Contact at : Michael.Coates [at] owasp.org
AppSensor - Project Lead, project started Summer of Code 2008
Global_Membership_Committee - Member since committee inception November, 2008
OWASP Top 10 2010 - Recognized Contributor
Michael Coates has extensive experience in application security, security code review and penetration assessments. He has conducted numerous security assessments for financial, enterprise and cellular customers worldwide. Michael holds a master's degree in Computer Security from DePaul University and a bachelor's degree in Computer Science from the University of Illinois.
Michael is the creator and leader of the AppSensor project and a contributor to the 2010 OWASP Top 10. He is a frequent speaker at OWASP security conferences in the US and Europe and has also spoken at the Chicago Thotcon conference and provided security training at BlackHat.
As the web security lead at Mozilla, Michael protects web applications used by millions of users each day.
Speaker at following OWASP conferences/events:
- OWASP Minneapolis Chapter, 2011
- OWASP San Antonio Chapter, 2011
- OWASP World Summit - Portugal, 2011
- OWASP AppSec USA California, 2010
- OWASP Northern Virginia Chapter, 2010
- OWASP Chicago Chapter, 2009
- OWASP AppSec EU Poland, 2009
- OWASP World Summit - Portugal, 2008
Full conference speaking history here
A bit more about me
Today I work at Mozilla, a company of less then 500 people with a massive footprint with over 450 million users. Here I'm responsible for the security of all of our web applications. This includes threat modeling, secure design, training, testing and continual security maintenance. Security can be tough, and perhaps one of the most interesting challenges is designing security solutions that scale and are usable to such a massive number of people.
Security is what I do. Like many of us in the security industry, this is more than just a means of employment, it's a hobby and a passion. Throughout my professional career I've had the opportunity to assess and secure a wide variety of systems. Straight out of college my career started in the risk division of a CPA firm. With a focus on financial institutions, our security team performed traditional no knowledge black box penetration assessments, internal network assessments, and even social engineering. Some of my best security stories involve the stories and persona I invented in order to talk my way into the bank's vault or server room (all part of the approved engagement of course).
My next opportunity led me to a major telecommunication and mobile company. I had the opportunity to work in the security operations center for a period of time where I gain an eye opening experience being on the "other side of the fence". Tasked with defending and investing attacks on a network of 150K seats, there was never a dull moment. I also had the opportunity to transition into the consulting division where I performed secure architecture design review on mobile and telecommunications networks. Another great security story involved an assessment where, with just a tethered cell phone and an international data connection, I was able to gain full control of the data service for the targeted mobile provider in Asia.
I was fortunate enough to land a spot in a top-notch application security consulting firm. With this company I was able to focus every day on threat modeling, code review and web application penetration assessments for the most critical applications in the world. From working on major financial systems to voting devices, I had a chance to really see it all.
Don't get me wrong, the deep dive into the technical items is great. I've done it for years. But the key has been bringing that up to overall risk to the business. Managing risk is the driving factor for everyone that we end up doing.