Open Web Application Security Project

Planning on attending Black Hat USA this year? Are you a member of OWASP?

2013-05-22T12:13:00.001-07:00

If you answered "yes" to both of these questions and would like to save 15% off on your registration fee please use discount code KobrLQ55.

OWASP Connector May 21, 2013

2013-05-21T17:26:00.000-07:00

OWASP Connector May 21, 2013

MAY FEATURED OWASP PROJECT

OWASP Mobile Security Project

The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications. The primary goal of this project is to classify mobile security risks, and provide developmental controls to reduce their impact our likelihood of exploitation.

The primary focus is at the application layer. While consideration is taken into the underlying mobile platform and carrier inherent risks when threat modeling and building controls, we are targeting the areas where the average developer can make a difference. Additionally, focus is placed not only on the mobile applications deployed to end user devices, but also on the broader server-side infrastructure which the mobile apps communicate with. Focus is heavily aimed towards the integration between the mobile application, remote authentication services, and cloud platform-specific features.

NEW OWASP PROJECTS

OWASP Good Component Practices Project
Project Leader: Mark Miller

Good Component Practice is one of the most overlooked silver bullets in the Open Source arsenal. Due to business pressure, we have found that companies are willing to risk using unverified open source components, trading off security for enhanced speed in development.

This project will use community input to document an industry acceptable process for the creation, maintenance, and use of open source components.

OWASP Bywaf Project
Project Leader: Rafael Gil Larios

The aim of this project is to develop an application that makes the work of an auditor much easier when conducting a Pen Test. The application's principal functions are to detect, evade, and give a vulnerability result utilizing known SQL injection, and other methods developed by professionals within the industry.

PROJECT ANNOUNCEMENTS

2013 Mobile Top 10 Call For Data

We are pleased to announce the 2013 call for data to help refresh the Mobile Top 10 Risks for 2013 and publish a more formal document. We are encouraging everyone to get involved. Right now we are looking for data that represents the current state of mobile application security. We are soliciting not just vulnerability data, but also incident and attack data that reflects the real-world prevalence and significance of these issues. The goal in requiring both is to rank risks accordingly based on data as opposed to making assumptions. We will use this data to flesh out and re-evaluate the currently incomplete Mobile Top Ten Project.

If you would like to et involved, please visit the OWASP Mobile Security Project wiki page. Please direct any questions or concerns to the Top 10 Refresh leaders, Jason Haddix, Jack Mannino, and Mike Zusman.

Do you want to host an event or propose OWASP involvement in an outreach event? Submit your event through the OWASP Conference Management System (OCMS)

Thank you to MStar Semiconductor, Inc, our newest Corporate Member

Thank you to AsTech Consulting for their Corporate Membership Renewal

GET READY FOR THE 2013 SUMMER

Cool Prizes
New Membership Levels
Become a LIFETIME Member
Click the icon for all the details

Apply for an Honorary Membership

Get the Details and the Link to the form

AppSec Research 2013

4th COUNTDOWN CHALLENGE RELEASED

There will be a challenge posted on the conference wiki page every month up until the event in August. The winner of each challenge will get FREE entrance to the conference (a €420 value). Be sure to sign up for the conference mailing list to get a monthly reminder.
CLICK HERE to access this challenge
Complete instructions on this challenge

OWASP is pleased to announce our upcoming Partner Events:

ICCS 2013 James R. Clapper, the Director of National Intelligence, will be the opening keynote speaker for the conference.

Blackhat 2013 (15% discount promo code for OWASP members is: KobrLQ44 - case sensitive)

EC Council - Use discount code TDCSTLOWASP for $99 conference passes

OWASP Foundation

www.owasp.org

Contact Us

OWASP Blog

Do you have some news? Submit your item to appear in the next connector HERE

MAY 23 GLOBAL WEBINARS SCHEDULED

TOPIC: Unraveling the mysteries of the OWASP WIKI

Have you ever wondered how to find something on the wiki? Where are the projects? How do i volunteer? How, and more importantly - Why, do I become a Member? Join us for this webinar where the Ops team will walk through some of they mysterious links on the OWASP.org website.

May 23, 2013 at 10am EDT

May 23, 2013 at 9pm EDT
(GMT -5)

Links to the recordings of previous meetings can be found on the Initiatives Page

To review All of the opportunities, Visit the Initiaives page

OWASP Global Board Elections

The call for candidates is OPEN!

