Difference between revisions of "Belgium"

From OWASP
Jump to: navigation, search
(PRESENTATIONS)
(PROGRAM)
 
(89 intermediate revisions by 4 users not shown)
Line 3: Line 3:
 
= Local News  =
 
= Local News  =
  
== Stay updated  ==
+
== Upcoming chapter meeting: 24 February 2015 (Leuven) ==
  
"'''BeNeLux Days 2012'''" is online: https://www.owasp.org/index.php/BeNeLux_OWASP_Day_2012.
+
On '''Tuesday 24 February 2015''', we will have our next BE chapter meeting in Leuven.  
  
 +
See https://www.owasp.org/index.php/Belgium#Chapter_Meetings for more details.
  
If you want to be invited for the next OWASP Belgium Chapter meetings, please [http://eepurl.com/iFZtb drop us your contact info].
+
== Presentations of the 2014 chapter meetings are online  ==
 +
 
 +
The presentations of our 2014 chapter meetings can be downloaded from
 +
https://www.owasp.org/index.php/Belgium#tab=Chapter_Meetings
 +
 
 +
 
 +
 
 +
== Stay in touch ==
 +
 
 +
=== Twitter ===
  
 
You can also follow us on [https://twitter.com/owasp_be Twitter]!
 
You can also follow us on [https://twitter.com/owasp_be Twitter]!
  
== Structural Sponsors 2012/2013  ==
+
=== OWASP-BE contact list ===
 +
 
 +
If you want to be invited for the next OWASP Belgium Chapter meetings, please [http://eepurl.com/iFZtb drop us your contact info].
 +
 
 +
=== OWASP-BE discussion mailing list===
 +
If you want to join the local chapter mailing list, please [http://lists.owasp.org/mailman/listinfo/owasp-belgium click here].
 +
 
 +
== Structural Sponsors 2013/2014 ==
 
OWASP Member affiliated to the Belgium chapter:
 
OWASP Member affiliated to the Belgium chapter:
  
{{MemberLinks|link=http://www.pwc.com/|logo=PWC_log_resized.png}}
+
{{MemberLinks|link=http://www.pwc.com/|logo=PWC_log_resized.png}} [[File:TSF logo blackred transparent.png|250px|link=http://www.thesecurityfactory.be/]]
  
OWASP Belgium thanks its structural chapter supporters for 2012 and the OWASP BeNeLux Days 2012:
 
  
[http://www.iminds.be https://www.owasp.org/images/thumb/a/a1/Iminds-logo.png/200px-Iminds-logo.png]
+
OWASP Belgium thanks its structural chapter supporters for 2013/2014 and the OWASP BeNeLux Days 2013:  
 +
 
 
[http://www.zionsecurity.com https://www.owasp.org/images/e/e6/Zionsecurity.jpg]
 
[http://www.zionsecurity.com https://www.owasp.org/images/e/e6/Zionsecurity.jpg]
[http://on2it.net https://www.owasp.org/images/3/3d/On2it-sponsor.png]
+
[http://www.nviso.be https://www.owasp.org/images/5/5e/Nviso_logo_RGB_baseline_200px.png]
 +
[http://www.Checkmarx.com https://www.owasp.org/images/a/a2/Checkmarx.jpg]
  
 
If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]
 
If you want to support our chapter, please contact [mailto:seba@owasp.org Seba Deleersnyder]
  
 
= Chapter Meetings  =
 
= Chapter Meetings  =
 +
== Next Meeting (24 February 2015) in Leuven ==
  
 +
=== WHEN ===
 +
24 February 2015
  
 +
=== WHERE  ===
 +
Hosted by [https://distrinet.cs.kuleuven.be iMinds-Distrinet Research Group (KU Leuven)].
  
 +
Both speakers are faculty of the [http://www.secappdev.org/ Secure Application Development] course which is held in Leuven from 10 to 14 February 2014. OWASP Members get a 10% discount to attend the course.
  
== Next Meeting (5th of March 2013) in Leuven ==
+
Address: <br>
 +
Department of Computer Science (foyer at ground floor)<br> Celestijnenlaan 200 A<br> 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap google maps])
 +
 
