OWASP Foundation (Overview Slides) is a professional association of global members and is open to anyone interested in learning more about software security. Local chapters are run independently and guided by the Chapter_Leader_Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of any meeting venue and/or refreshments is tax-deductible. Financial contributions should only be made online using the authorized online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.
Or consider the value of Individual, Corporate, or Academic Supporter membership. Ready to become a member?
To find out more about the Boston chapter, just join the OWASP Boston mailing list.
Local Chapter Information --- Our Eighth Year
| The chapter shipping/mailing address is:
| OWASP Boston Application Security Conference 2012
||The Boston chapter is grateful for support from:|
We usually meet the FIRST WEDNESDAY of EVERY MONTH (Unless a speaker can only present another night), 6:30 to 9 pm.
Everyone is welcome to come to any meeting, there is no signup or joining criteria, just come if it sounds interesting. Feel free to sign up to the OWASP Boston mailing list. This list is very low volume (2 - 3 emails/month); it is used to remind people about each monthly meeting, inform about local application security events and special chapter offers.
Information for meeting updates about this and other Boston area user groups can also be found at BostonUserGroups.
Please Note New Location:
We no longer meet in Waltham or at our old Cambridge meeting place. Most meetings will now happen at Akamai at 8 Cambridge Center in Cambridge, MA.
Topic: What is BSIMM?
Speaker: Nabil Hannan
New Location: Akamai at 8 Cambridge Center in Cambridge, MA
Nabil is Director of Vulnerability Assessments and Managing Consultant at Cigital.
The purpose of the BSIMM is to quantify the activities carried out by real software security initiatives. BSIMM is a study of the secure development practices of over 50 organizations, analyzed along the dimensions that were found in the data, not along preconceived ideas of what secure development should be.
BSIMM describes the work of 974 software security group members working with a satellite of 2039 people to secure the software developed by 218,286 developers.
The BSIMM describes 111 activities that any organization can put into practice. The activities are described in twelve practices grouped into four domains. Associated with each activity is an objective.
Speaker: Eric Kobrin, Akamai
When: Wednesday, February 6, 6:30 pm
Location: Akamai at 8 Cambridge Center in Cambridge, MA
Eric Kobrin is a Senior Security Architect in the Infosec organization of Akamai Technologies, the global leader in Cloud-based application acceleration and content delivery. Eric has been involved in Software Architecture for over 15 years, having worked at such companies and IBM, Velocitude and eDiets.com. He has a passion for programming languages, security, and software performance and has worked in all layers of the software stack from hypervisors to complex servers and web applications. Eric's works have been published, presented at international conferences and patented.
His presentation will provide an analysis of the BroBot DDOS attacks, including discussion of:
- Vulnerable system discovery
- Zombie compromise
- Control structure
- Attack traffic
- Mitigation steps
Topic: Third-Party Application Analysis: Best Practices and Lessons Learned
Speaker: Chad Holmes, Veracode
Location: Akamai at 8 Cambridge Center in Cambridge, MA
Chad Holmes will present details of the work Veracode has been doing with their 3rd Party program, discuss the technical and business challenges that have arisen during that time and lead a discussion on what team members can do to help drive adoption of security best practices across their vendor community.
The flow of the presentation is designed to drive discussion within an audience – both from a technical and business perspective with some anecdotal stories. Chad wants this to be an interactive discussion so he’ll have questions and you should bring yours I’ve already sent him some. The order of the presentation is:
· Adoption rates of externally developed software
· The risk within those apps
· Some deeper stats on what “3rd party” really means (total outsourcing/total COTS produced/open source/imported libraries/etc)
· Some raw data about our experiences (to show this is based on a large sample size rather than “Look how awesome Veracode is!”)
· Challenges that will be faced (business, intellectual property, policy, analysis capabilities, etc)
· Best Practices for high rates of adoption
· Lessons Learned and Recommendations
Chad Holmes has over 10 years of software development and application security experience. During his time at Veracode, Chad has lead the redesign and execution of the third-party analysis process to allow for a more streamlined approach while still addressing common ISV intellectual property concerns. In addition to his third-party analysis responsibilities, Chad's previous work as a Security Program Manager has lead to the successful roll out and improvement of multiple corporate application security groups.
