OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?
"BeNeLux Days 2012" is online: https://www.owasp.org/index.php/BeNeLux_OWASP_Day_2012.
If you want to be invited for the next OWASP Belgium Chapter meetings, please drop us your contact info.
You can also follow us on Twitter!
Structural Sponsors 2012/2013
OWASP Member affiliated to the Belgium chapter:
OWASP Belgium thanks its structural chapter supporters for 2012 and the OWASP BeNeLux Days 2012:
If you want to support our chapter, please contact Seba Deleersnyder
Next Meeting (5th of March 2013) in Leuven
5th of March 2013 (18h00 - 21h00)
This chapter meeting is co-organized with the SecAppDev training course.
Both speakers are faculty of the Secure Application Development course which is held in Leuven from 4 March 2013 until 8 March 2013. OWASP Members get a 10% discount to attend the course.
Hosted by Distrinet Research Group (K.U.Leuven).
Department of Computer Science (meeting room 05.128 - fifth floor)
Celestijnenlaan 200 A
- 18h00 - 18h30: Welcome & sandwiches
- 18h30 - 18h45: OWASP Update (by Lieven Desmet, OWASP Belgium Board)
- 18h45 - 19h45: 25 Years of Vulnerabilities (by Yves Younan, Senior Research Engineer at Sourcefire)
- This talk will take a look into the interesting world of vulnerability statistics. We have examined data for the last 25 years and used it to map out trends and general information on vulnerabilities in software. Some of the questions we look at are "What were the most popular vulnerabilities? Which had the most impact? Which vendors and products suffered from the most issues? Etc. While some of the statistics are predictable, others are surprising. This data was first introduced at RSA Conference San Francisco 2013.
- Dr. Yves Younan is a Senior Research Engineer in the Vulnerability Research Team (VRT) at Sourcefire where he works on vulnerabilities and mitigations. Prior to joining Sourcefire, he worked as a Security Researcher with BlackBerry Security at Research In Motion. Before joining RIM, he was an academic, founding the Native Code Security group within the DistriNet research group at the KU Leuven in Belgium. He received a Master's degree in Computer Science from the Vrije Universiteit Brussel (VUB) and a PhD in Engineering: Computer Science from KU Leuven. His PhD focused on building efficient mitigations against vulnerability exploitation, several practical mitigations were published and presented at international conferences.
- 19h45 - 20h00: Break
- 20h00 - 21h00: Banking Security: Attacks and Defences (by Steven Murdoch, Senior Researcher at University of Cambridge)
- Designers of banking security systems are faced with a difficult challenge of developing technology within a tightly constrained budget, yet which must be capable of defeating attacks by determined, well-equipped criminals. This talk will summarise banking security technologies for protecting Chip and PIN/EMV card payments, online shopping, and online banking. The effectiveness of the security measures will be discussed, along with vulnerabilities discovered in them both by academics and by criminals. These vulnerabilities include cryptographic flaws, failures of tamper resistance, and poor implementation decisions, and have led not only to significant financial losses, but in some cases unfair allocation of liability. Proposed improvements will also be described, not only to the technical failures but also to the legal and regulatory regimes which are the underlying reason for some of these problems not being properly addressed.
- Dr. Steven J. Murdoch is a Royal Society University Research Fellow in the Security Group of the University of Cambridge Computer Laboratory, working on developing metrics for security and privacy. His research interests include covert channels, banking security, anonymous communications, and censorship resistance. Following his PhD studies on anonymous communications, he worked with the OpenNet Initiative, investigating Internet censorship. He then worked for the Tor Project, on improving the security and usability of the Tor anonymity system. Currently he is supported by the Royal Society on developing methods to understand complex system security. He is also working on analyzing the security of banking systems especially Chip & PIN/EMV, and is Chief Security Architect of Cronto, an online authentication technology provider.
Please register via https://owasp-belgium-2013-03-06.eventbrite.com
Previous Meeting (6th of March 2012) in Leuven
6th of March 2012 18h-21h00
Hosted by Distrinet Research Group (K.U.Leuven).
Co-organized with SecAppDev 2012
Department of Computer Science (auditorium 00.225)
Celestijnenlaan 200 A
- 18h00 - 18h45: Welcome & Pizzas
- 18h45 - 19h00: OWASP Update (PPT) (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
- 19h00 - 20h00: Common iOS Pitfalls vs. OWASP's iGoat (PPT) (by Ken van Wyk, KRvW Associates)
- In this session, Ken will spotlight and demonstrate several security "gotchas" in Apple's iOS platform (iPhone and iPad). He'll then introduce the OWASP iGoat tool and demonstrate how it can be used (and extended) to help train iOS coders. Like the other OWASP *Goat tools, iGoat is a great learning platform that can help iOS developers internalize the big issues they face in building bulletproof apps. Ken is the project leader for iGoat, and we're always looking for contributors.
