection vulnerabilities by providing the means to discard exogenous "false positive" alarms and confirm exploitable vulnerabilities.
  
'''Accommodations'''
+
We propose a black-box technique to detect and exploit SQL injection vulnerabilities. The exploitation provides an interface to execute arbitrary SQL code through them. Therefore, we are able to thoroughly assess the impact of the vulnerability (e.g., understand what a hacker can do).
  
To be defined
+
The core of this talk is in examining the difficulties that appear while trying to expose vulnerability and how to do a black-box interaction to automatically construct an exploit.
  
'''Transportation to the Conference'''
+
[http://www.owasp.org/images/3/3a/OWASP_Brasil_2009_-_Automated_SQL_Ownage_Techniques.pptx Slides]<br> [http://vimeo.com/7462181 Video]
  
To be defined
+
<br> '''Praticas e ferramentas fundamentais para o desenvolvimento de software seguro (''Tools and Practices for Secure Software Development'')'''
  
'''How to get to the venue?'''
+
''Cassio Goldschmidt'', Symantec
  
To be defined
+
Implementing a security program for the whole application life cycle can be a daunting and costly task. So, in the development of this talk, we will demonstrate how it is possible to lessen the risk of this program, using high quality resource freely available on the Internet and studying the practices considered fundamental by SAFECode members (EMC, Juniper, Microsoft, Nokia, SAP, symantec).
  
'''Registration and Conference Fees'''
+
[http://www.owasp.org/images/5/55/Praticas_e_ferramentas_fundamentais_para_o_desenvolvimento_de_software_seguro_-_AppSec_Brasil.pptx Slides]<br> [http://vimeo.com/7461207 Video]
  
There will be no fees for this conference, only '''registration''' is required to participate.
+
<br> '''Abordagem Preventiva para Teste de Segurança em Aplicações Web (''Preventive Approach for Web Application Security Testing'')'''  
  
==== Committees ====
+
''Luiz Otávio Duarte, Ferrucio de Franco Rosa, Walcir M. Cardoso Jr.'', CTI/MCT
  
'''Conference Committee'''
+
The objetive of this lecture is to present the approach used by CTI (Renato Archer Information Technology Center, institution under the Brazilian Ministry of Science and Technology) for security testing of web applications. The presentation is organized as follows: First, an introduction will be presented, including important concepts, motivation, statistics and most critical vulnerabilities nowadays.
  
OWASP Conferences Chair: Dave Wichers - Aspect Security - dave.wichers 'at' owasp.org
+
Later will be shown techniques for software testing and techniques for software security testing. Then we show the approach used by CTI to security testing web application such as inspection of source code, use of regular expressions and vulnerability detection techniques. A pratical demonstration will be presented after the approach overview.  
  
2009 AppSec Brasil Program Committee (appsec.brasil@camara.gov.br):
+
The presentation will be finalized with conclusions and recommendations of best practices for security testing web applications.  
* Conference Chair: Lucas C. Ferreira (lucas.ferreira at owasp.org)
+
* Tutorials Organization: Eduardo V. C. Neves (eduardo.neves at owasp.org)
+
* Tracks Organization: Wagner Elias (wagner.elias at owasp.org)
+
  
Pre-Event Organization Team
+
[http://www.owasp.org/images/8/8c/AprOwasp_LOD_FER_WAL_NewVersion.pdf Slides]<br> [http://vimeo.com/7460959 Video]
  
* Cassio Goldschmidt (cassio 'at' owasp.org)
+
<br> '''ModSecurity: Firewall OpenSource para Aplicações Web (WAF) (''ModSecurity, Open Source Web Application Firewall'')'''  
* Kuai Hinojosa (kuai.hinojosa 'at' owasp.org)
+
* Leonardo Cavallari - (leo.cavallari 'at' owasp.org)
+
* Thiago Lechuga (thiagoalz 'at' gmail.com)
+
* Dinis Cruz (dinis.cruz 'at' owasp.org)
+
  
Event Organization Team
+
''Klaubert Herr da Silveira''
  
 +
With the growing complexity and importance of web applications, short development schedule, new attack techniques and the lack of attention and/or focus of developer with security, regulations and the seek for best practices, is necessary add a new layer of security to web applications, the "web applications firewalls" or WAF's. This talk will show the concepts of WAF, specially of ModSecurity, open source web application firewall, a powerful and complex tool, designed to understand and protect the web applications of many types, Will be presented their functionalities, and how it can help the day-by-day of a web site, for monitoring, protection or even as a troubleshooting tool for web application.
  
 +
[http://www.owasp.org/images/d/d6/OWASP_BSB_ModSecurity_Klaubert-Herr.ppt Slides]<br> [http://vimeo.com/7462060 Video]
  
==== Links and other information ====
+
<br> '''Programação Segura utilizando Análise Estática (''Secure Programming with Static Analysis'')'''
  
Event page on LinkedIn: http://events.linkedin.com/OWASP-AppSec-Brasil/pub/65160
+
''Philippe Sevestre'', LeadComm
  
<headertabs/>
+
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine-tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution.
  
