Difference between revisions of "Belgium"

From OWASP
Jump to: navigation, search
(PRESENTATIONS)
m
(41 intermediate revisions by 3 users not shown)
Line 4: Line 4:
  
 
== Stay updated  ==
 
== Stay updated  ==
 +
 +
"'''BeNeLux Days 2012'''" is online: https://www.owasp.org/index.php/BeNeLux_OWASP_Day_2012.
 +
 +
 
If you want to be invited for the next OWASP Belgium Chapter meetings, please [http://eepurl.com/iFZtb drop us your contact info].
 
If you want to be invited for the next OWASP Belgium Chapter meetings, please [http://eepurl.com/iFZtb drop us your contact info].
  
 
You can also follow us on [https://twitter.com/owasp_be Twitter]!
 
You can also follow us on [https://twitter.com/owasp_be Twitter]!
  
== Structural Sponsors 2011/2012  ==
+
== Structural Sponsors 2012/2013 ==
 
OWASP Member affiliated to the Belgium chapter:
 
OWASP Member affiliated to the Belgium chapter:
  
{{MemberLinks|link=http://www.ascure.com|logo=Ascure_Logo.jpg}}
+
{{MemberLinks|link=http://www.pwc.com/|logo=PWC_log_resized.png}}
  
OWASP Belgium thanks its structural chapter supporters for 2011 and the OWASP BeNeLux Day 2011:  
+
OWASP Belgium thanks its structural chapter supporters for 2012 and the OWASP BeNeLux Days 2012:  
  
 +
[http://www.iminds.be https://www.owasp.org/images/thumb/a/a1/Iminds-logo.png/200px-Iminds-logo.png]
 
[http://www.zionsecurity.com https://www.owasp.org/images/e/e6/Zionsecurity.jpg]
 
[http://www.zionsecurity.com https://www.owasp.org/images/e/e6/Zionsecurity.jpg]
[http://www.zenitelbelgium.com https://www.owasp.org/images/d/df/SAIT_Zenitel.jpg]
+
[http://on2it.net https://www.owasp.org/images/3/3d/On2it-sponsor.png]
[http://www.barracuda.com https://www.owasp.org/images/f/f6/Bnl11-Barracuda_Logo-4C.png]
+
[http://www.f5.com https://www.owasp.org/images/f/fd/AppSec_Research_2010_sponsor_F5_logo.jpg]
+
  
 
If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]
 
If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]
Line 27: Line 30:
  
  
== Next Meeting (26th of September 2012) in Ghent ==
+
== Next Meeting (8th of October 2013) in Diegem ==
  
 
=== WHEN ===
 
=== WHEN ===
 
+
8th of October 2013 (18h00 - 21h00)
26th of September 2012 (18h00 - 21h00)
+
  
 
=== WHERE  ===
 
=== WHERE  ===
 +
Hosted by [http://www.ey.com Ernst & Young].
  
Hosted by [http://www.pwc.be/ PWC].
+
Address: <br>
 
+
Ernst & Young<br>
Co-organized with the [http://www.issa-be.org ISSA (Information Systems Security Association)]
+
De Kleetlaan 2<br>
 
+
B1831 Diegem<br>
Address: <br>  
+
Location: [https://www.google.com/maps?q=Ernst+%26+Young+Tax+Consultants,+De+Kleetlaan,+Diegem,+Machelen,+Belgium&hl=en&ll=50.887198,4.449935&spn=0.009124,0.017488&sll=50.881364,4.436437&sspn=0.009125,0.017488&oq=ernst+%26+young+diegem&hq=Ernst+%26+Young+Tax+Consultants,&hnear=De+Kleetlaan,+Diegem+1831+Machelen,+Vlaams-Brabant,+Vlaams+Gewest,+Belgium&t=m&z=16&iwloc=A Google Maps].
PWC Ghent (Wilson) - Club<br>
+
Wilsonplein 5G<br>
+
B - 9000 GENT<br>  
+
 
+
Routemap: http://www.pwc.be/en/map/index.jhtml<br>
+
 
+
Parking facilities at the ''Ghent South station''.<br>
+
  
 
=== PROGRAM ===
 
=== PROGRAM ===
 
 
The agenda:
 