- KenKenneth R. van Wyk is an internationally recognized information security expert and author of the O’Reilly and Associates books, Incident Response and Secure Coding. Ken provides consulting and training services through his company, KRvW Associates, LLC (http://www.KRvW.com). Ken has 22 years experience as an IT Security practitioner in the academic, military, and commercial sectors. He has held senior and executive technologist positions at Tekmark, Para-Protect, Science Applications International Corporation (SAIC), the U.S. Department of Defense, Carnegie Mellon University, and Lehigh University.
- 20h00 - 20h15: Break
- 20h15 - 21h15: Access Control Design Best Practices (PPT) (by Jim Manico, WhiteHat Security)
- Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.
- Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. Jim is a participant and project manager of the OWASP Developer Cheatsheet series. He is also the producer and host of the OWASP Podcast Series.
Please register via http://owasp-belgium-2012-03-06.eventbrite.com/
Previous Meeting (25th of January 2012) in Brussels
25th of January 2012 18h-21h00
Location is sponsored by Cisco Belgium.
Location: Cisco, Pegasus Park, De Kleetlaan, 6A, B-1831 Diegem. See directions.
- 18h00 - 18h30: Welcome & Sandwiches
- 18h30 - 18h45: OWASP Update (ppt) (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
- 18h45 - 19h45: devops, secops, devsec or *ops ? A gentle introduction to Devops(pdf) (by Kris Buytaert, Inuits)
- This talk will summarize the different ideas behind devops, and will show that this goes beyond tooling and becomes a way of thinking, where ultimately everybody will stand together to support the business.
- Some call this phenomenon devops, others hate the word and want to call it *ops or ops* , truth is that agile techniques used in development have an impact on the way operations organizes it work. Similar, operations and sysadmins are becoming programmers because of the virtualization and automation trend where everything is managed through an API. And security is imvolved everywhere.
- Kris Buytaert is a long time Linux and Open Source Consultant. He's one of instigators of the devops movement, currently working for Inuits. Kris is the Co-Author of Virtualization with Xen, used to be the maintainer of the openMosix HOWTO and author of different technical publications. He is frequently speaking at, or organizing different international conferences. He spends most of his time working on Linux Clustering (both High Availability, Scalability and HPC), Virtualisation and Large Infrastructure Management projects hence trying to build infrastructures that can survive the 10th floor test, better known today as the cloud while actively promoting the devops idea ! His blog titled "Everything is a Freaking DNS Problem" can be found at http://www.krisbuytaert.be/blog/
- 19h45 - 20h00: Break
- 20h00 - 21h00: Hardening web applications against malware attacks (ppt) (by Erwin Geirnaert, Zion Security)
- During this presentation we give an overview of how we can harden web applications against different types of attacks used by malware to bypass the existing security controls in the web application. We discuss the OWASP Top 10 and how malware can abuse these attacks and how the developer must implement a different strategy. We explain why (mobile) browser security is an important aspect of web application hardening and most importantly that the battle against malware is an ongoing battle. For every countermeasure the security industry develops to protect web applications and is used by a lot of companies today we will show how malware is being developed to bypass these solutions. To finalize we give some advice on how to protect against these malware attacks, using pro-active and detective controls.
- Erwin Geirnaert founded ZION SECURITY in 2005 to help companies to protect against the latest threats, attacks against web applications. ZION SECURITY is nowadays a Belgian market leader in the field of security testing, vulnerability management, penetration testing and banking security. Erwin has more than 10 years of experience in web security, graduating with a Master of Science in Software Development from the University of Ghent. Erwin executes different types of projects for a lot of international software companies, financial institutions, telecom and web agencies. Specialist in executing code reviews in different development languages for critical applications, executing continuous penetration tests of their infrastructure and Internet applications. A specialist in J2EE security, .NET security and web services security. Erwin architects secure e-business projects for web agencies and software companies. He is a recognized application security expert and speaker at international events like Javapolis, OWASP, Eurostar,
The Belgium Chapter is supported by the following board:
- Erwin Geirnaert, Zion Security
- Philippe Bogaerts, F5
- André Mariën, Inno.com
- Lieven Desmet, K.U.Leuven
- Sebastien Deleersnyder, SAIT Zenitel
- Bart De Win, Ascure
- David Mathy, Focus ICT