Revision as of 07:53, 31 August 2013 by Dm-17 (talk | contribs) (Next Meeting (8th of October 2013) in Diegem)

Jump to: navigation, search

OWASP Belgium

Welcome to the Belgium chapter homepage. The chapter leader is Sebastien Deleersnyder
Click here to join the local chapter mailing list.


OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.


Btn donate SM.gif to this chapter or become a local chapter supporter.

Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member? Join Now BlueIcon.JPG

Stay updated

"BeNeLux Days 2012" is online:

If you want to be invited for the next OWASP Belgium Chapter meetings, please drop us your contact info.

You can also follow us on Twitter!

Structural Sponsors 2012/2013

OWASP Member affiliated to the Belgium chapter:


OWASP Belgium thanks its structural chapter supporters for 2012 and the OWASP BeNeLux Days 2012:

200px-Iminds-logo.png Zionsecurity.jpg On2it-sponsor.png

If you want to support our chapter, please contact Seba Deleersnyder

Next Meeting (8th of October 2013) in Diegem


8th of October 2013 (18h00 - 21h00)


Hosted by Ernst & Young.

Ernst & Young
De Kleetlaan 2
B1831 Diegem
Location: Google Maps.


The agenda:

  • 17h30 - 18h15: Welcome & sandwiches
  • 18h15 - 18h30: OWASP Update (by Sebastien Deleersnyder, OWASP Belgium Board)
  • 18h30 - 19h30: NoScript for Developers (by Giorgio Maone)
Everything security-conscious web developers should know to make their creations safer and more accessible for NoScript users, plus an overview of current and upcoming technologies inspired by NoScript which can be leveraged server-side to enhance web applications' security.
  • 19h30 - 19h45: Break
  • 19h45 - 20h45: JSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks (by Mario Heiderich)
There is a way to build common, classic web applications. You know, servers, databases, some HTML and a bit of JavaScript. Ye olde way. Grandfather still knows. And there is a way to build hip and fancy, modern and light-weight, elastic and scalable client-side web applications. Sometimes with a server in the background, sometimes with a database - but all the hard work is done by something new: JavaScript Model-View-Controller and templating frameworks.
Angular, Ember and CanJS, Knockout, Handlebars and Underscore... those aren't names of famous wrestlers but modern JavaScript fame-works that offer a boost in performance and productivity by taking care of many things web-app right there in the browser, where the magic happens. And more and more people jump on the bandwagon and implement those frameworks with great success. High time for a stern look from the security perspective, ain't it not?
This talk will show you how those frameworks work, how secure their core is and what kind of security issues spawn from the generous feature cornucopia they offer. Do their authors really know the DOM well enough to enrich it with dozens of abstraction layers? Or did they open a gate straight to JavaScript hell introducing a wide range of new injection bugs and coding worst-practices? Well, you'll know after this talk. You'll know...
Bio TBD.


Please register via ... Soon available ...

Previous Meeting (6th of June 2013) in Leuven


6th of June 2013 (18h00 - 21h00)


This chapter meeting is part of the OWASP Europe Tour 2013

Hosted by iMinds-Distrinet Research Group (KU Leuven).

Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee (google maps)



The agenda:

Using static analysis to identify software bugs is not a new paradigm. For years, developers have used static analysis tools to identifying code quality issues. While these tools may not be specifically designed for identifying security bugs. This presentation will discuss how custom security rules can be added to existing code quality tools to identify potential software security bugs. Writing custom software security rules for the popular Java code scanning tool PMD will be the focus of the presentation.
Justin Clarke is a Director and Co-Founder of Gotham Digital Science. He is the lead author/technical editor of "SQL Injection Attacks and Defense" (Syngress), co-author of "Network Security Tools" (O'Reilly), contributor to "Network Security Assessment, 2nd Edition" (O'Reilly), as well as a speaker at numerous security conferences and events such as Black Hat, EuSecWest, ISACA, BruCON, OWASP AppSec, OSCON, RSA and SANS. Justin is the Chapter Leader for the OWASP London chapter in the United Kingdom.
We present an approach to predict which components of a software system contain security vulnerabilities. Prediction models are a key instrument to identify the weak spots that deserve special scrutiny. Our approach is based on text mining the source code of an application. We have explored the potential of the bag-of-words representation and discovered that a dependable prediction model can be built by means of machine learning techniques. In a validation with 10 Android applications we have obtained performance results that often outclass state-of-the-art approaches.


xme has blogged about the meeting on his /dev/random blog


Please register via CLOSED

Previous Meeting (5th of March 2013) in Leuven


5th of March 2013 (18h00 - 21h00)


This chapter meeting is co-organized with SecAppDev.