Location - Microsoft Waltham (201 Jones Rd., Sixth Floor Waltham, MA)
Speaker Will Vandevanter - Rapid 7
Fingerprinting web applications of all kinds
This turbo talk will introduce a new Metasploit module that fingerprints "known" web applications, attempts the default credentials for the application, and runs an associated exploit or authenticated access module if applicable. Some example fingerprints in the database target common enterprise web applications including Microsoft products (Outlook Web Access, Sharepoint), printers (Xerox Document Centre), security cameras, routers, and others.
Will Vandevanter is a senior penetration tester and researcher at Rapid7. His focus interests include web application security and secure code. He has previously spoken at Defcon, SOURCE, BSides LV, and other conferences.
May 31 2012
Location - Jobspring, Boston. 545 Boylston st.
Speaker - Glenn Gramling, Vice President, Cenzic
“Cloudy with a Chance of Hack”
Cloud computing is a cost effective and efficient way for enterprises to automate their processes. However organizations need to be aware of the pitfalls of the many cloud solutions out there - one of the main being security. Most cloud applications were built for ease of use and without security necessarily in mind. Companies need to be asking their solution providers about the security measures used in developing the application and get an independent verification to make sure there are no gaping holes. With over 75% of attacks occurring through the Web, any attack through these applications can lead to leakage of confidential information and embarrassment. In this session, we'll give attendees tips and tricks to prepare them for the potential of "stormy weather."
Glenn Gramling is responsible for global sales and business development for Cenzic’s application security.
April 11, 2012
Location - Microsoft Waltham (201 Jones Rd., Sixth Floor Waltham, MA)
Speaker - David Eoff, Senior Product Marketing Manager, HP Enterprise Security
David is a Senior Product Marketing Manager, within the Enterprise Security Products division of HP focused on Fortify application security. His 18+ years of background in software and hardware enterprise marketing provides a solid foundation for his marketing of the HP security solutions.
Prior to joining Fortify in 2009 and being acquired by HP, David ran Firewall and IPS marketing for the Security division of Nokia Corporation. In addition, he has held multiple positions in product marketing, product management, channel marketing and sales while working for Oracle, EMC, Legato, BMC Software and several start-ups.
Topic - Gray, the New Black: Gray-Box Vulnerability Testing
Over the years, two key techniques have emerged as the most effective for finding security vulnerabilities in software: Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST). While DAST and SAST each possess unique strengths, the “Holy Grail” of security testing is thought to be “hybrid” – a technique that combines and correlates the results from both testing methods, maximizing the advantages of each. Until recently, however, a critical element has been missing from first generation hybrid solutions: information about the inner workings and behavior of applications undergoing DAST and SAST analysis.
This presentation will introduce you to the next generation of hybrid security analysis – what it is, how it works, and the benefits it offers. It will also address (and dispel) the claims against hybrid, and leave you with a clear understanding of how the new generation of hybrid will enable organizations to resolve their most critical software security issues faster and more cost-effectively than any other available analysis technology.
March 8, 2012, with the Boston Security Meetup group
Location - JobSpring, Boylston St.
Topic - Corporate Espionage for Dummies: The Hidden Threat of Embedded Web Servers
Speaker - VP for Security Research at ZScaler, along with other speakers at the security meetup.
Today, everything from kitchen appliances to television sets come with an IP address. Network connectivity for various hardware devices opens up exciting opportunities. Forgot to lower the thermostat before leaving the house? Simply access it online. Need to record a show? Start the DVR with a mobile app. While embedded web servers are now as common as digital displays in hardware devices, sadly, security is not. What if that same convenience exposed photocopied documents online or allowed outsiders to record your telephone conversations? A frightening thought indeed.
