Revision as of 17:49, 14 May 2011 by MichaelCoates (talk | contribs)

Jump to: navigation, search

Michael Coates


Contact at : Michael.Coates [at]



OWASP Involvement

AppSensor - Project Lead, project started Summer of Code 2008

Global_Membership_Committee - Member since committee inception November, 2008

OWASP Top 10 2010 - Recognized Contributor

OWASP Transport Layer Protection Cheat Sheet - Author

Wiki Contributions


Michael Coates has extensive experience in application security, security code review and penetration assessments. He has conducted numerous security assessments for financial, enterprise and cellular customers worldwide. Michael holds a master's degree in Computer Security from DePaul University and a bachelor's degree in Computer Science from the University of Illinois.

Michael is the creator and leader of the AppSensor project and a contributor to the 2010 OWASP Top 10. He is a frequent speaker at OWASP security conferences in the US and Europe and has also spoken at the Chicago Thotcon conference and provided security training at BlackHat.

As the web security lead at Mozilla, Michael protects web applications used by millions of users each day.

OWASP Events

Speaker at following OWASP conferences/events:

  • OWASP Minneapolis Chapter, 2011
  • OWASP San Antonio Chapter, 2011
  • OWASP World Summit - Portugal, 2011
  • OWASP AppSec USA California, 2010
  • OWASP Northern Virginia Chapter, 2010
  • OWASP Chicago Chapter, 2009
  • OWASP AppSec EU Poland, 2009
  • OWASP World Summit - Portugal, 2008

Full conference speaking history here

A bit more about me

Security is what I do. Like many of us in the security industry, this is more than just a means of employment, it's a hobby and a passion. Throughout my professional career I've had the opportunity to assess and secure a wide variety of systems. Straight out of college my career started in the risk division of a CPA firm. With a focus on financial institutions, our security team performed traditional no knowledge black box penetration assessments, internal network assessments, and even social engineering. Some of my best security stories involve the stories and persona I invented in order to talk my way into the bank's vault or server room (all part of the approved engagement of course).

My next opportunity led me to a major telecommunication and mobile company. I had the opportunity to work in the security operations center for a period of time where I gain an eye opening experience being on the "other side of the fence". Tasked with defending and investing attacks on a network of 150K seats, there was never a dull moment. I also had the opportunity to transition into the consulting division where I performed secure architecture design review on mobile and telecommunications networks. Another great security story involved an assessment where, with just a tethered cell phone and an international data connection, I was able to gain full control of the data service for the targeted mobile provider in Asia.

I was fortunate enough to land a spot in a top-notch application security consulting firm. With this company I was able to focus every day on threat modeling, code review and web application penetration assessments for the most critical applications in the world. From working on major financial systems to voting devices, I had a chance to really see it all.

Today I work at Mozilla, a company of less then 500 people with a massive footprint with over 450 million users. Here I'm responsible for the security of all of our web applications. This includes threat modeling, secure design, training, testing and continual security maintenance. Security can be tough, and perhaps one of the most interesting challenges is designing security solutions that scale and are usable to such a massive number of people.