The agenda:
*18h00 - 18h30: ''Welcome''<br>  
+
*17h30 - 18h15: '''Welcome &amp; sandwiches'''<br>
*18h30 - 19h30: '''Introducing the Smartphone Penetration Testing Framework''' (by Georgia Weidman, Bulb Security LLC)<br>  
+
*18h15 - 18h30: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP Belgium Board)<br>  
:As smartphones enter the workplace, sharing the network and accessing sensitive data, it is crucial to be able to assess the security posture of these devices in much the same way we perform penetration tests on workstations and servers. However, smartphones have unique attack vectors that are not currently covered by available industry tools. The smartphone penetration testing framework, the result of a DARPA Cyber Fast Track project, aims to provide an open source toolkit that addresses the many facets of assessing the security posture of these devices. We will look at the functionality of the framework including information gathering, exploitation, social engineering, and post exploitation through both a traditional IP network and through the mobile modem, showing how this framework can be leveraged by security teams and penetration testers to gain an understanding of the security posture of the smartphones in an organization. We will also show how to use the framework through a command line console, a graphical user interface, and a smartphone based app. Demonstrations of the framework assessing multiple smartphone platforms will be shown.<br>
+
*18h30 - 19h30: '''NoScript for Developers''' (by Giorgio Maone)<br>
:Georgia Weidman is a penetration tester, security researcher, and trainer. She holds a Master of Science degree in computer science, secure software engineering, and information security as well as holding CISSP, CEH, NIST 4011, and OSCP certifications. Her work in the field of smartphone exploitation has been featured in print and on television internationally. She has presented her research at conferences around the world including Shmoocon, Hacker Halted, Security Zone, and Bsides. Georgia has delivered highly technical security training for conferences, schools, and corporate clients to excellent reviews. Building on her experience, Georgia recently founded Bulb Security LLC a security consulting firm specializing in security assessments/penetration testing, security training, and research/development. She was awarded a DARPA Cyber Fast Track grant to continue her work in mobile device security.<br>
+
:Everything security-conscious web developers should know to make their creations safer and more accessible  for [http://noscript.net NoScript] users, plus an overview of current and upcoming technologies inspired by NoScript which can be leveraged server-side to enhance web applications' security.
*19h30 - 19h45: ''Break''<br>
+
:[http://maone.net Giorgio Maone] is a software developer and security researcher born and living in Palermo, Italy. He's member of the Mozilla Security Group and invited expert in the W3C's Web Application Security Working Group. In 2005 he created the NoScript browser security add-on, which still today absorbs most of the time and energy left by his main job: parenting 3 little children.
*19h45 - 20h45: '''Why your security products suck...''' (by Joe McCray, StrategicSec)<br>
+
*19h30 - 19h45: '''Break'''<br>  
:Joe McCray will be demonstrating a series of advanced hacking techniques focused on the areas of IDS/IPS/Web Application Firewall Bypass, SRP bypass and several other ways to defeat popular security mechanisms.<br>
+
*19h45 - 20h45: '''JSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks''' (by Mario Heiderich)<br>
:Bring your laptop, and hack with him. Joe will bring a wireless access point and allow the attendees to play with the security products as well.<br>
+
:There is a way to build common, classic web applications. You know, servers, databases, some HTML and a bit of JavaScript. Ye olde way. Grandfather still knows. And there is a way to build hip and fancy, modern and light-weight, elastic and scalable client-side web applications. Sometimes with a server in the background, sometimes with a database - but all the hard work is done by something new: JavaScript Model-View-Controller and templating frameworks.
:Let's hack!!!!<br>
+
:Angular, Ember and CanJS, Knockout, Handlebars and Underscore... those aren't names of famous wrestlers but modern JavaScript fame-works that offer a boost in performance and productivity by taking care of many things web-app right there in the browser, where the magic happens. And more and more people jump on the bandwagon and implement those frameworks with great success. High time for a stern look from the security perspective, ain't it not?
*20h45 - 21h30: ''Closing Drink''<br>
+
:This talk will show you how those frameworks work, how secure their core is and what kind of security issues spawn from the generous feature cornucopia they offer. Do their authors really know the DOM well enough to enrich it with dozens of abstraction layers? Or did they open a gate straight to JavaScript hell introducing a wide range of new injection bugs and coding worst-practices? Well, you'll know after this talk. You'll know...
 +
:[http://heideri.ch Mario Heiderich] is founder of the German/UK pen-test outfit Cure53 and a Microsoft security contractor. He focuses on HTML5, SVG security, script-less attacks and believes XSS can be eradicated by using JavaScript. Maybe. Some day. Actually quite soon. Mario invoked the HTML5 security cheat-sheet, the Alexa Top 1x search engine Crawly and several other projects. In the remaining time he delivers trainings and security consultancy for larger German and international companies for sweet sweet money and the simple minded fun in breaking things. Mario has spoken on a large variety of international conferences - both academic and industry-focused, co-authored two books, several academic papers and doesn't see a problem in his one year old son having a tablet already. There you have it.
  
=== REGISTRATION  ===
+
<!-- === Coverage ===
  
Please register via [https://owasp-belgium-2012-09-26.eventbrite.com/ https://owasp-belgium-2012-09-26.eventbrite.com]
 
 
<!--
 
=== PRESENTATIONS  ===
 
 
The slides are available online!<br>
 
*'''Introducing the Smartphone Penetration Testing Framework''' (by Georgia Weidman, Bulb Security LLC) -  ([https://www.owasp.org/images/0/0b/OWASPBE_20120926_IntroducingTheSmartphonePenetrationTestingFramework.pptx ppt])<br>
 
 
*'''Why your security products suck...''' (by Joe McCray, StrategicSec) ([https://www.owasp.org/images/d/d1/OWASPBE_20120912_WhyYourSecurityProductsSuck.pptx ppt])
 
 
-->
 
-->
  
 +
=== REGISTRATION  ===
 +
Please register [https://owasp-belgium-2013-10-08.eventbrite.com/ on EventBrite]
  
== Previous Meeting (12th of September 2012) in Leuven ==
+
== Previous Meeting (6th of June 2013) in Leuven ==
  
 
=== WHEN ===
 
=== WHEN ===
 
+
6th of June 2013 (18h00 - 21h00)
12th of September 2012 (18h00 - 21h00)
+
  
 
=== WHERE  ===
 
=== WHERE  ===
 +
This chapter meeting is part of the [[EUTour2013| OWASP Europe Tour 2013]]
  
Hosted by [http://distrinet.cs.kuleuven.be Distrinet Research Group (K.U.Leuven)].
+
<BR/>
 +
Hosted by [https://distrinet.cs.kuleuven.be iMinds-Distrinet Research Group (KU Leuven)].
  