[[Category:OWASP AppSec Conference]]
+
We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.
 +
 
 +
[http://www.owasp.org/images/a/aa/AppSec_Brasil_2009-SecureProgrammingWithStaticAnalysis.pdf Slides]<br> [http://vimeo.com/7461756 Video]
 +
 
 +
<br>
 +
 
 +
==== Training Sessions  ====
 +
 
 +
'''Risk Management Applied to Web Services'''
 +
 
 +
''José Eduardo Malta de Sá Brandão'', IPEA
 +
 
 +
<span style="color: rgb(255, 0, 0);">This course will be in Portuguese only.</span>
 +
 
 +
Date: Oct 27<br> Time: Morning
 +
 
 +
This training will present the risk management discipline regarding web services. The course focus will show concepts and systematize this discipline, exemplifying with a case study to reinforce the utility and need of using these methodology to understand and develop web services. The course should provide its students the knowledge to develop their own risk management projects. The presentation will show concepts, models and compare the main standards related to security risk management.
 +
 
 +
[http://www.owasp.org/images/4/41/Owasp2009_brandao.ppt Slides]
 +
 
 +
<br> '''Web Security: Techniques for Secure Application Programming'''
 +
 
 +
''André Ricardo Abed Grégio e Vitor Monte Afonso'', CTI/MCT, ''Paulo Licio de Geus'', IC/UNICAMP
 +
 
 +
<span style="color: rgb(255, 0, 0);">This course will be in Portuguese only.</span>
 +
 
 +
Date: Oct 28<br> Time: afternoon
 +
 
 +
This course aims to present the principles and techniques of secure programming, specially web application programming, showing fundamental concepts and detailing the vulnerabilities which could be explored and focusing on the methods to mitigate those faults. We will present some examples of how some OWASP Top Ten vulnerabilities can be corrected in different programming languages, with code vulnerable snippets from code reviews conducted by the training authors. Some tools for detecting attacks and web application vulnerability testing will be presented.
 +
 
 +
[http://www.owasp.org/images/9/9f/AppSecBR2009_VAfonso_AGregio_PGeus.pdf Slides]
 +
 
 +
<br> '''Computational Security in Web Service Development'''
 +
 
 +
''Júlio Cesar Estrella et al'', ICMC/USP
 +
 
 +
<span style="color: rgb(255, 0, 0);">This course will be in Portuguese only.</span>
 +
 
 +
Date: Oct 28<br> Time: all day
 +
 
 +
This training session will present the development of distributed applications using the concept of SOA and considering its computational security. For the development of the client and server applications, we will use the Apache Axis2 engine. The basic components of Axis2 will be presented, as well as the web service invocation types and models, and their main characteristics. Two web service security standards will be seen in the context of the Apache Axis2 engine: WS-Security and SAML. The methodology used for this training session includes theory and practice, touching the fundamental concepts of the Axis2 engine and the construction of real applications with focus on security.
 +
 
 +
[http://www.owasp.org/images/e/ef/AppSec_Brasil_2009_Web_Services_Security.pdf Slides]
 +
 
 +
<br> '''Security Technologies in Web Services'''
 +
 
 +
''Eduardo Takeo Ueda e Wilson Vicente Ruggiero'', Poli/USP
 +
 
 +
<span style="color: rgb(255, 0, 0);">This course will be in Portuguese only.</span>
 +
 
 +
Data: Oct 28<br> Time: morning
 +
 
 +
Due to their integration characteristics and because they use open standards, web services have become an area of great interest to academics and industry. Firstly, we will introduce the basic concepts of a service oriented architecture, so the training can be self sufficient. After, we will present the main security standards and specifications in development and which must be adopted for web services. Lastly, the training ends with an exposition of the current challenges in web service security.
 +
 
 +
<br> '''Hands on Web Application Testing using the OWASP Testing Guide.'''
 +
 
 +
''Matt Tesauro'', OWASP
 +
 
 +
Date: Oct 27 and 28 (2 days)<br> Time: all day
 +
 
 +
The training will cover the critical areas of web application testing using the OWASP Testing Guide v3 as the framework for testing an application and the OWASP Live CD for the tools to test with. A custom version of the OWASP Live CD will be created for the training. It will include a self-contained testing environment providing vulnerable applications so that both tools and the applications to test them on are provided.
 +
 
 +
<span style="color: rgb(255, 0, 0);">This course requires a laptop for the hands-on activities. Each student should bring its own laptop.</span>
 +
 
 +
[http://www.owasp.org/images/9/97/Matt.tesauro.hands.on.zip Slides]
 +
 
 +
==== Venue  ====
 +
 
 +
[[Image:CongressoNacional.jpg|The Palácio do Congresso building]]
 +
 
 +
The event will be held in Brasília, Brazil's Capital at: Câmara dos Deputados, Anexo II, Praça dos Três Poderes.
 +
 