2013 WASPY (Web Application Security People of the Year) Awards

It's time to submit your nominations for the 2013 WASPY (Web Application Security People of the Year) Awards!
This year's awards will recognize our community's best in 5 different OWASP related category:

Best Chapter Leader

Best Project Leader

Best community supporter - contributor to chapter, project or initiative

Best Mission Outreach - grow the OWASP community

Best Innovator - willingness to try new ideas

Kate Hartmann

kate.hartmann@owasp.org

+1 301-275-9403

2013 OWASP Mobile Top 10 Call For Data

2013-05-20T23:11:00.001-07:00

Hello All,

We are pleased to announce the 2013 call for data to help refresh the Mobile Top 10 Risks for 2013 and publish a more formal publication. We are encouraging everyone to get involved.

The current Mobile Top Ten Risks are located here:

https://www.owasp.org/index.php/OWASP_Mobile_Security_Project#tab.3DTop_Ten_Mobile_Risks

What do we need?

Right now we are looking for data that represents the current state of mobile application security. We are soliciting not just vulnerability data, but also incident and attack data that reflects the real-world prevalence and significance of these issues. The goal in requiring both is to rank risks accordingly based on data as opposed to making assumptions. We will use this data to flesh out and re-evaluate the currently incomplete Mobile Top Ten Project.

How can you contribute?

Contributing data is easy. All we require is anonymized statistics on the vulnerabilities you’ve seen in 2012-Present. If you have data on real-world incidents and attacks to share, these will be of great value as well as they will allow real-world impact to be better assessed. This can be just aggregate percentages, no need to tell us how many apps you’re doing if you’re not comfortable with that. Something like the below:

Issue: Something related to geolocation
Percentage Affected: X%
Number Affected: Y (only if you are comfortable with this)
Brief Description: This is a problem because xyz and also, bad things.

The data you submit does not necessarily have to reflect the current Top 10, it has to reflect what you are observing in the applications you analyze. At the same time, we would certainly love feedback on what you believe is correct or incorrect about the current list.

What happens next?

After a 60 day period we will review all submissions and re-draft the Mobile Top Ten based on the prevalence and impact of data provided by participants. After the submission period ends, there will be follow-on discussions and work to analyze the data. Participation in this initiative may require up to 10 hours of efforts per week, so please take this into consideration before signing up.

Spread the word. Make a difference.

Also, any help spreading the word on the Mobile Security Project is immensely helpful. A Tweet/Facebook/Linkedin post, blog entry, etc. This initiative will fail if people don't know about it. Anyone that you can promote this initiative to will help the cause.

We thank all of you in advance for your participation and hard work in making this initiative a success. Your participation will be noted and recorded when compiling the list of contributors for the final release of the Mobile Top 10 Risks documentation.

Get in touch and get involved.

Please direct any questions or concerns to the Top 10 Refresh leaders, Jason Haddix (jason.haddix@owasp.org), Jack Mannino (jack.mannino@owasp.org), and Mike Zusman (mike.zusman@owasp.org).

We will be using a Google Group to collaborate on the Top 10 refresh: https://groups.google.com/a/owasp.org/forum/?hl=en&fromgroups#!forum/owasp-mobile-top-10-risks

The OWASP Mobile Security project’s mailing list is also another way to get in touch with other contributors (owasp-mobile-security-project@lists.owasp.org).

2013 Board Election Call For Candidates & Honorary Membership

2013-05-15T08:59:00.001-07:00

On behalf of the OWASP Foundation, I am happy to announce the 2013 OWASP Foundation Call for Board Candidates. This year there are three board seats open for election. We are now accepting Call for Candidates and Honorary Membership requests.

Individuals that are interested in running for the board are strongly encourage to read the International Board of Directors Primary Responsibilities as well as the Eligibility Requirements for Board Candidates before submitting your Candidate Submission form. All candidates interested in running must be declared by August 16.

Honorary Membership is available for active project and active chapter leaders with their leadership positions on file prior to September 30. **ALL qualified individuals who wish to be granted Honorary Membership MUST apply for Honorary Membership in order to vote in this years election.** Deadline to submit your self nomination form for Honorary Membership is September 30.