Co-organized with the [http://www.cosic.esat.kuleuven.be/spion/ IWT-project SPION (security and privacy in online social networks)]
+
Address: <br>
 +
Department of Computer Science (foyer at ground floor)<br> Celestijnenlaan 200 A<br> 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap google maps])
  
Address: <br> Department of Computer Science (auditorium 00.225)<br> Celestijnenlaan 200 A<br> 3001 Heverlee <br>
+
Routemap: https://distrinet.cs.kuleuven.be/about/route/
 
+
Routemap: http://distrinet.cs.kuleuven.be/about/route/
+
  
 
=== PROGRAM ===
 
=== PROGRAM ===
 +
The agenda:
 +
*17h30 - 18h15: '''Welcome &amp; sandwiches'''<br>
 +
*18h15 - 18h30: '''[https://www.owasp.org/images/5/5a/Owasp_Belgium_update_2013-06-06_v2.pptx OWASP Update]''' (by Sebastien Deleersnyder, OWASP Belgium Board)<br>
 +
*18h30 - 19h30: '''[https://www.owasp.org/images/2/23/OWASP_EU_-_Tour_2103-abridged-Ned.pdf Needles in haystacks, we we are not solving the appsec problem & html hacking the browser, CSP is dead.]''' (by Eoin Keary, CTO and founder of BCC Risk Advisory Ltd.)<br>
 +
:TBD
 +
*19h30 - 20h30: '''[https://www.owasp.org/images/c/cc/Securing_Development_with_PMD_-_Teaching_an_Old_Dog_New_Tricks_-_OWASP.pdf Teaching an Old Dog New Tricks: Securing Development with PMD]''' (by Justin Clarke, Director and Co-Founder of Gotham Digital Science)<br>
 +
:Using static analysis to identify software bugs is not a new paradigm. For years, developers have used static analysis tools to identifying code quality issues. While these tools may not be specifically designed for identifying security bugs. This presentation will discuss how custom security rules can be added to existing code quality tools to identify potential software security bugs. Writing custom software security rules for the popular Java code scanning tool PMD will be the focus of the presentation.
 +
:Justin Clarke is a Director and Co-Founder of Gotham Digital Science. He is the lead author/technical editor of "SQL Injection Attacks and Defense" (Syngress), co-author of "Network Security Tools" (O'Reilly), contributor to "Network Security Assessment, 2nd Edition" (O'Reilly), as well as a speaker at numerous security conferences and events such as Black Hat, EuSecWest, ISACA, BruCON, OWASP AppSec, OSCON, RSA and SANS. Justin is the Chapter Leader for the OWASP London chapter in the United Kingdom.
 +
*20h30 - 21h30: '''[https://www.owasp.org/images/d/d1/Owasp_be_Vulnerability_Prediction_in_Android_Apps.pdf Vulnerability Prediction in Android Applications]''' (by Aram Hovsepyan, Ph. D.)<br>
 +
:We present an approach to predict which components of a software system contain security vulnerabilities. Prediction models are a key instrument to identify the weak spots that deserve special scrutiny. Our approach is based on text mining the source code of an application. We have explored the potential of the bag-of-words representation and discovered that a dependable prediction model can be built by means of machine learning techniques. In a validation with 10 Android applications we have obtained performance results that often outclass state-of-the-art approaches.
  
Pre-program:
+
=== Coverage ===
 
+
xme has blogged about the meeting on his [http://blog.rootshell.be/2013/06/06/june-2013-owasp-belgium-chapter-meeting-wrap-up/ /dev/random blog]
* 14h00 - 18h00: '''[http://people.cs.kuleuven.be/~frank.piessens/TechnicalWorkshop.html First SPION Technical Workshop]'''<br>
+
:Attendees of the OWASP Chapter are kindly invited to join the SPION technical workshop, collocated with the chapter meeting. Participation is free, but registration is mandatory.
+
:The program of this workshop on security and privacy in online social networks can be found at http://people.cs.kuleuven.be/~frank.piessens/TechnicalWorkshop.html<br>
+
 