 +
You can check the location at [http://maps.google.com/maps?f=q&source=s_q&hl=pt-BR&geocode=&q=anexo+II,+camara+dos+deputados,+brasilia&sll=37.0625,-95.677068&sspn=43.934478,79.101563&ie=UTF8&t=h&ll=-15.800058,-47.865822&spn=0.01309,0.019312&z=16 Google Maps]
 +
 
 +
'''Training Sessions'''
 +
 
 +
All training sessions will happen in the Deputy Chamber Cororate University (CEFOR), which is located at the following address:
 +
 
 +
Centro de Formação, Treinamento e Aperfeiçoamente da Câmara dos Deputados, via N3, Projeção L, Setor de Garagens Ministeriais Norte, Complexo Avançado da Câmara dos Deputados, Bloco B.
 +
 
 +
Check its location on [http://maps.google.com.br/maps/ms?ie=UTF8&hl=pt-BR&msa=0&ll=-15.793895,-47.864009&spn=0.005017,0.006866&t=h&z=17&msid=106468407154665154285.0004577c477849eda80f3 this map].
 +
 
 +
''How to get there''
 +
 
 +
We are trying to provided a transfer from somewhere in the ''Esplanada dos Ministérios'', which is accessible by bus. Any new information on this will be posted in this page.
 +
 
 +
To go by taxi, show the map to the driver. It is improbable tha any taxi driver will be able to get you to the training sessions location just by reading is address. With the map, arriving to the location is quite easy and fast from any downtown location.
 +
 
 +
We strongly recommend against getting to the trainings in your own car, as it is very difficult to find unused parking slots in this part of town.
 +
 
 +
==== Registration  ====
 +
 
 +
'''Registration and Conference Fees'''
 +
 
 +
There will be no fees for this conference, only '''registration''' is required to participate. The registration form can be found [http://www2.camara.gov.br/eventos/appsec-brasil-2009-confer.-inter.-de-seguranca-de/inscricao here].
 +
 
 +
The training session registration form can be found [https://creator.zoho.com/lucas.ferreira/appsec-mini-cursos/ here]
 +
 
 +
==== Committees  ====
 +
 
 +
'''Conference Committee'''
 +
 
 +
OWASP Conferences Chair: Dave Wichers - Aspect Security - dave.wichers 'at' owasp.org
 +
 
 +
2009 AppSec Brasil Program Committee (appsec.brasil@camara.gov.br):
 +
 
 +
*Conference Chair: Lucas C. Ferreira (lucas.ferreira at owasp.org)
 +
*Tutorials Organization: Eduardo V. C. Neves (eduardo.neves at owasp.org)
 +
*Tracks Organization: Wagner Elias (wagner.elias at owasp.org)
 +
 
 +
Organization Team
 +
 
 +
*Cassio Goldschmidt (cassio 'at' owasp.org)
 +
*Kuai Hinojosa (kuai.hinojosa 'at' owasp.org)
 +
*Leonardo Cavallari - (leo.cavallari 'at' owasp.org)
 +
*Thiago Lechuga (thiagoalz 'at' gmail.com)
 +
*Dinis Cruz (dinis.cruz 'at' owasp.org)
 +
 
 +
<br>
 +
 
 +
==== Links and other information  ====
 +
 
 +
Event page on LinkedIn: http://events.linkedin.com/OWASP-AppSec-Brasil/pub/65160
 +
 
 +
==== FAQ  ====
 +
 
 +
'''Q. Who is promoting the conference?'''
 +
 
 +
A. This conference is being supported and organized by the [http://www.ticontrole.gov.br TI-Controle Community] and the [http://www.camara.gov.br Deputy Chamber], with the contents (presentations, keynotes, training, etc) selected by the OWASP [[Brazilian]] Chapter.
 +
 
 +
'''Q. What will it cost?'''
 +
 
 +
A. Nothing. Thanks to its sponsor, the conference will be free of charge. However we have limited seats, so please register early.
 +
 
 +
<br> '''''Call For Papers'''''
 +
 
 +
'''Q. What is the Open Web Application Security Project (OWASP)?'''
 +
 
 +
The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work with your support.
 +
 
 +
'''Q. How many speaking slots are there?'''
 +
 
 +
Please see the Conference Agenda in its [http://www.owasp.org/index.php/AppSec_Brasil_2009 main page].
 +
 
 +
'''Q. What are the submission deadlines?'''
 +
 
 +
The CFP submission deadline is July 11th, with the final version of the presentation material due September 15th 2009.
 +
 
 +
'''Q: Who is allowed to submit presentations?'''
 +
 
 +
A: Original authors may submit presentations for consideration. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.
 +
 
 +
'''Q: Why aren't Third Parties such as PR Firms allowed to submit presentations?'''
 +
 
 +
A: Due to potential copyright and intellectual property liability issues as well as the need for OWASP to have direct contact with potential and selected presenters to expedite selection and deliverable materials, we require that only original authors of presentations submit for the Call for Papers. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.
 +
 
 +
'''Q: Are there any restrictions on the content of the presentations?'''
 +
 
 +
A: Yes, all presentations must respect the rules defined in the OWASP [[Speaker Agreement]].
 +
 
 +
'''Q: How long will I have to wait before I am notified if I have been accepted or denied?'''
 +
 