Software vendors have been forced to climb the security learning curve. As independent researchers uncovered embarrassing vulnerabilities, vendors had little choice but to plug the holes and revamp development lifecycles to bake security into products. Vendors of embedded web servers have faced minimal scrutiny and as such are at least a decade behind when it comes to security practices. Today, network connected devices are regularly deployed with virtually no security whatsoever.
The risk of insecure embedded web servers has been amplified by insecure networking practices. Every home and small business now runs a wireless network, but it was likely set up by someone with virtually no networking expertise. As such, many devices designed only for LAN access are now unintentionally Internet facing and wide open to attack from anyone, regardless of their location.
Leveraging the power of cloud based services, Zscaler spent several months scanning large portions of the Internet to understand the scope of this threat. Our findings will make any business owner think twice before purchasing a 'wifi enabled' device. We'll share the results of our findings, reveal specific vulnerabilities in a multitude of appliances and discuss how embedded web servers will represent a target rich environment for years to come.
December 13, 2011, 6:30, Microsoft NERD, Cambridge, Horace Mann Room
Jeremiah Grossman – Founder and CTO WhiteHat Security
September 14 2011
Dinis Cruz - OWASP O2 Platform
The O2 Platform is focused on automating application security knowledge and workflows. It is a library of scriptable objects specifically designed for developers and security consultants to be able to perform quick, effective and thorough source code-driven application security reviews (blackbox + whitebox).
September 7 2011
Adriel Desautels – Differences between Penetration Testing and Vulnerability Scanning
Anurag Agarwal, the founder of MyAppSecurity
Session 1 - Managing Risk with Threat Modeling Threat Modeling can help by guiding the Application Development Teams to ensure your Security Policies get properly coded into the Applications at time of Development. By creating pre-approved methods of coding for your development teams, and applying them in a repeatable and scalable process, you can assist your development teams in building a secure application easily and effortlessly.
Session 2 - False Positive, False Negative and False Sense of Security This interactive session will talk about the pros and cons of using black box testing tools and discuss their effectiveness in building a mature software security program.
Thursday June 2
Location - Microsoft NERD - http://microsoftcambridge.com/About/Directions/tabid/89/Default.aspx
Topic - Bringing Sexy Back: Defensive Measures That Actually Work
Presenter - Paul Asadoorian, Founder & CEO, PaulDotCom Enterprises
There is a plethora of information available on how to break into systems, steal information, and compromise users. As a penetration tester, I have performed testing on a regular basis that reveals severe security weaknesses in several organizations, and many of my peers have reported on the same. However, once you "own" the network and report on how you accomplished your goals, now what? Sure, we make defensive recommendations, but consistently it has been proven that security can be bypassed. Not enough focus is given to what works defensively. We have a lot of technology at our disposal: firewalls, intrusion detection, log correlation, but it provides little protection from today's threats and is often not implemented effectively. This talk will focus on taking an offensive look at defense. Applying techniques that are simple, yet break the mold of traditional defensive measures. We will explore setting up "traps" for attackers, slowing them down with simple scripts, using honeypots, planting bugs, and most importantly tying these methods to "enterprise security". This talk will also include real-world examples of the techniques in action from a live, heavily attacked site. Topics will include:
- Using wireless “attacks” on the attackers
- Implementing the Metasploit Decloak engine to find the attackers
- Setting traps to detect web application attacks
- Integrating results into your enterprise log management tool
The goal of this talk is to make defense “sexy”…
Paul Asadoorian is currently the "Product Evangelist" for Tenable Network Security, where he showcases vulnerability scanning and management through blogs, podcasts and videos. Paul is also the founder of PaulDotCom, an organization centered around the award winning "PaulDotCom Security Weekly" podcast that brings listeners the latest in security news, vulnerabilities, research and interviews with the security industry's finest. Paul has a background in penetration testing, intrusion detection, and is the co-author of "WRT54G Ultimate Hacking", a book dedicated to hacking Linksys routers.
Thursday May 26
Location - Microsoft Waltham (201 Jones Rd., Sixth Floor Waltham, MA)
Topic - OWASP Top 10 issue #4 – Insecure Direct Object Reference
Presenter - Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels and President of OWASP Boston
Jim Weiler will discuss threat models, risks and various remediations of issue #4 in the 2010 OWASP Top 10 – Insecure Direct Object References.