+
The agenda:
+
* 18h00 - 19h00: '''Pizza buffet''' with '''SPION demos''' on the side<br>
+
*19h00 - 19h15: '''OWASP Update''' (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)<br>
+
*19h15 - 20h00: '''You Are What You Include: Remote JavaScript Inclusions''' (by Steven Van Acker, DistriNet, KU Leuven)<br>
+
:JavaScript is used by web developers to enhance the interactivity of their sites, offload work to the users' browsers and improve their sites' responsiveness and user-friendliness, making web pages feel and behave like traditional desktop applications. An important feature of JavaScript, is the ability to combine multiple libraries from local and remote sources into the same page, under the same namespace. While this enables the creation of more advanced web applications, it also allows for a malicious JavaScript provider to steal data from other scripts and from the page itself. Today, when developers include remote JavaScript libraries, they trust that the remote providers will not abuse the power bestowed upon them.
+
:In this talk, we report on a large-scale crawl of more than three million pages of the top 10,000 Alexa sites, and identify the trust relationships of these sites with their library providers. We also identify four, previously unknown, types of vulnerabilities that attackers could use to attack popular web sites. Lastly, we review some proposed ways of protecting a web application from malicious remote scripts and show that some of them may not be as effective as previously thought.
+
:'''Steven Van Acker''' is PhD student at DistriNet (KU Leuven). As web application security researcher, he studies among others secure containment solutions for untrusted JavaScript, and conducts large scale security assessments across the Internet. He also actively creates and maintains wargames at OverTheWire.org and HackitoErgoSum.org CTFs.
+
*20h00 - 20h15: Break<br>
+
*20h15 - 21h00: '''Modern Information Gathering''' (by Dave van Stein, KZA bv)<br>
+
:Nowadays sharing information is becoming normal and hackers use this to their advantage. This talk will try to provide insight in the amount of information that anonymous attackers can retrieve about your systems (and users) by showing some of the possibilities of tools freely available.<br>
+
:'''Dave van Stein''' is a security consultant at KZA bv. He has more than 11 years of experience in software and acceptance testing and started specializing in Web Application Security in the beginning of 2008. Over the years Dave has gained experience with many open source and commercial testing tools. Dave is active in the Dutch OWASP chapter and he is both ISEB/ISTQB-certified and EC-Council 'Certified Ethical Hacker'.<br>
+
  
 
=== REGISTRATION  ===
 
=== REGISTRATION  ===
 +
Please register via CLOSED
  
Please register via http://owasp-belgium-2012-09-12.eventbrite.com/
+
== Previous Meeting (5th of March 2013) in Leuven ==
 
+
=== PRESENTATIONS  ===
+
 
+
The slides are available online!<br>
+
*'''Owasp update''' (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board) ([https://www.owasp.org/images/9/93/Owasp_Belgium_update_2012-09-12.pptx ppt])<br>
+
 
+
*'''You Are What You Include: Remote JavaScript Inclusions''' (by Steven Van Acker, DistriNet, KU Leuven) ([https://www.owasp.org/images/0/0b/OWASPBE_20120912_YouAreWhatYouInclude.pptx ppt])<br>
+
 
+
*'''Modern Information Gathering''' (by Dave van Stein, KZA bv) ([https://www.owasp.org/images/0/0e/OWASP-Modern_Information_Gathering.pdf pdf])<br>
+
 
+
=== COVERAGE ===
+
 
+
Follow what they say about us...<br>
+
* [http://blog.rootshell.be/2012/09/12/owasp-belgium-chapter-september-2012-wrap-up/ /dev/random blog]<br>
+
* [http://erikvanderhasselt.blogspot.be/2012/09/remote-javascript-inclusion_13.html Erik Vanderhasselt's blog]<br>
+
 
+
== Previous Meeting (6th of March 2012) in Leuven ==
+
  
 
=== WHEN ===
 
=== WHEN ===
 +
5th of March 2013 (18h00 - 21h00)
  
6th of March 2012 18h-21h00
+
=== WHERE  ===
 +
This chapter meeting is co-organized with '''[http://www.secappdev.org SecAppDev]'''.
  
=== WHERE  ===
+
Both speakers are faculty of the [http://www.secappdev.org Secure Application Development course] which is held in Leuven from 4 March 2013 until 8 March 2013. OWASP Members get a 10% discount to attend the course.
  
 +
<BR/>
 
Hosted by [http://distrinet.cs.kuleuven.be Distrinet Research Group (K.U.Leuven)].
 
Hosted by [http://distrinet.cs.kuleuven.be Distrinet Research Group (K.U.Leuven)].
  
Co-organized with [http://www.secappdev.org SecAppDev 2012]
+
Address: '''UPDATED!'''<br>
 
+
'''Welcome & Sandwiches:''' <br>Department of Computer Science (foyer at ground floor)<br> Celestijnenlaan 200 A<br> 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap google maps])<br>
Address: <br> Department of Computer Science (auditorium 00.225)<br> Celestijnenlaan 200 A<br> 3001 Heverlee <br>  
+
'''Talks:''' <br>Celestijnenlaan 200L, Auditorium L.00.06<br> 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.86327251977556,%204.679660797119141)&zoomlevel=17&plaatsnaam=200L.00.06&maptype=roadmap google maps])<br>
  