 +
A: Submitters will be notified of the status (acceptance or denial) on August 7th 2009.
 +
 
 +
'''Q. Is there an honorarium for presenters?'''
 +
 
 +
No. OWASP is committed to making its conferences available to the widest possible audience. In order to do this OWASP keeps the entrance free for the AppSec Brazil 2009 to make the conference accessible. As a result we are unable to provide a monetary honorarium but we welcome our speakers as our guests to the conference where they can network with other security professionals. We will provide lodging and domestic air travel for one presenter for each selected work.
 +
 
 +
'''Q: I have been accepted. What are the materials that I have to turn in and what are the deadlines?'''
 +
 
 +
A: The following is a list of materials that are required from each accepted presentation. Failure to proceed these materials by the deadlines set forth for the event the presentation was accepted for will result in cancellation of acceptance.
 +
 
 +
*A confirmed [[Speaker Agreement|Speaker Agreement]] (July 15th 2009)
 +
*Presentation in PowerPoint or Keynote format using the [http://www.owasp.org/images/5/54/Presentation_template.ppt OWASP Template] (September 15th 2009)
 +
*Detailed Bibliography of resources, co-authors, etc. (September 15th 2009)
 +
*Optional White Paper for inclusion on CD (September 15th 2009)
 +
 
 +
'''Q: Do I have to submit a White Paper?'''
 +
 
 +
A: No. We would certainly appreciate any White Papers that can be included on the conference web site but they are not required. If you have written an existing white paper to go along with your presentation, please submit it with your CFP submission. Submissions with attached White Papers will receive additional consideration.
 +
 
 +
'''Q: What if I have a co-author who is not presenting. How do I cite the person(s)?'''
 +
 
 +
A: All co-authors and works that have been used should be cited in a detailed bibliography that will be published on the Conference CD.
 +
 
 +
'''Q: I have been accepted and would like to add co-presenters. Can I still do this?'''
 +
 
 +
A: No. Co-presenters should have been added at the time that the Presentation was submitted. They may attend the conference and present if they register as any other participant.
 +
 
 +
'''Q: My PR company/friends/co-workers/family would like to come see me give my presentation. Will they be allowed in for free?'''
 +
 
 +
A: Yes, but they need to register on the conference web site as any other conference participant.
 +
 
 +
'''Q. I have more questions'''
 +
 
 +
A: Email appsec.brasil@camara.gov.br concerning this event.
 +
 
 +
<br> __NOTOC__ <headertabs />
 +
 
 +
[[Category:OWASP_AppSec_Conference]]

Latest revision as of 04:55, 2 December 2009


Para a versão em português, veja em AppSec Brasil 2009 (pt-br)

International Conference on Application Security

TI-Controle and the Computing Centre of the Deputy Chamber present the First International Conference on Application Security that will happen in Brasilia, Capital of Brazil with the support of OWASP Brazilian Chapter. The Conference consists of two days of training sessions, followed by a two-day conference on a single track. Brasilia Panorama.jpg

Conference Dates

The conference will happen from October 27th, 2009 to October 30th, 2009. The first two days will be tutorial days (see below). Plenary sessions will be held on October 29th and 30th.

Conference's Slides and Videos

The Presentations' slides and videos are available under the Presentation Abstracts tab.

The Training Sessions' slides are available under the Training Sessions tab


Sponsorship

This conference is promoted by TI-Controle Community and organized by Computing Centre of Brazilian Deputy Chamber.

The conference is supported by OWASP Brazilian Chapter, as content provider (talks selection, trainings and schedule grid).

The conference is supported by the University of Brasilia (UnB) Unb.gif

The conference is sponsored by Conviso IT Security CorVersao BR Small.jpg and LeadComm LeadComm Logo Screen.jpg


Keynotes

GaryMcGraw.JPG
Gary McGraw

CTO, Cigital

Title: The Building Security In Maturity Model (BSIMM)

Bio: Gary McGraw is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C. area. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Java Security, Building Secure Software, Exploiting Software, Software Security, and Exploiting Online Games; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 100 peer-reviewed scientific publications, authors a monthly security column for informIT, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean's Advisory Council for the School of Informatics. Gary served on the IEEE Computer Society Board of Governors, produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine (syndicated by informIT), and produces the Reality Check Security Podcast for CSO Online.


Jason Li and Jerry Hoff

Aspect Security

Title: Agile and Secure: Can We Do Both?

Bio: Jason Li is a Senior Application Security Engineer at Aspect Security. Jason has led security architecture reviews, application security code reviews, penetration tests and provided web application security training services for a variety of commercial, financial, and government customers. He is also actively involved in the Open Web Application Security Project (OWASP), serving on the OWASP Global Projects Committee and as a co-author of the OWASP AntiSamy Project (Java version). Jason earned his Post-Master's degree in Computer Science with a concentration in Information Assurance from Johns Hopkins University. He earned his Master's degree in Computer Science from Cornell University, where he also earned his Bachelor's degree, double majoring in Computer Science and Operations Research.