 +
Routemap: https://distrinet.cs.kuleuven.be/about/route/
 +
 
 +
=== PROGRAM ===
 +
The agenda:
 +
*18h15 - 19h00: '''Welcome & sandwiches'''<br>
 +
*19h00 - 19h15: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP Belgium Board)<br>
 +
*19h15 - 20h15: '''[https://www.owasp.org/images/0/0c/2015-02-24-Jim_DelGrosso-OWASP_Belgium%2C_Why_Code_Reviews_and_Pen-Tests_Are_Not_Enough.pdf Why Code Reviews and Pen-Tests Are Not Enough]''' (by Jim DelGrosso, Cigital)<br>
 +
:''Abstract:'' Code reviews and penetration tests are excellent techniques for finding defects in software. But there is a whole class of defects that they are not good at finding - flaws. Jim will briefly talk about the differences between bugs and flaws, will describe a technique to help identify flaws, and talk about the work being done as part of the IEEE Center for Secure Design to help people avoid common flaws.
 +
:''Bio:'' '''Jim DelGrosso''' is a Principal Consultant at Cigital with over 30 years of experience working for software development and consulting organizations. At Cigital, Jim heads up the Architecture Analysis practice with the mission to analyze the architecture and design of systems to identify flaws and provide our customers contextual guidance to remediate or mitigate those flaws. Jim is also the Executive Director for the [http://cybersecurity.ieee.org/center-for-secure-design.html IEEE Computer Society Center for Secure Design initiative].
 +
*20h15 - 20h30: '''Break'''<br>
 +
*20h30 - 21h30: '''[https://www.owasp.org/images/9/98/2015_02_24-Aurelien-Francillon-Owasp_leuven.pdf An analysis of exploitation behaviors on the web and the role of web hosting providers in detecting them.]''' (by prof. Aurélien Francillon, EURECOM)<br>
 +
:''Abstract:'' Compromised websites are often used by attackers to deliver malicious content or to host phishing pages designed to steal private information from their victims. In a first part of the talk I will describe Eurecom's web honeypot, a set of deliberately vulnerable web applications that are regularly compromised by real attackers.  In a second part of the talk, I will describe tests we performed on the ability of specialized monitoring services and web hosting providers to detect compromised websites and how they react to user complaints.
 +
:''Bio:'' ''' Aurélien Francillon''' is an assistant professor in the Networking and Security department at EURECOM, where he is co-heading the System and Software Security group. Prior to that he obtained a PhD from INRIA  and Grenoble INP and then spent 2 years as a postdoctoral researcher in the System Security Group at ETH Zurich. He is mainly interested in practical aspects of the security of embedded devices.  In this context he has worked on topics such as code injection, code attestation, random number generation, hardware support for software security, bug finding techniques as well as on broader security and privacy topics. He served in many program committees and was program co-chair of CARDIS 2013.
 +
 
 +
=== REGISTRATION  ===
 +
Please register via EventBrite: http://owasp-belgium-2015-02-24.eventbrite.com
 +
 
 +
=== Coverage ===
 +
 
 +
== Previous Meeting (17 December 2014) in Mechelen ==
  
 
=== WHEN ===
 
=== WHEN ===
5th of March 2013 (18h00 - 21h00)
+
17 December 2014
  
 
=== WHERE  ===
 
=== WHERE  ===
This chapter meeting is co-organized with '''[http://www.secappdev.org SecAppDev]'''.
 
  
Both speakers are faculty of the [http://www.secappdev.org Secure Application Development course] which is held in Leuven from 4 March 2013 until 8 March 2013. OWASP Members get a 10% discount to attend the course.
+
Hosted at Moonbeat (Mechelen), kindly offered by [http://www.is4u.be/ is4u].
 +
 
 +
Venue address:<br>
 +
Moonbeat <br>
 +
Oude Brusselsestraat 10-12 <br>
 +
2800 mechelen <br>
 +
 
 +
 
 +
Route/Parking: http://www.moonbeat.be/index.php/j-stuff/web-links
 +
 
 +
=== PROGRAM ===
 +
The agenda:
 +
*18h00 - 18h45: '''Welcome & sandwiches'''<br>
 +
*18h45 - 19h00: '''OWASP Update''' (by Sebastien Deleersnyder, OWASP Belgium Board)<br>
 +
*19h00 - 20h00: '''OWASP Top 10 Mobile Risks / demos''' (by Erwin Geirnaert)<br>
 +
:''Abstract:'' During this presentation Erwin will discuss the OWASP Top 10 Mobile Risks for mobile apps. How easy it is to bypass security controls, retrieve confidential information, ….  And how to protect against these problems.
 +
:''Bio:'' '''Erwin Geirnaert''' is founder and Chief Hacking Officer at ZIONSECURITY, a company that aims to ensure its clients business value by securing (web/mobile) applications, either in the cloud or on-premise; and mainly focused on protecting home banking environments against fraud and attacks. Erwin is a recognized application security expert and speaker at international events like Javapolis, OWASP, Eurostar and Infosecurity. He is a specialist in J2EE security, .NET security and web services security and has more than 10 years of experience in executing security tests of web and thick client applications. Erwin also architects secure e-business projects for banks, web agencies and software companies.
 +
*20h00 - 20h15: '''Break'''<br>
 +
*20h15 - 20h30: '''[https://www.owasp.org/images/6/61/Investigating_software_security_practices-2014-12-17-OWASP-BE.pdf Investigating software security practices]''' (by Koen Yskout and Laurens Sion, iMinds-DistriNet)<br>
 +
:''Abstract:'' Security must be considered throughout the whole software development cycle, including early phases such as requirements elicitation and software design. While this is a widely accepted statement, it is not evident to achieve this in practice. Although some academic proposals along this line exist, they are not used in industry. As academics, before making any new proposals, we want to perform a survey in order to understand to what degree security and privacy are currently present in the requirements elicitation and architecture and design activities of organizations, how they are incorporated in practice, and what the benefits and limitations of the existing approaches are.
 +
:In this short talk, we will explore why such a study is needed, what our goal is, and why you should participate.
 +
*20h30 - 21h30: '''OpenSAMM Best Practices: Lessons from the Trenches''' (by Sebastien Deleersnyder and Bart De Win)<br>
 +
:''Abstract:'' Managing all application security activities as part of development and deployment of applications can be an overwhelming challenge. OWASP OpenSAMM gives you a structural and measurable blueprint to integrate OWASP best practices in your software life cycle. This OWASP framework allows you to formulate and implement a strategy for software security that is tailored to the risk profile of your organisation.
 +
:During this talk Bart and Sebastien will get you up to speed on the OpenSAMM framework and share their important challenges they faced in implementing the framework within various organisations. Important topics that will be covered during this presentation are:
 +
:*What is the optimal OpenSAMM maturity level for your organisation?
 +
:*At which level to implement OpenSAMM in the organisation: at company, business unit or development team level?
 +
:*How to integrate OpenSAMM activities in agile development?
 +
:*How to apply OpenSAMM on suppliers or outsourced development?
 +
:*What metrics does OpenSAMM provide to manage your secure development life cycle?
 +
:Practical lessons learned and use cases from the trenches that make OWASP OpenSAMM a valuable methodology and which you should apply for your secure development life cycle!
 +
:''Bio:'' '''Sebastien Deleersnyder''' is co-founder & managing partner application security at Toreon.com
 +
:As application security specialist for more than 10 years, Sebastien has helped various companies improve their ICT-, Web- and Mobile Security, including BNP Paribas Fortis, Atos Worldline, KBC, NationaleNederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post, Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, co-project leader of the OpenSAMM project, served on the OWASP Foundation Board member (2007-2013) and performed several presentations and trainings on Web Application, Mobile and Web Services Security. Furthermore Sebastien co-organizes the yearly BruCON conference in Ghent (Belgium).
 +
:''Bio:'' '''Bart De Win''' has over 15 years of experience in software security. He has an extensive background in the field, including his Ph.D. and research work on methods and techniques for software protection. Since 2009, Bart has been responsible for all application security services within Ascure & PwC Belgium. He has extensive project experience in software testing and in assisting companies improving their secure software development practices. Bart is member of the OWASP Belgium Chapter board and he is a co-leader of the OpenSAMM Software Assurance Model. Bart is SABSA, Prince 2 and CSSLP certified.
 +
 