 
Routemap: http://distrinet.cs.kuleuven.be/about/route/
 
Routemap: http://distrinet.cs.kuleuven.be/about/route/
  
 
=== PROGRAM ===
 
=== PROGRAM ===
 +
The agenda:
 +
*18h00 - 18h30: '''Welcome &amp; sandwiches'''<br>
 +
*18h30 - 18h45: '''OWASP Update''' (by Lieven Desmet, OWASP Belgium Board)<br>
 +
*18h45 - 19h45: '''25 Years of Vulnerabilities''' (by Yves Younan, Senior Research Engineer at Sourcefire)<br>
 +
:This talk will take a look into the interesting world of vulnerability statistics. We have examined data for the last 25 years and used it to map out trends and general information on vulnerabilities in software. Some of the questions we look at are "What were the most popular vulnerabilities? Which had the most impact? Which vendors and products suffered from the most issues? Etc. While some of the statistics are predictable, others are surprising. This data was first introduced at RSA Conference San Francisco 2013.
 +
:'''Dr. Yves Younan''' is a Senior Research Engineer in the Vulnerability Research Team (VRT) at Sourcefire where he works on vulnerabilities and mitigations. Prior to joining Sourcefire, he worked as a Security Researcher with BlackBerry Security at Research In Motion. Before joining RIM, he was an academic, founding the Native Code Security group within the DistriNet research group at the KU Leuven in Belgium.  He received a Master's degree in Computer Science from the Vrije Universiteit Brussel (VUB) and a PhD in Engineering: Computer Science from KU Leuven. His PhD focused on building efficient mitigations against vulnerability exploitation, several practical mitigations were published and presented at international conferences.
 +
*19h45 - 20h00: Break<br>
 +
*20h00 - 21h00: '''Banking Security: Attacks and Defences''' (by Steven Murdoch, Senior Researcher at University of Cambridge)<br>
 +
:Designers of banking security systems are faced with a difficult challenge of developing technology within a tightly constrained budget, yet which must be capable of defeating attacks by determined, well-equipped criminals. This talk will summarise banking security technologies for protecting Chip and PIN/EMV card payments, online shopping, and online banking. The effectiveness of the security measures will be discussed, along with vulnerabilities discovered in them both by academics and by criminals. These vulnerabilities include cryptographic flaws, failures of tamper resistance, and poor implementation decisions, and have led not only to significant financial losses, but in some cases unfair allocation of liability. Proposed improvements will also be described, not only to the technical failures but also to the legal and regulatory regimes which are the underlying reason for some of these problems not being properly addressed.
 +
:'''Dr. Steven J. Murdoch''' is a Royal Society University Research Fellow in the Security Group of the University of Cambridge Computer Laboratory, working on developing metrics for security and privacy. His research interests include covert channels, banking security, anonymous communications, and censorship resistance. Following his PhD studies on anonymous communications, he worked with the OpenNet Initiative, investigating Internet censorship. He then worked for the Tor Project, on improving the security and usability of the Tor anonymity system. Currently he is supported by the Royal Society on developing methods to understand complex system security. He is also working on analyzing the security of banking systems especially Chip & PIN/EMV, and is Chief Security Architect of Cronto, an online authentication technology provider.
  
The agenda:
+
=== PRESENTATIONS ===
 
+
The slides are available online!
*18h00 - 18h45: Welcome &amp; Pizzas<br>
+
* '''OWASP Update''' (by Lieven Desmet) ([https://www.owasp.org/images/9/91/Owasp_Belgium_update_2013-03-05.pdf PDF])
*18h45 - 19h00: '''OWASP Update ([https://www.owasp.org/images/c/c9/Owasp_Belgium_update_2012-03-06.pptx PPT])''' (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)<br>
+
* '''25 Years of Vulnerabilities''' (by Yves Younan, Sourcefire) ([https://www.owasp.org/images/c/cc/OWASP_Belgium_Yves_Younan_2013.pdf PDF])
*19h00 - 20h00: '''Common iOS Pitfalls vs. OWASP's iGoat ([https://www.owasp.org/images/c/c3/Appsecusa2011-bechapterbyKen-owasptop10mobilerisks.pptx PPT])''' (by Ken van Wyk, KRvW Associates)<br>
+
* '''Banking Security: Attacks and Defences''' (by Steven Murdoch, University of Cambridge) ([https://www.owasp.org/images/d/d5/Owasp13bankingsecurity.pdf PDF])
:In this session, Ken will spotlight and demonstrate several security "gotchas" in Apple's iOS platform (iPhone and iPad). He'll then introduce the OWASP iGoat tool and demonstrate how it can be used (and extended) to help train iOS coders. Like the other OWASP *Goat tools, iGoat is a great learning platform that can help iOS developers internalize the big issues they face in building bulletproof apps. Ken is the project leader for iGoat, and we're always looking for contributors.
+
:'''KenKenneth R. van Wyk''' is an internationally recognized information security expert and author of the O’Reilly and Associates books, Incident Response and Secure Coding. Ken provides consulting and training services through his company, KRvW Associates, LLC (http://www.KRvW.com). Ken has 22 years experience as an IT Security practitioner in the academic, military, and commercial sectors. He has held senior and executive technologist positions at Tekmark, Para-Protect, Science Applications International Corporation (SAIC), the U.S. Department of Defense, Carnegie Mellon University, and Lehigh University. 
+
*20h00 - 20h15: Break<br>
+
*20h15 - 21h15: '''Access Control Design Best Practices ([https://www.owasp.org/images/8/84/Be_chapter_presentation_by_jim_manico_Access_Control_Pitfalls_v1.1.pptx PPT])''' (by Jim Manico, WhiteHat Security)<br>
+
:Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.
+
:'''Jim Manico''' is the VP of Security Architecture for WhiteHat Security, a web security firm.  Jim is a participant and project manager of the OWASP Developer Cheatsheet series. He is also the producer and host of the OWASP Podcast Series.
+
 