Jerry Hoff is a Senior Application Security Engineer at Aspect Security. Jerry has led and performed numerous application security code reviews for clients across multiple industries. Jerry also provides training services for clients, and has over 10 years teaching and development experience. Jerry is also involved in the Open Web Application Security Project (OWASP) and was the lead developer of AntiSamy.net project. He has a master's degree in Computer Science from Washington University in St. Louis.


Dinis Cruz

OWASP Board

Title: To be defined

Bio: Coming Soon.


Kuai Hinojosa

OWASP

Title: Deploying Secure Web Applications with OWASP Resources

Bio: Kuai Hinojosa has been developing and securing web applications for about 12 years. He previously worked in the banking industry as a database security administrator for the 5th largest bank in the U.S. where he worked in a small team developing applications that protected company's assets. He now works for New York University as a Web Applications Specialist where he continues to use web application development and application security experience to protect university resources. In his spare time Kuai volunteers his time preaching the application security gospel and leading the Minneapolis OWASP chapter. Kuai is a member of the OWASP (Open Web Application Security Project) Global Education Committee.

Agenda

Conference Program - Day 1 - October 29th 2009

08:30 - 09:00 Reception Desk Open
09:00 - 10:00 Opening Ceremony
10:00 - 10:30 Dinis Cruz
What is OWASP?
10:30 - 12:30 Gary McGraw (Cigital)
The Building Security In Maturity Model (BSIMM)
12:30 - 14:00 Lunch Break
14:00 - 14:50 Dinis Cruz
OWASP Project Tour
14:50 - 15:40 Thomas Schreiber
The Logic and Semantic Layer of Web Application Security
15:40 - 16:00 Break
16:00 - 16:50 Brian Contos
Making a Case for Data Security to Network-Centric Peers and Managers and Leveraging Web Application Firewalls (WAF) and Database Activity Monitoring (DAM) to Augment Secure Coding & Review Practices
16:50 - 17:40 Matt Tesauro
OWASP ROI: Optimize Security Spending using OWASP
17:40 - 18300 Pravir Chandra
Software Assurance Maturity Model (SAMM)
18:30 - 18:35 End of the First Day Program



Conference Program - Day 2 - October 30th 2009

08:30 - 09:00 Reception Desk Open
09:00 - 10:30 Jason Li e Jerry Hoff (Aspect Security)
Agile and Secure - Can we do both?
10:30 - 10:50 Break
10:30 - 11:40 Cassio Goldschmidt
Praticas e ferramentas fundamentais para o desenvolvimento de software seguro
(Tools and Practices for Secure Software Development)
11:40 - 12:30 Luiz Otávio Duarte
Abordagem Preventiva para Teste de Segurança em Aplicações Web
(Preventive Approach for Web Application Security Testing)
12:30 - 14:00 Lunch Break
14:00 - 15:10 Ulisses Castro
SQL Injection: Amplifying Data Leakeage
15:10 - 16:00 Sebastian Cufre
Automated SQL Ownage Techniques
16:00 - 16:20 Break
16:20 - 17:10 Klaubert Herr da Silveira
ModSecurity: Firewall OpenSource para Aplicações Web (WAF)
(ModSecurity, Open Source Web Application Firewall)
17:10 - 18:00 Philippe Sevestre
Programação Segura utilizando Análise Estática
(Secure Programming with Static Analysis)
18:00 - 18:30 End of the Conference


Presentation Abstracts

The Building Security In Maturity Model (BSIMM)

Gary McGraw, Cigital

As a discipline, software security has made great progress over the last decade. There are now at least 34 large scale software security initiatives underway in enterprises including global financial services firms, independent software vendors, defense organizations, and other verticals. In 2008, Brian Chess, Sammy Migues and I interviewed the executives running nine initiatives using the twelve practices of the Software Security Framework as our guide. Those companies among the nine who graciously agreed to be identified include: Adobe, The Depository Trust and Clearing Corporation (DTCC), EMC, Google, Microsoft, QUALCOMM, and Wells Fargo. The resulting data, drawn from real programs at different levels of maturity was used to guide the construction of the Building Security In Maturity Model (BSIMM). This talk will describe the observation-based maturity model, drawing examples from many real software security programs. A maturity model is appropriate because improving software security almost always means changing the way an organization works ---people, process, and automation are all required. While not all organizations need to achieve the same security goals, all successful large scale software security initiatives share common ideas and approaches. Whether you rely on the Cigital Touchpoints, Microsoft's SDL, or OWASP CLASP, there is much to learn from practical experience. Use the BSIMM as a yardstick to determine where you stand and what kind of software security plan will work best for you.

Slides
Video


Agile and Secure: Can We Do Both?

Jason Li and Jerry Hoff, Aspect Security

Agile is taking the software development world by storm, but security has been slow to adapt. What can we learn from the Agile movement? Is it possible to achieve security and remain Agile? Jason and Jerry will share Aspect Security's experiences working with Agile teams to gain assurance and save money. They'll compare and contrast traditional waterfall and agile processes and show how we can achieve assurance and security while remaining true to Agile principles.