Topic - A Web-Application Architecture for Regulatory Compliant Cloud Computing
Presenter - Arshad Noor, StrongAuth
The emergence of cloud-computing as an alternative deployment strategy for IT systems presents many opportunities, yet challenges traditional notions of data-security. The fact that data-security regulations are developing teeth, leaves information technology professionals perplexed on how to take advantage of cloud-computing while proving compliance to regulations for protecting sensitive information.
This presentation presents an architecture for building the next generation of web-applications. This architecture allows you to leverage emerging technologies such as cloud-computing, cloud-storage and enterprise key-management (EKM) to derive benefits such as lower costs, faster time-to-market and immense scalability with smaller investments - while proving compliance to PCI-DSS, HIPAA/HITECH and similar data-security regulations.
Arshad Noor is the CTO of StrongAuth, Inc, a Silicon Vally-based company that specializes in enterprise key management. He is the designer and lead-developer of StrongKey, the industry's first open-source Symmetric Key Management System, and the KeyAppliance - the industry's first appliance combining encryption, tokenization, key-management and a cryptographic hardware module at an unprecedented value. He has written many papers and spoken at many forums on the subject of encryption and key-management over the years.
Topic – Secure Application design and Coding -- CANCELLED
Presenter - Josh Abraham, Rapid 7
Ed Adams Security Innovation -- the new OWASP Exams Project and the work being done by the OWASP Academies Working Group
Josh Abraham, Rapid 7
Owning the world, one mobile app at a time, and web services pen testing.
Rob Cheyne, CEO of Safelight Security -
Security Leadership series: Delivering a successful security presentation
Application Architecture Security Assessment - Second session
Rob Cheyne, CEO SafeLight Security Advisors
Open SAMM – Software Assurance Maturity Model
Shakeel Tufail is the Federal Practice Manager at Fortify, an HP company.
Rob Cheyne, CEO SafeLight Security Advisors Overview: In this highly interactive two-part workshop, Rob Cheyne of Safelight Security will show you the basics of conducting a real-world architecture & design review. This workshop draws from Safelight's Security Architecture Fundamentals training course, a two-day course frequently used to teach Fortune 500 companies how to look at their system architectures from both the hacker's and the designer’s point of view.
Lightning Talk – Rob Cheyne, CEO Safelight Security Advisors In this installment of the Safelight lightning talks series, Rob will present the basics of a Cross-site Request Forgery (CSRF).
Main Presentation - Drive-by Pharming with MonkeyFist
Joey Peloquin - Director of Application Security, Fishnet Security
Rob Cheyne Lightning Talk - topic to be announced
Main Presentation - Ryan Barnett The Web Hacking Incident Database (WHID) is a Web Application Security Consortium project dedicated to maintaining a list of web applications related security incidents. Ryan Barnett is director of application security research at Breach Security where he leads Breach Security Labs.
Rob Cheyne Lightning Talk - SQL Injection
Vinnie Liu - Data Exposure, New Approaches to Open Source Intelligence Techniques, and Incident Handling
Dan Hestad Security Innovation Dan will be talking about his experiences with PCI and web applications, and answering questions about do's and don'ts of acceptable PCI practices in web applications.
Zack Lanier - Disclosure Samsara, or "the endless vulnerability disclosure debate"
http://n0where.org/talks/samsara_20100310.pdf (very large PDF)
Rob Cheyne of Safelight Security Advisors; New Technology, Same Old Vulnerabilities
January 2010 at Microsoft NERD, Cambridge
Josh Abraham, Rapid 7 Technologies
Eric Bender, Cenzic
Jim Weiler, Sr. Mgr. Information Security, Starwood Hotels - Web Application Vulnerability Scanners
Mush Hakhinian, Leader, Application Security Practice, IntraLinks - Secure coding with no money down using SONAR: unleashing the power of open-source code analysis tools
Paul Schofield, Senior Security Engineer, Imperva - From Rivals to BFF: WAF & VA Unite
September 2009 at CORE Technologies, Boston
Paul Asadoorian, Pauldotcom.com
Alex Horan, CORE Security
Joey Peloquin, Fishnet Security, Secure SDLC: The Good, the Bad and the Ugly presentation pdf
Sabha Kazerooni, Security Compass - Exploit Me tools; Framework Level Threat Analysis
Meeting Pizza Sponsor - Arcot
Arcot is a leader in online fraud prevention, strong authentication and eDocument security. Arcot's solutions are easily deployed, low-cost and extremely scalable, allowing organizations to transparently protect their users from fraud without changing user behavior or requiring expensive hardware.