 +
=== REGISTRATION  ===
 +
Please register via EventBrite: http://owasp-belgium-2014-12-17.eventbrite.com
 +
 
 +
=== Coverage ===
 +
 
 +
== Previous Meeting (20th of May 2014) in Brussels ==
 +
 
 +
=== WHEN ===
 +
20th of May 2014 (18h00 - 21h00)
 +
 
 +
=== WHERE  ===
 +
 
 +
Hosted by [https://www.nviso.be/ NVISO]
 +
 
 +
Address:<br>
 +
NVISO (ICAB)<br>
 +
Rue des Peres Blancs 4<br>
 +
1040 Etterbeek
 +
 
 +
=== PROGRAM ===
 +
The agenda:
 +
*18h00 - 18h45: '''Welcome & sandwiches'''<br>
 +
*18h45 - 19h00: '''OWASP Update''' (by Bart De Win, OWASP Belgium Board)<br>
 +
*19h00 - 20h00: '''[https://github.com/jsteven/psm/blob/master/presentations/Secure%20Password%20Storage%20AUS%20(w%20Notes).pptx.pdf Securing Password Storage – Increasing Resistance to Brute Force Attacks]''' (by Tiago Teles)<br>
 +
:''Abstract:'' In this talk Tiago Teles takes apart password protection scheme analyzing the attack resistance of hashes, hmacs, adaptive hashes (such as script), and encryption schemes. First, we present a threat model for password storage. Then audience members will learn the construction, performance, and protective properties of these primitives. Discussion of the primitives will be from a critical perspective modeled as an iterative secure design session.
 +
:Ultimately, this session presents the solution and code donated as part an on-going OWASP project – a OWASP PSM (password storage module). Discussion of this solution will include key techniques for hardening PSM learned through years of delivering production JavaEE code to customers…
 +
:''Bio:'' Tiago Teles is a Technical Consultant with 8 years of experience in clients across different sectors and countries, including banking, insurance, telecommunications and commercial organizations in a variety of roles: Delivering Training, Development, Business Intelligence and Quality Assurance. For some of the talks already delivered please see: [https://www.youtube.com/watch?v=CbeSXmAXBbU Video talks] for more information please visit: [http://nl.linkedin.com/in/tiagoteles Tiago Teles' LinkedIn profile].
 +
*20h00 - 20h15: '''Break'''<br>
 +
*20h15 - 21h15: '''[https://www.owasp.org/images/7/7b/A_history_of_ATM_violence_-_OWASP_Chapter_Night.pdf A history of ATM violence - From blowing up safes over jackpotting to all-round malware]''' (by Daan Raman and Erik Van Buggenhout)<br>
 +
:''Abstract:'' ATMs (Automated Teller Machines) are the main component of self-servicing banking functions used by millions of banking customers worldwide. To put things in perspective, 400,000 ATM devices were deployed in Europe alone as of 30 June 2013. Worldwide, the number of ATMs grew from 1.7 million to 2.5 million between 2007 and 2013.
 +
:This entertaining talk on attacks against Automated Teller Machines (ATMs) will focus on the history of ATM attacks and the current development of cross-vendor ATM malware. The talk will include a presentation of our from-scratch developed ATM malware that will be presented on a live ATM system (see http://youtu.be/MBOD59r3lTM).
 +
:''Bio:'' Daan Raman and Erik Van Buggenhout are security consultants at NVISO, where they focus on information security topics in the financial services industry.
 +
 