Slides
Video


Deploying Secure Web Applications with OWASP Resources

Kuai Hinojosa, NY University and OWASP

Universities are key to making application security visible and the need to educate software developers about application security as an aspect of proper software development has never been more important. In this presentation I will share how OWASP resources can be used by universities to develop, test and deploy secure web applications. I will discuss challenges that Universities currently face integrating a pplication security best practices, describe how OWASP tools and resources are currently used at New York University to test for most common web application flaws. I will introduce projects such as the OWASP Enterprise Security API which can be used to mitigate most common flaws in web applications and share initiatives the OWASP Global Education Committee is currently working on. If you are interested in securing web applications, and supporting the OWASP Global Education Committee efforts you don't want to miss this!


What is OWASP

Dinis Cruz, OWASP

TBD.

Video


OWASP Project Tour

Dinis Cruz, OWASP

TBD.

Video


The Logic and Semantic Layer of Web Application Security

Thomas Schreiber, SecureNet

Testing Web Application Security mostly focusses on technical weaknesses only. But there is a huge field of potential weaknesses above the server layer and beyond the implementational aspects. Even if a web application is totally free from security bugs in code and system, it may still be vulnerable to dangerous threats. It is the kind how the business logic is mapped onto software, that gives an attacker a starting point for his bad intents. The presentation shows, illustrated with various real examples, how a clever hacker may reveal sensitive data - including credit card data -, enter into user accounts or conduct a denial-of-service on the whole infrastructure - not only the server - by attacking the logical and semantical layers. The presentation also gives hints on how to avoid these pitfalls.


Making a Case for Data Security to Network-Centric Peers and Managers and Leveraging Web Application Firewalls (WAF) and Database Activity Monitoring (DAM) to Augment Secure Coding & Review Practices

Brian Contos, Imperva

Information system security has changed. The days of being focused on network security measures, operating system vulnerabilities, and open ports, while still important, is no longer the main concern for most organizations. Today, the attackers – organized crime, competitors, nation-states, and malicious insiders are going after the assets that process and store data: applications and databases. The criminals are already fighting the fight on this front. In response, organizations are deploying new defenses - adopting application and data security countermeasures that allow them to protect, monitor and respond to nefarious activity.

Slides
Video


OWASP ROI: Optimize Security Spending using OWASP

Matt Tesauro

Considering the current economic times, security spending is tighter than ever. This presentation will cover the Open Web Application Security Project (OWASP) projects and how they can improve your application security posture in a budgetfriendly way. OWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. The OWASP Foundation is a notforprofit entity and provides unbiased, practical, costeffective information about application security. Projects covered include the OWASP Top 10, OWASP Testing Guide, OpenSAMM Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Application Security Desk Reference (ASDR) and others. A case study of a specific company's success with implementing OWASP methodologies and tools will also be provided. In this case study, the company realized a saving of nearly $400,000 in year one.

Slides
Video


Software Assurance Maturity Model (SAMM)

Pravir Chandra, Fortify

The Software Assurance Maturity Model (SAMM) (http://www.opensamm.org) is a flexible and prescriptive framework for building security into a software development organization. Covering more than typical SDLC-based models for security, SAMM enables organizations to self-assess their security assurance program and then use recommended roadmaps to improve in a way that's aligned to the specific risks facing the organization. Beyond that, SAMM enables creation of scorecards for an organization's effectiveness at secure software development throughout the typical governance, development, and deployment business functions. Scorecards also enable management within an organization to demonstrate quantitative improvements through iterations of building a security assurance program. This workshop will introduce the SAMM framework and walk through useful activities such as assessing an assurance program, mapping an existing organization to a recommended roadmap, and iteratively building an assurance program. Time allowing, additional case studies will also be discussed. SAMM is an open a free project and has recently been added under the Open Web Application Security Project (OWASP).

Slides
Video


SQL Injection: Amplifying Data Lekeage

Ulisses Castro

Talk about how some SQL Injection techniques works and how they can be more effective when mixin with some available database native functions.

The main idea is how you can amplifying the amount of data that is downloaded per request to the web server.


Slides
Video


Automated SQL Ownage Techniques

Sebastian Cufre, Core Security

This talk is about web application security assessment. In particular, in this talk we set to improve the assessment process for SQL injection vulnerabilities by providing the means to discard exogenous "false positive" alarms and confirm exploitable vulnerabilities.

We propose a black-box technique to detect and exploit SQL injection vulnerabilities. The exploitation provides an interface to execute arbitrary SQL code through them. Therefore, we are able to thoroughly assess the impact of the vulnerability (e.g., understand what a hacker can do).

The core of this talk is in examining the difficulties that appear while trying to expose vulnerability and how to do a black-box interaction to automatically construct an exploit.

Slides
Video


Praticas e ferramentas fundamentais para o desenvolvimento de software seguro (Tools and Practices for Secure Software Development)

Cassio Goldschmidt, Symantec

Implementing a security program for the whole application life cycle can be a daunting and costly task. So, in the development of this talk, we will demonstrate how it is possible to lessen the risk of this program, using high quality resource freely available on the Internet and studying the practices considered fundamental by SAFECode members (EMC, Juniper, Microsoft, Nokia, SAP, symantec).