Arcot can be contacted thru Michael Kreppein, email@example.com, 617-467-5200
Brian Holyfield, Gothem Digital Science
Tamper Proofing Web Applications http://www.gdssecurity.com/l/b/2008/12/04/
Jeremiah Grossman; Founder and CTO, Whitehat Security
Main Topic - Business Logic Flaws: How they put your Websites at Risk
Chris Eng; Senior Director, Security Research, Veracode
Description – Attacking crypto in web applications
Scott Matsumoto; Principal Consultant, Cigital
Description – You Say Tomayto and I Say Tomahto – Talking to Developers about Application Security
Tom Mulvehill Ounce Labs
Description – Tom will share his knowledge and expertise on implementing security into the software development life cycle. This presentation will cover how to bring practicality into secure software development. Several integration models will be explored as well as solutions for potential obstacles
George Johnson, Principal Software Engineer EMC; CISSP
An Introduction to Threat Modeling.
Day of Worldwide OWASP 1 day conferences on the topic "Privacy in the 21st Century"
Tool Talk - Jim Weiler - WebGoat and Crosssite Request Forgeries
Danny Allan; Director, Security Research, Watchfire
Topic: Exploitation of the OWASP Top 10: Attacks and Strategies
Jeremiah Grossman, CTO Whitehat Security: Top 10 Web Application Hacks of 2006
Dave Low, RSA the Security Division of EMC: encryption case studies
Mike Gavin, Forrester Research: Web Application Firewalls
Imperva - Application and Database Vulnerabilities and Intrusion Prevention
Jim Weiler - Using Paros Proxy Server as a Web Application Vulnerability tool
Dennis Hurst; SPI Dynamics: A study of AJAX Hacking
Jim Weiler; OWASP Boston: Using Paros HTTP proxy, part 1. first meeting with all demos, no powerpoints!
Mateo Meucci; OWASP Italy Anatomy of 2 web attacks
Tom Stracener; Cenzic Web Application Vulnerabilities
Ron Ben Natan; Guardium CTO Database Security: Protecting Identity Information at the Source
David Low, Senior Field Engineer: RSA Practical Encryption
Paul Galwas, Product Manager: nCipher Enigma variations: Key Management controlled
Robert Hurlbut, Independent Consultant Threat Modeling for web applications
Prateek Mishra, Ph.D. Director, Security Standards and Strategy: Oracle Corp Chaiman of the OASIS Security Services (SAML) Technical Committee - Identity Federation : Prospects and Challenges
Ryan Shorter, Sr. System Engineer: Netcontinuum - Application Security Gateways
Dr. Herbert Thompson, Chief Security Strategist: SecurityInnovation - How to Break Software Security
Mark O'Neill, CTO: Vordel - Giving SOAP a REST? A look at the intersection of Web Application Security and Web Services Security
Arian Evans, National Practice Lead, Senior Security Engineer: Fishnet Security Overview of Application Security Tools
Patrick Hynds, CTO: Critical Sites - Passwords - Keys to the Kingdom
Jonathan Levin - Of Random Numbers
Jothy Rosenberg, Founder and CTO: Service Integrity - Web Services Security
Joe Stagner: Microsoft Let's talk about Application Security
Application Security Inc. PowerPoint slides for the Anatomy of a Database Attack.
Boston OWASP Chapter Leaders
- Jim Weiler 781 356 0067
- Mark Arnold
- Yolanda Liu