 +
=== REGISTRATION  ===
 +
Please register via EventBrite: CLOSED
 +
 
 +
=== Coverage ===
 +
 
 +
Covered by Xavier Mertens: http://blog.rootshell.be/2014/05/22/may-2014-owasp-belgium-chapter-meeting-wrap-up/
 +
 
 +
== Previous Meeting (12th of February 2014) in Leuven ==
 +
 
 +
=== WHEN ===
 +
12th of February 2014 (18h00 - 21h00)
 +
 
 +
=== WHERE  ===
 +
Jointly organized with [http://www.secappdev.org/ SecAppDev].
 +
Hosted by [https://distrinet.cs.kuleuven.be iMinds-Distrinet Research Group (KU Leuven)].
 +
 
 +
Both speakers are faculty of the [http://www.secappdev.org/ Secure Application Development] course which is held in Leuven from 10 to 14 February 2014. OWASP Members get a 10% discount to attend the course.
 +
 
 +
Address: <br>
 +
Department of Computer Science (foyer at ground floor)<br> Celestijnenlaan 200 A<br> 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap google maps])
 +
 
 +
Routemap: https://distrinet.cs.kuleuven.be/about/route/
 +
 
 +
=== Last minute update: ===
 +
 
 +
 
 +
I would like to notify you that due to traffic work you most probably will have to make a detour to get to the university campus.
  
<BR/>
+
Because of a road block at the Celestijnenlaan, this street has become one way. This forces participants coming from the E40/Koning Boudewijnlaan to reach the campus via the ring (R23)/Naamsesteenweg/Kardinaal Mercierlaan.
Hosted by [http://distrinet.cs.kuleuven.be Distrinet Research Group (K.U.Leuven)].
+
  
Address: '''UPDATED!'''<br>
+
A map of the detour can be found here: http://goo.gl/maps/kZqEQ
'''Welcome & Sandwiches:''' <br>Department of Computer Science (foyer at ground floor)<br> Celestijnenlaan 200 A<br> 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.864186697481145,%204.678754210472107)&zoomlevel=17&plaatsnaam=Department+of+Computer+Science&maptype=roadmap google maps])<br>
+
'''Talks:''' <br>Celestijnenlaan 200L, Auditorium L.00.06<br> 3001 Heverlee ([http://googlemapsinterface.kuleuven.be/index.cgi?lang=N&nbol=(50.86327251977556,%204.679660797119141)&zoomlevel=17&plaatsnaam=200L.00.06&maptype=roadmap google maps])<br>
+
  
Routemap: http://distrinet.cs.kuleuven.be/about/route/
+
As this is the only way to get to the campus, take into account that it may lead to significant delays.
  
 
=== PROGRAM ===
 
=== PROGRAM ===
 
The agenda:
 