For more information on this years Board Election including the Election Timeline, Call for Candidates form and the Honorary Membership form please see http://owasp.com/index.php/2013_Board_Elections.

AppSecUSA $445 before May 15th

2013-05-08T22:26:00.001-07:00

Early Bird Special: AppSecUSA 2013 NYC

Pardon the interruption, we wanted to save you $500 before May 15th

In the city that never sleeps (NYC), what could possibly happen when you have over 2500 Builders, Breakers and Defenders from around the world get together? Collaboration that drives innovation and a recipe for another high energy cyber security conference not to be missed!

This year, located in the heart of New York in Time Square, at the Marriott Marquis, November 18th - 21st you will experience

* Briefings from industry experts on topics you care about
* Evolve OWASP projects at working sessions LIVE
* Meet hundreds of OWASP core contributors and project users
* Learn new skills from two-day hard core training classes.

If you have always wanted to see New York City this is your "ticket" -- bring the family or bring your team!

Additional activities
-----------------------------
* "Gringo WebHacker" in the Lockpick Village
* 5k NYC Run
* WIN the Capture the Flag for this years bragging rights and cash prizes!
* CareerFair
* Broadway Shows -- Helicopter Rides we have been hard at work!

....... and much much more we're just getting started!

Register BEFORE May 15th and get your 2-day all access badge for only $445.00 a saving of $500

FULL DETAILS ONLINE AT: http://www.appsecusa.org

=======

Not able to attend the full event but want to learn whats new from the sponsors or attend the CareerFair no problem OWASP has you covered - register now using the event code of: NYCOWASP! (A $50 value) and receive a limited access badge to the TechExpo, CareerFair and the Capture the Flag competition

Interested in being a sponsor and reaching key technical influencers and decision makers? Opportunities are available act today space is limited:http://appsecusa.org/2013/sponsors/become-a-sponsor/

========

The Open Web Application Security Project (OWASP) is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of software. Our mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. You'll find everything about OWASP online at http://www.owasp.org

OWASP does not endorse or recommend commercial products or services, allowing our community to remain vendor neutral with the collective wisdom of the best minds in software security worldwide

OWASP Connector May 7, 2013

2013-05-07T19:01:00.000-07:00

OWASP Connector May 7, 2013

NEW OWASP PROJECTS

OWASP Scytale Project - Project Leader: Maxime Labelle - Scytale is a database encryption proxy for modern DBMS and applications. It supports multi-recipient, group encryption, and comes loaded with a strong RSA/AES crypto-system. Scytale sits between your application and your favorite DBMS, adding automatic transparent encryption and decryption for your application's data at the table-level. Scytale stores the encrypted data inside your preferred DBMS for storage.

OWASP iMAS - iOS Mobile Application Security Project - Project Leader: Gregg Ganley. iMAS - iOS is a secure application framework that reduces iOS application vulnerabilities and information loss. iMAS has its first open source static security controls for download and use in iOS applications. Visit and browse our project to find out more. Download it, and give it a try. Once you do, tell us what you think, or better yet, get involved and participate!

PROJECT ANNOUNCEMENTS

Technical Project Advisors Wanted - OWASP is currently recruiting 6 volunteers that will assist with technical project advisor duties for our OWASP Global Projects. This is an excellent opportunity to be a part of an advisory group that aims to support the technical strategic direction of our global projects. The Project Advisors should have experience with the technical area of our projects that they are applying to, and be able to contribute at least 5 hours per month to our global project initiatives. Please apply to let us know of your interest HERE

Thank you to IMPERVA for renewing their membership:

CONGRATULATIONS!!!!!

Andrew van der Stock has been selected as a finalist in the category of AusCERT's award for Individual Excellence in Information Security, as part of the 2013 AusCert Awards! This award is presented to the individual who has provided a great contribution to information security in terms of their work in the areas of community service, innovation, education, liaison, law enforcement, governance or leadership. Andrew is the Project Leader of the OWASP Development Guide Project, and has contributed to many other projects over the years. Please join us in congratulating Andrew for his nomination and wishing him the best of luck at the awards ceremony later this month!

AppSec USA 2013 will be OWASP's biggest event and fundraiser ever! Join 2000+ attendees for over 50 sessions across 3 tracks to learn about the latest and greatest in software security in the heart of NYC.