+
=== REGISTRATION  ===
+
 
+
Please register via http://owasp-belgium-2012-03-06.eventbrite.com/
+
 
+
== Previous Meeting (25th of January 2012) in Brussels ==
+
 
+
=== WHEN ===
+
 
+
25th of January 2012 18h-21h00
+
 
+
=== WHERE  ===
+
 
+
Location is sponsored by [http://www.cisco.com/web/BE/index.html Cisco Belgium].
+
 
+
Location: Cisco, Pegasus Park, De Kleetlaan, 6A, B-1831 Diegem. See [http://www.cisco.com/web/BE/pdfs/contact_plan.pdf directions].
+
 
+
=== PROGRAM ===
+
 
+
The agenda:
+
 
+
*18h00 - 18h30: Welcome &amp; Sandwiches<br>
+
*18h30 - 18h45: '''OWASP Update ([https://www.owasp.org/images/1/1f/Owasp_Belgium_update_2012-01-25.pptx ppt])''' (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)<br>
+
*18h45 - 19h45: '''devops, secops, devsec or *ops ? A gentle introduction to Devops([https://www.owasp.org/images/0/0f/Owasp_belgium_chapter_2012-01-25_devops-secops-kris-buytaert.pdf pdf])''' (by Kris Buytaert, Inuits)<br>
+
:This talk will summarize the different ideas behind devops, and will show that this goes beyond tooling and becomes a way of thinking, where ultimately everybody  will stand together to support the business.
+
:Some call this phenomenon devops, others hate the word and want to call it *ops or ops* ,  truth is that agile techniques used in development have an impact on the way operations organizes it work.  Similar, operations and sysadmins are becoming programmers because of the virtualization and automation trend where everything is managed through an API.    And security is imvolved everywhere.
+
:'''[http://www.krisbuytaert.be/bio.shtml Kris Buytaert]'''  is a long time Linux and Open Source Consultant. He's one of instigators of the devops movement, currently working for Inuits. Kris is the Co-Author of [http://www.amazon.co.uk/Virtualization-Xen-Including-Xenenterprise-Xenexpress/dp/1597491675/ref=pd_bbs_sr_1/002-0083558-4788061?ie=UTF8&s=books&qid=1179251994&sr=8-1 Virtualization with Xen], used to be the maintainer of the [http://howto.krisbuytaert.be/ openMosix HOWTO] and author of [http://www.krisbuytaert.be/ different technical publications]. He is frequently speaking at, or organizing different international conferences. He spends most of his time working on Linux Clustering (both High Availability, Scalability and HPC), Virtualisation and Large Infrastructure Management projects hence trying to build infrastructures that can survive the 10th floor test, better known today as the cloud while actively promoting the devops idea ! His blog titled "Everything is a Freaking DNS Problem" can be found at [http://www.krisbuytaert.be/blog/ http://www.krisbuytaert.be/blog/]
+
*19h45 - 20h00: Break<br>
+
*20h00 - 21h00: '''Hardening web applications against malware attacks ([https://www.owasp.org/images/6/62/OWASP_Presentation_January2012_Erwin_Geirnaert.ppt ppt])''' (by Erwin Geirnaert, Zion Security)<br>
+
:During this presentation we give an overview of how we can harden web applications against different types of attacks used by malware to bypass the existing security controls in the web application. We discuss the OWASP Top 10 and how malware can abuse these attacks and how the developer must implement a different strategy. We explain why (mobile) browser security is an important aspect of web application hardening and most importantly that the battle against malware is an ongoing battle. For every countermeasure the security industry develops to protect web applications and is used by a lot of companies today we will show how malware is being developed to bypass these solutions. To finalize we give some advice on how to protect against these malware attacks, using pro-active and detective controls.
+
:'''Erwin Geirnaert''' founded [http://www.zionsecurity.com/ ZION SECURITY] in 2005 to help companies to protect against the latest threats, attacks against web applications. ZION SECURITY is nowadays a Belgian market leader in the field of security testing, vulnerability management, penetration testing and banking security. Erwin has more than 10 years of experience in web security, graduating with a Master of Science in Software Development from the University of Ghent. Erwin executes different types of projects for a lot of international software companies, financial institutions, telecom and web agencies. Specialist in executing code reviews in different development languages for critical applications, executing continuous penetration tests of their infrastructure and Internet applications. A specialist in J2EE security, .NET security and web services security. Erwin architects secure e-business projects for web agencies and software companies. He is a recognized application security expert and speaker at international events like Javapolis, OWASP, Eurostar,
+
  
 +
=== COVERAGE ===
 +
Follow what they say about us...
 +
* [http://blog.rootshell.be/2013/03/05/owasp-belgium-chapter-wrap-up-march-2013/ /dev/random blog]
  
 
== Past Events  ==
 
== Past Events  ==
 +
*Events held in [[Belgium Previous Events 2012|2012]]
 
*Events held in [[Belgium Previous Events 2011|2011]]  
 
*Events held in [[Belgium Previous Events 2011|2011]]  
 
*Events held in [[Belgium Previous Events 2010|2010]]  
 
*Events held in [[Belgium Previous Events 2010|2010]]  
Line 210: Line 158:
 
*André Mariën, Inno.com  
 
*André Mariën, Inno.com  
 
*Lieven Desmet, K.U.Leuven  
 
*Lieven Desmet, K.U.Leuven  
*Sebastien Deleersnyder, SAIT Zenitel
+
*Sebastien Deleersnyder, freelance
 
*Bart De Win, Ascure
 
*Bart De Win, Ascure
 
*David Mathy, Focus ICT
 
*David Mathy, Focus ICT

Revision as of 14:56, 5 September 2013

OWASP Belgium

Welcome to the Belgium chapter homepage. The chapter leader is Sebastien Deleersnyder
Click here to join the local chapter mailing list.

Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is and open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Sponsorship/Membership

Btn donate SM.gif to this chapter or become a local chapter supporter.

Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? Join Now BlueIcon.JPG

[edit]

Stay updated

"BeNeLux Days 2012" is online: https://www.owasp.org/index.php/BeNeLux_OWASP_Day_2012.


If you want to be invited for the next OWASP Belgium Chapter meetings, please drop us your contact info.

You can also follow us on Twitter!

Structural Sponsors 2012/2013

OWASP Member affiliated to the Belgium chapter:

PWC_log_resized.png       

OWASP Belgium thanks its structural chapter supporters for 2012 and the OWASP BeNeLux Days 2012:

200px-Iminds-logo.png Zionsecurity.jpg On2it-sponsor.png

If you want to support our chapter, please contact Seba Deleersnyder

Next Meeting (8th of October 2013) in Diegem

WHEN

8th of October 2013 (18h00 - 21h00)

WHERE

Hosted by Ernst & Young.

Address:
Ernst & Young
De Kleetlaan 2
B1831 Diegem
Location: Google Maps.

PROGRAM

The agenda:

  • 17h30 - 18h15: Welcome & sandwiches
  • 18h15 - 18h30: OWASP Update (by Sebastien Deleersnyder, OWASP Belgium Board)
  • 18h30 - 19h30: NoScript for Developers (by Giorgio Maone)
Everything security-conscious web developers should know to make their creations safer and more accessible for NoScript users, plus an overview of current and upcoming technologies inspired by NoScript which can be leveraged server-side to enhance web applications' security.
Giorgio Maone is a software developer and security researcher born and living in Palermo, Italy. He's member of the Mozilla Security Group and invited expert in the W3C's Web Application Security Working Group. In 2005 he created the NoScript browser security add-on, which still today absorbs most of the time and energy left by his main job: parenting 3 little children.
  • 19h30 - 19h45: Break
  • 19h45 - 20h45: JSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks (by Mario Heiderich)
There is a way to build common, classic web applications. You know, servers, databases, some HTML and a bit of JavaScript. Ye olde way. Grandfather still knows. And there is a way to build hip and fancy, modern and light-weight, elastic and scalable client-side web applications. Sometimes with a server in the background, sometimes with a database - but all the hard work is done by something new: JavaScript Model-View-Controller and templating frameworks.
Angular, Ember and CanJS, Knockout, Handlebars and Underscore... those aren't names of famous wrestlers but modern JavaScript fame-works that offer a boost in performance and productivity by taking care of many things web-app right there in the browser, where the magic happens. And more and more people jump on the bandwagon and implement those frameworks with great success. High time for a stern look from the security perspective, ain't it not?
This talk will show you how those frameworks work, how secure their core is and what kind of security issues spawn from the generous feature cornucopia they offer. Do their authors really know the DOM well enough to enrich it with dozens of abstraction layers? Or did they open a gate straight to JavaScript hell introducing a wide range of new injection bugs and coding worst-practices? Well, you'll know after this talk. You'll know...
Mario Heiderich is founder of the German/UK pen-test outfit Cure53 and a Microsoft security contractor. He focuses on HTML5, SVG security, script-less attacks and believes XSS can be eradicated by using JavaScript. Maybe. Some day. Actually quite soon. Mario invoked the HTML5 security cheat-sheet, the Alexa Top 1x search engine Crawly and several other projects. In the remaining time he delivers trainings and security consultancy for larger German and international companies for sweet sweet money and the simple minded fun in breaking things. Mario has spoken on a large variety of international conferences - both academic and industry-focused, co-authored two books, several academic papers and doesn't see a problem in his one year old son having a tablet already. There you have it.


REGISTRATION

Please register on EventBrite

Previous Meeting (6th of June 2013) in Leuven

WHEN

6th of June 2013 (18h00 - 21h00)

WHERE

This chapter meeting is part of the OWASP Europe Tour 2013


Hosted by iMinds-Distrinet Research Group (KU Leuven).