The agenda:
*18h00 - 18h30: '''Welcome &amp; sandwiches'''<br>  
+
*18h00 - 18h45: '''Welcome & sandwiches'''<br>  
*18h30 - 18h45: '''OWASP Update''' (by Lieven Desmet, OWASP Belgium Board)<br>  
+
*18h45 - 19h00: '''[https://www.owasp.org/images/4/41/Owasp_Belgium_update_2013-12-17_v1.pptx OWASP Update]''' (by Sebastien Deleersnyder, OWASP Belgium Board)<br>  
*18h45 - 19h45: '''25 Years of Vulnerabilities''' (by Yves Younan, Senior Research Engineer at Sourcefire)<br>
+
*19h00 - 20h00: '''[https://www.owasp.org/images/f/f8/Danezis-owasp14.pptx Smart metering privacy]''' (by George Danezis)<br>
:This talk will take a look into the interesting world of vulnerability statistics. We have examined data for the last 25 years and used it to map out trends and general information on vulnerabilities in software. Some of the questions we look at are "What were the most popular vulnerabilities? Which had the most impact? Which vendors and products suffered from the most issues? Etc. While some of the statistics are predictable, others are surprising. This data was first introduced at RSA Conference San Francisco 2013.  
+
:''Abstract:'' In the past few years tremendous cryptographic progress has been made in relation to primitives for privacy friendly-computations. These include celebrated results around fully homomorphic encryption, faster somehow homomorphic encryption, and ways to leverage them to support more efficient secret-sharing based secure multi-party computations. Similar break-through in verifiable computation, and succinct arguments of knowledge, make it practical to verify complex computations, as part of privacy-preserving client side program execution. Besides computations themselves, notions like differential privacy attempt to capture the essence of what it means for computations to leak little personal information, and have been mapped to existing data query languages.
:'''Dr. Yves Younan''' is a Senior Research Engineer in the Vulnerability Research Team (VRT) at Sourcefire where he works on vulnerabilities and mitigations. Prior to joining Sourcefire, he worked as a Security Researcher with BlackBerry Security at Research In Motion. Before joining RIM, he was an academic, founding the Native Code Security group within the DistriNet research group at the KU Leuven in Belgium.  He received a Master's degree in Computer Science from the Vrije Universiteit Brussel (VUB) and a PhD in Engineering: Computer Science from KU Leuven. His PhD focused on building efficient mitigations against vulnerability exploitation, several practical mitigations were published and presented at international conferences.
+
:So, is the problem of computation on private data solved, or just about to be solved? In this talk, I argue that the models of generic computation supported by cryptographic primitives are complete, but rather removed from what a typical engineer or data analyst expects. Furthermore, the use of these cryptographic technologies impose constrains that require fundamental changes in the engineering of computing systems. While those challenges are not obviously cryptographic in nature, they are nevertheless hard to overcome, have serious performance implications, and errors open avenues for attack.
*19h45 - 20h00: Break<br>  
+
:Throughout the talk I use examples from our own work relating to privacy-friendly computations within smart grid and smart metering deployments for private billing, privacy-friendly aggregation, statistics and fraud detection. These experiences have guided the design of ZQL, a cryptographic language and compiler for zero-knowledge proofs, as well as more recent tools that compile using secret-sharing based primitives.
*20h00 - 21h00: '''Banking Security: Attacks and Defences''' (by Steven Murdoch, Senior Researcher at University of Cambridge)<br>
+
:''Bio:'' George Danezis is a Reader in Security and Privacy Engineering at the Department of Computer Science of University College London. He has been working on anonymous communications, privacy enhancing technologies (PET), and traffic analysis since 2000. He has previously been a researcher for Microsoft Research, Cambridge; a visiting fellow at K.U.Leuven (Belgium); and a research associate at the University of Cambridge (UK), where he also completed his doctoral dissertation under the supervision of Prof. R.J. Anderson.
:Designers of banking security systems are faced with a difficult challenge of developing technology within a tightly constrained budget, yet which must be capable of defeating attacks by determined, well-equipped criminals. This talk will summarise banking security technologies for protecting Chip and PIN/EMV card payments, online shopping, and online banking. The effectiveness of the security measures will be discussed, along with vulnerabilities discovered in them both by academics and by criminals. These vulnerabilities include cryptographic flaws, failures of tamper resistance, and poor implementation decisions, and have led not only to significant financial losses, but in some cases unfair allocation of liability. Proposed improvements will also be described, not only to the technical failures but also to the legal and regulatory regimes which are the underlying reason for some of these problems not being properly addressed.
+
*20h00 - 20h15: '''Break'''<br>  
:'''Dr. Steven J. Murdoch''' is a Royal Society University Research Fellow in the Security Group of the University of Cambridge Computer Laboratory, working on developing metrics for security and privacy. His research interests include covert channels, banking security, anonymous communications, and censorship resistance. Following his PhD studies on anonymous communications, he worked with the OpenNet Initiative, investigating Internet censorship. He then worked for the Tor Project, on improving the security and usability of the Tor anonymity system. Currently he is supported by the Royal Society on developing methods to understand complex system security. He is also working on analyzing the security of banking systems especially Chip & PIN/EMV, and is Chief Security Architect of Cronto, an online authentication technology provider.
+
*20h15 - 21h15: '''[https://www.owasp.org/images/d/db/HTML_Forms_and_Workflows_v3.pdf Securing Complex Forms]''' (by Jim Manico)<br>
 +
:''Abstract:'' The heart of how users interact with a web application is the HTML form submission. A great deal of very sensitive data flows over HTML forms. Securing web form submissions is critical for the construction of a secure web application. Multi-form workflows make securing form submissions even more complicated! This presentation will take you on a journey as untrusted data flows from a form submission into the many layers of a secure web application.
 +
:* Review some of the basic threats against web forms
 +
:* Learn some of the most important defense categories for building secure web forms
 +
:* Discuss some of the more complex aspects to form construction, such as workflow
 +
:''Bio:'' Jim Manico is the VP of Security Architecture at WhiteHat Security. Jim has been a web application developer since 1997. He has also been an active member of OWASP since 2008 supporting projects that help developers write secure code.
  
 
=== REGISTRATION  ===
 
=== REGISTRATION  ===
Please register via [https://owasp-belgium-2013-03-05.eventbrite.com https://owasp-belgium-2013-03-05.eventbrite.com]
+
Please register [https://owasp-belgium-2014-02-12.eventbrite.com/ on EventBrite]
  
=== PRESENTATIONS ===
 
The slides are available online!
 
* '''OWASP Update''' (by Lieven Desmet) ([https://www.owasp.org/images/9/91/Owasp_Belgium_update_2013-03-05.pdf PDF])
 
* '''25 Years of Vulnerabilities''' (by Yves Younan, Sourcefire)
 
* '''Banking Security: Attacks and Defences''' (by Steven Murdoch, University of Cambridge) ([https://www.owasp.org/images/d/d5/Owasp13bankingsecurity.pdf PDF])
 
  
=== COVERAGE ===
 
Follow what they say about us...
 