Slides
Video


Abordagem Preventiva para Teste de Segurança em Aplicações Web (Preventive Approach for Web Application Security Testing)

Luiz Otávio Duarte, Ferrucio de Franco Rosa, Walcir M. Cardoso Jr., CTI/MCT

The objetive of this lecture is to present the approach used by CTI (Renato Archer Information Technology Center, institution under the Brazilian Ministry of Science and Technology) for security testing of web applications. The presentation is organized as follows: First, an introduction will be presented, including important concepts, motivation, statistics and most critical vulnerabilities nowadays.

Later will be shown techniques for software testing and techniques for software security testing. Then we show the approach used by CTI to security testing web application such as inspection of source code, use of regular expressions and vulnerability detection techniques. A pratical demonstration will be presented after the approach overview.

The presentation will be finalized with conclusions and recommendations of best practices for security testing web applications.

Slides
Video


ModSecurity: Firewall OpenSource para Aplicações Web (WAF) (ModSecurity, Open Source Web Application Firewall)

Klaubert Herr da Silveira

With the growing complexity and importance of web applications, short development schedule, new attack techniques and the lack of attention and/or focus of developer with security, regulations and the seek for best practices, is necessary add a new layer of security to web applications, the "web applications firewalls" or WAF's. This talk will show the concepts of WAF, specially of ModSecurity, open source web application firewall, a powerful and complex tool, designed to understand and protect the web applications of many types, Will be presented their functionalities, and how it can help the day-by-day of a web site, for monitoring, protection or even as a troubleshooting tool for web application.

Slides
Video


Programação Segura utilizando Análise Estática (Secure Programming with Static Analysis)

Philippe Sevestre, LeadComm

Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine-tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution.

We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.

Slides
Video


Training Sessions

Risk Management Applied to Web Services

José Eduardo Malta de Sá Brandão, IPEA

This course will be in Portuguese only.

Date: Oct 27
Time: Morning

This training will present the risk management discipline regarding web services. The course focus will show concepts and systematize this discipline, exemplifying with a case study to reinforce the utility and need of using these methodology to understand and develop web services. The course should provide its students the knowledge to develop their own risk management projects. The presentation will show concepts, models and compare the main standards related to security risk management.

Slides


Web Security: Techniques for Secure Application Programming

André Ricardo Abed Grégio e Vitor Monte Afonso, CTI/MCT, Paulo Licio de Geus, IC/UNICAMP

This course will be in Portuguese only.

Date: Oct 28
Time: afternoon

This course aims to present the principles and techniques of secure programming, specially web application programming, showing fundamental concepts and detailing the vulnerabilities which could be explored and focusing on the methods to mitigate those faults. We will present some examples of how some OWASP Top Ten vulnerabilities can be corrected in different programming languages, with code vulnerable snippets from code reviews conducted by the training authors. Some tools for detecting attacks and web application vulnerability testing will be presented.

Slides


Computational Security in Web Service Development

Júlio Cesar Estrella et al, ICMC/USP

This course will be in Portuguese only.

Date: Oct 28
Time: all day

This training session will present the development of distributed applications using the concept of SOA and considering its computational security. For the development of the client and server applications, we will use the Apache Axis2 engine. The basic components of Axis2 will be presented, as well as the web service invocation types and models, and their main characteristics. Two web service security standards will be seen in the context of the Apache Axis2 engine: WS-Security and SAML. The methodology used for this training session includes theory and practice, touching the fundamental concepts of the Axis2 engine and the construction of real applications with focus on security.

Slides


Security Technologies in Web Services

Eduardo Takeo Ueda e Wilson Vicente Ruggiero, Poli/USP

This course will be in Portuguese only.

Data: Oct 28
Time: morning

Due to their integration characteristics and because they use open standards, web services have become an area of great interest to academics and industry. Firstly, we will introduce the basic concepts of a service oriented architecture, so the training can be self sufficient. After, we will present the main security standards and specifications in development and which must be adopted for web services. Lastly, the training ends with an exposition of the current challenges in web service security.


Hands on Web Application Testing using the OWASP Testing Guide.

Matt Tesauro, OWASP

Date: Oct 27 and 28 (2 days)
Time: all day

The training will cover the critical areas of web application testing using the OWASP Testing Guide v3 as the framework for testing an application and the OWASP Live CD for the tools to test with. A custom version of the OWASP Live CD will be created for the training. It will include a self-contained testing environment providing vulnerable applications so that both tools and the applications to test them on are provided.

This course requires a laptop for the hands-on activities. Each student should bring its own laptop.

Slides

Venue

The Palácio do Congresso building

The event will be held in Brasília, Brazil's Capital at: Câmara dos Deputados, Anexo II, Praça dos Três Poderes.