Both speakers are faculty of the Secure Application Development course which is held in Leuven from 4 March 2013 until 8 March 2013. OWASP Members get a 10% discount to attend the course.

Hosted by Distrinet Research Group (K.U.Leuven).

Address: UPDATED!
Welcome & Sandwiches:
Department of Computer Science (foyer at ground floor)
Celestijnenlaan 200 A
3001 Heverlee (google maps)
Celestijnenlaan 200L, Auditorium L.00.06
3001 Heverlee (google maps)



The agenda:

  • 18h00 - 18h30: Welcome & sandwiches
  • 18h30 - 18h45: OWASP Update (by Lieven Desmet, OWASP Belgium Board)
  • 18h45 - 19h45: 25 Years of Vulnerabilities (by Yves Younan, Senior Research Engineer at Sourcefire)
This talk will take a look into the interesting world of vulnerability statistics. We have examined data for the last 25 years and used it to map out trends and general information on vulnerabilities in software. Some of the questions we look at are "What were the most popular vulnerabilities? Which had the most impact? Which vendors and products suffered from the most issues? Etc. While some of the statistics are predictable, others are surprising. This data was first introduced at RSA Conference San Francisco 2013.
Dr. Yves Younan is a Senior Research Engineer in the Vulnerability Research Team (VRT) at Sourcefire where he works on vulnerabilities and mitigations. Prior to joining Sourcefire, he worked as a Security Researcher with BlackBerry Security at Research In Motion. Before joining RIM, he was an academic, founding the Native Code Security group within the DistriNet research group at the KU Leuven in Belgium. He received a Master's degree in Computer Science from the Vrije Universiteit Brussel (VUB) and a PhD in Engineering: Computer Science from KU Leuven. His PhD focused on building efficient mitigations against vulnerability exploitation, several practical mitigations were published and presented at international conferences.
  • 19h45 - 20h00: Break
  • 20h00 - 21h00: Banking Security: Attacks and Defences (by Steven Murdoch, Senior Researcher at University of Cambridge)
Designers of banking security systems are faced with a difficult challenge of developing technology within a tightly constrained budget, yet which must be capable of defeating attacks by determined, well-equipped criminals. This talk will summarise banking security technologies for protecting Chip and PIN/EMV card payments, online shopping, and online banking. The effectiveness of the security measures will be discussed, along with vulnerabilities discovered in them both by academics and by criminals. These vulnerabilities include cryptographic flaws, failures of tamper resistance, and poor implementation decisions, and have led not only to significant financial losses, but in some cases unfair allocation of liability. Proposed improvements will also be described, not only to the technical failures but also to the legal and regulatory regimes which are the underlying reason for some of these problems not being properly addressed.
Dr. Steven J. Murdoch is a Royal Society University Research Fellow in the Security Group of the University of Cambridge Computer Laboratory, working on developing metrics for security and privacy. His research interests include covert channels, banking security, anonymous communications, and censorship resistance. Following his PhD studies on anonymous communications, he worked with the OpenNet Initiative, investigating Internet censorship. He then worked for the Tor Project, on improving the security and usability of the Tor anonymity system. Currently he is supported by the Royal Society on developing methods to understand complex system security. He is also working on analyzing the security of banking systems especially Chip & PIN/EMV, and is Chief Security Architect of Cronto, an online authentication technology provider.


The slides are available online!

  • OWASP Update (by Lieven Desmet) (PDF)
  • 25 Years of Vulnerabilities (by Yves Younan, Sourcefire) (PDF)
  • Banking Security: Attacks and Defences (by Steven Murdoch, University of Cambridge) (PDF)


Follow what they say about us...

Past Events

The Belgium Chapter is supported by the following board:

  • Erwin Geirnaert, Zion Security
  • Philippe Bogaerts, F5
  • André Mariën,
  • Lieven Desmet, K.U.Leuven
  • Sebastien Deleersnyder, freelance
  • Bart De Win, Ascure
  • David Mathy, Focus ICT
Our goal is to professionalize the local OWASP functioning, provide in a bigger footprint to detect OWASP opportunities such as speakers/topics/sponsors/… and set a 5 year target on: Target audiences, Different events and Interactions of OWASP global – local projects.