* [http://blog.rootshell.be/2013/03/05/owasp-belgium-chapter-wrap-up-march-2013/ /dev/random blog]
 
  
 
== Past Events  ==
 
== Past Events  ==
 +
*Events held in [[Belgium Previous Events 2013|2013]]
 
*Events held in [[Belgium Previous Events 2012|2012]]
 
*Events held in [[Belgium Previous Events 2012|2012]]
 
*Events held in [[Belgium Previous Events 2011|2011]]  
 
*Events held in [[Belgium Previous Events 2011|2011]]  
Line 92: Line 225:
 
*André Mariën, Inno.com  
 
*André Mariën, Inno.com  
 
*Lieven Desmet, K.U.Leuven  
 
*Lieven Desmet, K.U.Leuven  
*Sebastien Deleersnyder, SAIT Zenitel
+
*Sebastien Deleersnyder, Toreon
 
*Bart De Win, Ascure
 
*Bart De Win, Ascure
*David Mathy, Focus ICT
+
*David Mathy, Toreon
  
 
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects. __NOTOC__ <headertabs/>
 
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects. __NOTOC__ <headertabs/>
 
[[Category:Europe]]
 
[[Category:Europe]]

Latest revision as of 04:35, 25 February 2015

OWASP Belgium

Welcome to the Belgium chapter homepage. The chapter leader is Sebastien Deleersnyder
Click here to join the local chapter mailing list.

Participation

OWASP Foundation (Overview Slides) is a professional association of global members and is and open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.

Sponsorship/Membership

Btn donate SM.gif to this chapter or become a local chapter supporter.

Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? Join Now BlueIcon.JPG

[edit]

Upcoming chapter meeting: 24 February 2015 (Leuven)

On Tuesday 24 February 2015, we will have our next BE chapter meeting in Leuven.

See https://www.owasp.org/index.php/Belgium#Chapter_Meetings for more details.

Presentations of the 2014 chapter meetings are online

The presentations of our 2014 chapter meetings can be downloaded from https://www.owasp.org/index.php/Belgium#tab=Chapter_Meetings


Stay in touch

Twitter

You can also follow us on Twitter!

OWASP-BE contact list

If you want to be invited for the next OWASP Belgium Chapter meetings, please drop us your contact info.

OWASP-BE discussion mailing list

If you want to join the local chapter mailing list, please click here.

Structural Sponsors 2013/2014

OWASP Member affiliated to the Belgium chapter:

PWC_log_resized.png        TSF logo blackred transparent.png


OWASP Belgium thanks its structural chapter supporters for 2013/2014 and the OWASP BeNeLux Days 2013:

Zionsecurity.jpg Nviso_logo_RGB_baseline_200px.png Checkmarx.jpg

If you want to support our chapter, please contact Seba Deleersnyder

Next Meeting (24 February 2015) in Leuven

WHEN

24 February 2015

WHERE

Hosted by iMinds-Distrinet Research Group (KU Leuven).

Both speakers are faculty of the Secure Application Development course which is held in Leuven from 10 to 14 February 2014. OWASP Members get a 10% discount to attend the course.

Address:
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee (google maps)

Routemap: https://distrinet.cs.kuleuven.be/about/route/

PROGRAM

The agenda:

Abstract: Code reviews and penetration tests are excellent techniques for finding defects in software. But there is a whole class of defects that they are not good at finding - flaws. Jim will briefly talk about the differences between bugs and flaws, will describe a technique to help identify flaws, and talk about the work being done as part of the IEEE Center for Secure Design to help people avoid common flaws.
Bio: Jim DelGrosso is a Principal Consultant at Cigital with over 30 years of experience working for software development and consulting organizations. At Cigital, Jim heads up the Architecture Analysis practice with the mission to analyze the architecture and design of systems to identify flaws and provide our customers contextual guidance to remediate or mitigate those flaws. Jim is also the Executive Director for the IEEE Computer Society Center for Secure Design initiative.
Abstract: Compromised websites are often used by attackers to deliver malicious content or to host phishing pages designed to steal private information from their victims. In a first part of the talk I will describe Eurecom's web honeypot, a set of deliberately vulnerable web applications that are regularly compromised by real attackers. In a second part of the talk, I will describe tests we performed on the ability of specialized monitoring services and web hosting providers to detect compromised websites and how they react to user complaints.
Bio: Aurélien Francillon is an assistant professor in the Networking and Security department at EURECOM, where he is co-heading the System and Software Security group. Prior to that he obtained a PhD from INRIA and Grenoble INP and then spent 2 years as a postdoctoral researcher in the System Security Group at ETH Zurich. He is mainly interested in practical aspects of the security of embedded devices. In this context he has worked on topics such as code injection, code attestation, random number generation, hardware support for software security, bug finding techniques as well as on broader security and privacy topics. He served in many program committees and was program co-chair of CARDIS 2013.

REGISTRATION

Please register via EventBrite: http://owasp-belgium-2015-02-24.eventbrite.com

Coverage

Previous Meeting (17 December 2014) in Mechelen

WHEN

17 December 2014

WHERE

Hosted at Moonbeat (Mechelen), kindly offered by is4u.