You can check the location at Google Maps

Training Sessions

All training sessions will happen in the Deputy Chamber Cororate University (CEFOR), which is located at the following address:

Centro de Formação, Treinamento e Aperfeiçoamente da Câmara dos Deputados, via N3, Projeção L, Setor de Garagens Ministeriais Norte, Complexo Avançado da Câmara dos Deputados, Bloco B.

Check its location on this map.

How to get there

We are trying to provided a transfer from somewhere in the Esplanada dos Ministérios, which is accessible by bus. Any new information on this will be posted in this page.

To go by taxi, show the map to the driver. It is improbable tha any taxi driver will be able to get you to the training sessions location just by reading is address. With the map, arriving to the location is quite easy and fast from any downtown location.

We strongly recommend against getting to the trainings in your own car, as it is very difficult to find unused parking slots in this part of town.

Registration

Registration and Conference Fees

There will be no fees for this conference, only registration is required to participate. The registration form can be found here.

The training session registration form can be found here

Committees

Conference Committee

OWASP Conferences Chair: Dave Wichers - Aspect Security - dave.wichers 'at' owasp.org

2009 AppSec Brasil Program Committee (appsec.brasil@camara.gov.br):

  • Conference Chair: Lucas C. Ferreira (lucas.ferreira at owasp.org)
  • Tutorials Organization: Eduardo V. C. Neves (eduardo.neves at owasp.org)
  • Tracks Organization: Wagner Elias (wagner.elias at owasp.org)

Organization Team

  • Cassio Goldschmidt (cassio 'at' owasp.org)
  • Kuai Hinojosa (kuai.hinojosa 'at' owasp.org)
  • Leonardo Cavallari - (leo.cavallari 'at' owasp.org)
  • Thiago Lechuga (thiagoalz 'at' gmail.com)
  • Dinis Cruz (dinis.cruz 'at' owasp.org)


Links and other information

Event page on LinkedIn: http://events.linkedin.com/OWASP-AppSec-Brasil/pub/65160

FAQ

Q. Who is promoting the conference?

A. This conference is being supported and organized by the TI-Controle Community and the Deputy Chamber, with the contents (presentations, keynotes, training, etc) selected by the OWASP Brazilian Chapter.

Q. What will it cost?

A. Nothing. Thanks to its sponsor, the conference will be free of charge. However we have limited seats, so please register early.


Call For Papers

Q. What is the Open Web Application Security Project (OWASP)?

The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work with your support.

Q. How many speaking slots are there?

Please see the Conference Agenda in its main page.

Q. What are the submission deadlines?

The CFP submission deadline is July 11th, with the final version of the presentation material due September 15th 2009.

Q: Who is allowed to submit presentations?

A: Original authors may submit presentations for consideration. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.

Q: Why aren't Third Parties such as PR Firms allowed to submit presentations?

A: Due to potential copyright and intellectual property liability issues as well as the need for OWASP to have direct contact with potential and selected presenters to expedite selection and deliverable materials, we require that only original authors of presentations submit for the Call for Papers. Third party representatives such as PR firms or Speaker Representatives MAY NOT submit materials on behalf of a potential speaker.

Q: Are there any restrictions on the content of the presentations?

A: Yes, all presentations must respect the rules defined in the OWASP Speaker Agreement.

Q: How long will I have to wait before I am notified if I have been accepted or denied?

A: Submitters will be notified of the status (acceptance or denial) on August 7th 2009.

Q. Is there an honorarium for presenters?

No. OWASP is committed to making its conferences available to the widest possible audience. In order to do this OWASP keeps the entrance free for the AppSec Brazil 2009 to make the conference accessible. As a result we are unable to provide a monetary honorarium but we welcome our speakers as our guests to the conference where they can network with other security professionals. We will provide lodging and domestic air travel for one presenter for each selected work.

Q: I have been accepted. What are the materials that I have to turn in and what are the deadlines?

A: The following is a list of materials that are required from each accepted presentation. Failure to proceed these materials by the deadlines set forth for the event the presentation was accepted for will result in cancellation of acceptance.

  • A confirmed Speaker Agreement (July 15th 2009)
  • Presentation in PowerPoint or Keynote format using the OWASP Template (September 15th 2009)
  • Detailed Bibliography of resources, co-authors, etc. (September 15th 2009)
  • Optional White Paper for inclusion on CD (September 15th 2009)

Q: Do I have to submit a White Paper?

A: No. We would certainly appreciate any White Papers that can be included on the conference web site but they are not required. If you have written an existing white paper to go along with your presentation, please submit it with your CFP submission. Submissions with attached White Papers will receive additional consideration.

Q: What if I have a co-author who is not presenting. How do I cite the person(s)?

A: All co-authors and works that have been used should be cited in a detailed bibliography that will be published on the Conference CD.

Q: I have been accepted and would like to add co-presenters. Can I still do this?

A: No. Co-presenters should have been added at the time that the Presentation was submitted. They may attend the conference and present if they register as any other participant.

Q: My PR company/friends/co-workers/family would like to come see me give my presentation. Will they be allowed in for free?

A: Yes, but they need to register on the conference web site as any other conference participant.

Q. I have more questions

A: Email appsec.brasil@camara.gov.br concerning this event.