Address:
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee (google maps)

Routemap: https://distrinet.cs.kuleuven.be/about/route/

PROGRAM

The agenda:

TBD
Using static analysis to identify software bugs is not a new paradigm. For years, developers have used static analysis tools to identifying code quality issues. While these tools may not be specifically designed for identifying security bugs. This presentation will discuss how custom security rules can be added to existing code quality tools to identify potential software security bugs. Writing custom software security rules for the popular Java code scanning tool PMD will be the focus of the presentation.
Justin Clarke is a Director and Co-Founder of Gotham Digital Science. He is the lead author/technical editor of "SQL Injection Attacks and Defense" (Syngress), co-author of "Network Security Tools" (O'Reilly), contributor to "Network Security Assessment, 2nd Edition" (O'Reilly), as well as a speaker at numerous security conferences and events such as Black Hat, EuSecWest, ISACA, BruCON, OWASP AppSec, OSCON, RSA and SANS. Justin is the Chapter Leader for the OWASP London chapter in the United Kingdom.
We present an approach to predict which components of a software system contain security vulnerabilities. Prediction models are a key instrument to identify the weak spots that deserve special scrutiny. Our approach is based on text mining the source code of an application. We have explored the potential of the bag-of-words representation and discovered that a dependable prediction model can be built by means of machine learning techniques. In a validation with 10 Android applications we have obtained performance results that often outclass state-of-the-art approaches.

Coverage

xme has blogged about the meeting on his /dev/random blog

REGISTRATION

Please register via CLOSED

Previous Meeting (5th of March 2013) in Leuven

WHEN

5th of March 2013 (18h00 - 21h00)

WHERE

This chapter meeting is co-organized with SecAppDev.

Both speakers are faculty of the Secure Application Development course which is held in Leuven from 4 March 2013 until 8 March 2013. OWASP Members get a 10% discount to attend the course.


Hosted by Distrinet Research Group (K.U.Leuven).

Address: UPDATED!
Welcome & Sandwiches:
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee (google maps)
Talks:
Celestijnenlaan 200L, Auditorium L.00.06
3001 Heverlee (google maps)

Routemap: http://distrinet.cs.kuleuven.be/about/route/

PROGRAM

The agenda:

  • 18h00 - 18h30: Welcome & sandwiches
  • 18h30 - 18h45: OWASP Update (by Lieven Desmet, OWASP Belgium Board)
  • 18h45 - 19h45: 25 Years of Vulnerabilities (by Yves Younan, Senior Research Engineer at Sourcefire)
This talk will take a look into the interesting world of vulnerability statistics. We have examined data for the last 25 years and used it to map out trends and general information on vulnerabilities in software. Some of the questions we look at are "What were the most popular vulnerabilities? Which had the most impact? Which vendors and products suffered from the most issues? Etc. While some of the statistics are predictable, others are surprising. This data was first introduced at RSA Conference San Francisco 2013.
Dr. Yves Younan is a Senior Research Engineer in the Vulnerability Research Team (VRT) at Sourcefire where he works on vulnerabilities and mitigations. Prior to joining Sourcefire, he worked as a Security Researcher with BlackBerry Security at Research In Motion. Before joining RIM, he was an academic, founding the Native Code Security group within the DistriNet research group at the KU Leuven in Belgium. He received a Master's degree in Computer Science from the Vrije Universiteit Brussel (VUB) and a PhD in Engineering: Computer Science from KU Leuven. His PhD focused on building efficient mitigations against vulnerability exploitation, several practical mitigations were published and presented at international conferences.
  • 19h45 - 20h00: Break
  • 20h00 - 21h00: Banking Security: Attacks and Defences (by Steven Murdoch, Senior Researcher at University of Cambridge)
Designers of banking security systems are faced with a difficult challenge of developing technology within a tightly constrained budget, yet which must be capable of defeating attacks by determined, well-equipped criminals. This talk will summarise banking security technologies for protecting Chip and PIN/EMV card payments, online shopping, and online banking. The effectiveness of the security measures will be discussed, along with vulnerabilities discovered in them both by academics and by criminals. These vulnerabilities include cryptographic flaws, failures of tamper resistance, and poor implementation decisions, and have led not only to significant financial losses, but in some cases unfair allocation of liability. Proposed improvements will also be described, not only to the technical failures but also to the legal and regulatory regimes which are the underlying reason for some of these problems not being properly addressed.
Dr. Steven J. Murdoch is a Royal Society University Research Fellow in the Security Group of the University of Cambridge Computer Laboratory, working on developing metrics for security and privacy. His research interests include covert channels, banking security, anonymous communications, and censorship resistance. Following his PhD studies on anonymous communications, he worked with the OpenNet Initiative, investigating Internet censorship. He then worked for the Tor Project, on improving the security and usability of the Tor anonymity system. Currently he is supported by the Royal Society on developing methods to understand complex system security. He is also working on analyzing the security of banking systems especially Chip & PIN/EMV, and is Chief Security Architect of Cronto, an online authentication technology provider.

PRESENTATIONS

The slides are available online!

  • OWASP Update (by Lieven Desmet) (PDF)
  • 25 Years of Vulnerabilities (by Yves Younan, Sourcefire) (PDF)
  • Banking Security: Attacks and Defences (by Steven Murdoch, University of Cambridge) (PDF)

COVERAGE

Follow what they say about us...

Past Events

  • Events held in 2012
  • Events held in 2011
  • Events held in 2010
  • Events held in 2009
  • Events held in 2008
  • Events held in 2007
  • Events held in 2006
  • Events held in 2005

The Belgium Chapter is supported by the following board:

  • Erwin Geirnaert, Zion Security
  • Philippe Bogaerts, F5
  • André Mariën, Inno.com
  • Lieven Desmet, K.U.Leuven
  • Sebastien Deleersnyder, freelance
  • Bart De Win, Ascure
  • David Mathy, Focus ICT
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.