Venue address:
Moonbeat
Oude Brusselsestraat 10-12
2800 mechelen


Route/Parking: http://www.moonbeat.be/index.php/j-stuff/web-links

PROGRAM

The agenda:

  • 18h00 - 18h45: Welcome & sandwiches
  • 18h45 - 19h00: OWASP Update (by Sebastien Deleersnyder, OWASP Belgium Board)
  • 19h00 - 20h00: OWASP Top 10 Mobile Risks / demos (by Erwin Geirnaert)
Abstract: During this presentation Erwin will discuss the OWASP Top 10 Mobile Risks for mobile apps. How easy it is to bypass security controls, retrieve confidential information, …. And how to protect against these problems.
Bio: Erwin Geirnaert is founder and Chief Hacking Officer at ZIONSECURITY, a company that aims to ensure its clients business value by securing (web/mobile) applications, either in the cloud or on-premise; and mainly focused on protecting home banking environments against fraud and attacks. Erwin is a recognized application security expert and speaker at international events like Javapolis, OWASP, Eurostar and Infosecurity. He is a specialist in J2EE security, .NET security and web services security and has more than 10 years of experience in executing security tests of web and thick client applications. Erwin also architects secure e-business projects for banks, web agencies and software companies.
Abstract: Security must be considered throughout the whole software development cycle, including early phases such as requirements elicitation and software design. While this is a widely accepted statement, it is not evident to achieve this in practice. Although some academic proposals along this line exist, they are not used in industry. As academics, before making any new proposals, we want to perform a survey in order to understand to what degree security and privacy are currently present in the requirements elicitation and architecture and design activities of organizations, how they are incorporated in practice, and what the benefits and limitations of the existing approaches are.
In this short talk, we will explore why such a study is needed, what our goal is, and why you should participate.
  • 20h30 - 21h30: OpenSAMM Best Practices: Lessons from the Trenches (by Sebastien Deleersnyder and Bart De Win)
Abstract: Managing all application security activities as part of development and deployment of applications can be an overwhelming challenge. OWASP OpenSAMM gives you a structural and measurable blueprint to integrate OWASP best practices in your software life cycle. This OWASP framework allows you to formulate and implement a strategy for software security that is tailored to the risk profile of your organisation.
During this talk Bart and Sebastien will get you up to speed on the OpenSAMM framework and share their important challenges they faced in implementing the framework within various organisations. Important topics that will be covered during this presentation are:
  • What is the optimal OpenSAMM maturity level for your organisation?
  • At which level to implement OpenSAMM in the organisation: at company, business unit or development team level?
  • How to integrate OpenSAMM activities in agile development?
  • How to apply OpenSAMM on suppliers or outsourced development?
  • What metrics does OpenSAMM provide to manage your secure development life cycle?
Practical lessons learned and use cases from the trenches that make OWASP OpenSAMM a valuable methodology and which you should apply for your secure development life cycle!
Bio: Sebastien Deleersnyder is co-founder & managing partner application security at Toreon.com
As application security specialist for more than 10 years, Sebastien has helped various companies improve their ICT-, Web- and Mobile Security, including BNP Paribas Fortis, Atos Worldline, KBC, NationaleNederlanden (ING), Isabel, Fluxys, OLAF, EU Council, TNT Post, Flemish Community, Agfa-Gevaert and ING Insurance International. Sebastien is the Belgian OWASP Chapter Leader, co-project leader of the OpenSAMM project, served on the OWASP Foundation Board member (2007-2013) and performed several presentations and trainings on Web Application, Mobile and Web Services Security. Furthermore Sebastien co-organizes the yearly BruCON conference in Ghent (Belgium).
Bio: Bart De Win has over 15 years of experience in software security. He has an extensive background in the field, including his Ph.D. and research work on methods and techniques for software protection. Since 2009, Bart has been responsible for all application security services within Ascure & PwC Belgium. He has extensive project experience in software testing and in assisting companies improving their secure software development practices. Bart is member of the OWASP Belgium Chapter board and he is a co-leader of the OpenSAMM Software Assurance Model. Bart is SABSA, Prince 2 and CSSLP certified.

REGISTRATION

Please register via EventBrite: http://owasp-belgium-2014-12-17.eventbrite.com

Coverage

Previous Meeting (20th of May 2014) in Brussels

WHEN

20th of May 2014 (18h00 - 21h00)

WHERE

Hosted by NVISO

Address:
NVISO (ICAB)
Rue des Peres Blancs 4
1040 Etterbeek

PROGRAM

The agenda:

Abstract: In this talk Tiago Teles takes apart password protection scheme analyzing the attack resistance of hashes, hmacs, adaptive hashes (such as script), and encryption schemes. First, we present a threat model for password storage. Then audience members will learn the construction, performance, and protective properties of these primitives. Discussion of the primitives will be from a critical perspective modeled as an iterative secure design session.
Ultimately, this session presents the solution and code donated as part an on-going OWASP project – a OWASP PSM (password storage module). Discussion of this solution will include key techniques for hardening PSM learned through years of delivering production JavaEE code to customers…
Bio: Tiago Teles is a Technical Consultant with 8 years of experience in clients across different sectors and countries, including banking, insurance, telecommunications and commercial organizations in a variety of roles: Delivering Training, Development, Business Intelligence and Quality Assurance. For some of the talks already delivered please see: Video talks for more information please visit: Tiago Teles' LinkedIn profile.
Abstract: ATMs (Automated Teller Machines) are the main component of self-servicing banking functions used by millions of banking customers worldwide. To put things in perspective, 400,000 ATM devices were deployed in Europe alone as of 30 June 2013. Worldwide, the number of ATMs grew from 1.7 million to 2.5 million between 2007 and 2013.
This entertaining talk on attacks against Automated Teller Machines (ATMs) will focus on the history of ATM attacks and the current development of cross-vendor ATM malware. The talk will include a presentation of our from-scratch developed ATM malware that will be presented on a live ATM system (see http://youtu.be/MBOD59r3lTM).
Bio: Daan Raman and Erik Van Buggenhout are security consultants at NVISO, where they focus on information security topics in the financial services industry.

REGISTRATION

Please register via EventBrite: CLOSED

Coverage

Covered by Xavier Mertens: http://blog.rootshell.be/2014/05/22/may-2014-owasp-belgium-chapter-meeting-wrap-up/

Previous Meeting (12th of February 2014) in Leuven

WHEN

12th of February 2014 (18h00 - 21h00)

WHERE

Jointly organized with SecAppDev. Hosted by iMinds-Distrinet Research Group (KU Leuven).

Both speakers are faculty of the Secure Application Development course which is held in Leuven from 10 to 14 February 2014. OWASP Members get a 10% discount to attend the course.

Address:
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee (google maps)

Routemap: https://distrinet.cs.kuleuven.be/about/route/

Last minute update:

I would like to notify you that due to traffic work you most probably will have to make a detour to get to the university campus.

Because of a road block at the Celestijnenlaan, this street has become one way. This forces participants coming from the E40/Koning Boudewijnlaan to reach the campus via the ring (R23)/Naamsesteenweg/Kardinaal Mercierlaan.

A map of the detour can be found here: http://goo.gl/maps/kZqEQ

As this is the only way to get to the campus, take into account that it may lead to significant delays.

PROGRAM

The agenda:

  • 18h00 - 18h45: Welcome & sandwiches
  • 18h45 - 19h00: OWASP Update (by Sebastien Deleersnyder, OWASP Belgium Board)
  • 19h00 - 20h00: Smart metering privacy (by George Danezis)
Abstract: In the past few years tremendous cryptographic progress has been made in relation to primitives for privacy friendly-computations. These include celebrated results around fully homomorphic encryption, faster somehow homomorphic encryption, and ways to leverage them to support more efficient secret-sharing based secure multi-party computations. Similar break-through in verifiable computation, and succinct arguments of knowledge, make it practical to verify complex computations, as part of privacy-preserving client side program execution. Besides computations themselves, notions like differential privacy attempt to capture the essence of what it means for computations to leak little personal information, and have been mapped to existing data query languages.
So, is the problem of computation on private data solved, or just about to be solved? In this talk, I argue that the models of generic computation supported by cryptographic primitives are complete, but rather removed from what a typical engineer or data analyst expects. Furthermore, the use of these cryptographic technologies impose constrains that require fundamental changes in the engineering of computing systems. While those challenges are not obviously cryptographic in nature, they are nevertheless hard to overcome, have serious performance implications, and errors open avenues for attack.
Throughout the talk I use examples from our own work relating to privacy-friendly computations within smart grid and smart metering deployments for private billing, privacy-friendly aggregation, statistics and fraud detection. These experiences have guided the design of ZQL, a cryptographic language and compiler for zero-knowledge proofs, as well as more recent tools that compile using secret-sharing based primitives.
Bio: George Danezis is a Reader in Security and Privacy Engineering at the Department of Computer Science of University College London. He has been working on anonymous communications, privacy enhancing technologies (PET), and traffic analysis since 2000. He has previously been a researcher for Microsoft Research, Cambridge; a visiting fellow at K.U.Leuven (Belgium); and a research associate at the University of Cambridge (UK), where he also completed his doctoral dissertation under the supervision of Prof. R.J. Anderson.
Abstract: The heart of how users interact with a web application is the HTML form submission. A great deal of very sensitive data flows over HTML forms. Securing web form submissions is critical for the construction of a secure web application. Multi-form workflows make securing form submissions even more complicated! This presentation will take you on a journey as untrusted data flows from a form submission into the many layers of a secure web application.
  • Review some of the basic threats against web forms
  • Learn some of the most important defense categories for building secure web forms
  • Discuss some of the more complex aspects to form construction, such as workflow
Bio: Jim Manico is the VP of Security Architecture at WhiteHat Security. Jim has been a web application developer since 1997. He has also been an active member of OWASP since 2008 supporting projects that help developers write secure code.

REGISTRATION

Please register on EventBrite


Past Events

  • Events held in 2013
  • Events held in 2012
  • Events held in 2011
  • Events held in 2010
  • Events held in 2009
  • Events held in 2008
  • Events held in 2007
  • Events held in 2006
  • Events held in 2005

The Belgium Chapter is supported by the following board:

  • Erwin Geirnaert, Zion Security
  • Philippe Bogaerts, F5
  • André Mariën, Inno.com
  • Lieven Desmet, K.U.Leuven
  • Sebastien Deleersnyder, Toreon
  • Bart De Win, Ascure
  • David Mathy, Toreon
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.