Visit http://appsecusa.org to register for the event and save on your early hotel reservation. This is an extraordinary rate to experience an amazing OWASP and NYC event.

In addition to the conference talks, you will have opportunities to practice lockpicking, compete in the CTF, discuss OWASP Projects, look for a new career opportunity, and shop around with all the latest and greatest security vendors.

Sponsors: Sign up by May 15th to be included in pre-conference literature!

Sponsor Information

AppSec Research 2013

Program Details and Registration Coming Soon!
visit https://appsec.eu for details or Follow us on Twitter to get all the latest news and announcements!

Information on the University Challenge for the AppSec EU 2013 can be found HERE

UPCOMING PARTNER EVENTS:

OWASP is pleased to announce our upcoming Partner Events:

ICCS 2013

Blackhat 2013 (15% discount promo code for OWASP members is: KobrLQ44 - case sensitive)

OWASP Hacking-Lab Project will be releasing a new challenge soon! Be sure to check out the Project Page and get ready for a new event containing the OWASP WebGoat Challenges!

OWASP Foundation

www.owasp.org

Contact Us

OWASP Blog

Do you have some news? Submit your item to appear in the next connector HERE

MAY 9th GLOBAL WEBINARS SCHEDULED

TOPIC: WASPY awards and 2013 Global Board Election

May 9, 2013 at 10am EDT

May 9, 2013 at 9pm EDT
(GMT -5)

Links to the recordings of previous meetings can be found on the Initiatives Page

To review All of the opportunities, Visit the Initiaives page

It's time to submit your nominations for the 2013 WASPY (Web Application Security People of the Year) Awards!
This year's awards will recognize our community's best in 5 different OWASP related category:

Best Chapter Leader

Best Project Leader

Best community supporter - contributor to chapter, project or initiative

Best Mission Outreach - grow the OWASP community

Best Innovator - willingness to try new ideas

NOMINATIONS ARE OPEN
CLICK HERE TO ACCESS THE FORM!

OWASP would like to thank
for stepping up to be a Platinum Sponsor for these awards in 2013! Additional sponsorship opportunities are available Here

OWASP Global Board Elections

The call for candidates is OPEN!

Additional information on the time line and the process for participation in the Global Elections will be outlined during Thursday's Webinar, so be sure to sign up!

Do you want to host an event or propose OWASP involvement in an outreach event? Submit your event through the OWASP Conference Management System (OCMS)

Kate Hartmann

kate.hartmann@owasp.org

+1 301-275-9403

OWASP Connector April 23, 2013

2013-04-26T09:48:00.001-07:00

OWASP Connector April 23, 2013

NEW OWASP PROJECTS

OWASP Web Application Security Quick Reference Guide Project - Project Leader: Marek Zmyslowski - This will be a simple checklist for Web Application. The unique feature of this project is that all checks will be simple and can be checked by particular testcase. It is simple but can be very informative and useful for testers and coders.

OWASP Application Fuzzing Framework Project - Project Leader: Marek Zmyslowski. The framework will be used to fuzz applications in the Windows environment. It will have a couple of modules. Two main modules will be for ile fuzzing and dll fuzzing. A very wide configuration will allow for many fuzzing possibilities.

OWASP Security JDIs Project - Project Leader: Edwin Aldridge. This project aims to build a library of concise, actionable, technology specific instructions detailing good practice on avoiding or closing specific vulnerabilities. This will be a Security HOWTOs for people who may not have time to study a problem in depth but need to secure their application.

OWASP Top 10 Fuer Entwickler - Project Leader: Torsten Gigler The Top 10 Fuer Entwickler (Top 10 Developer Edition in German) The objectives of the project is to add Good Practices (like the Cheat Sheets) to the OWASP Top 10. Its aim is to bridge the gap between awareness and theoretical knowledge, to effective know-how for the purpose of building good programs. It is written in German to amke it easier for German developers to use it. We will take care to make a migration to other languages easy.

OWASP Rails Goat Project - Project Leader: Ken Johnson This is a Rails application which is vulnerable to the OWASP Top 10. It is intended to show how each of these categories of vulnerabilities can manifest themselves in a Rails-specific way as well as provide the subsequent mitigations for each.

PROJECT ANNOUNCEMENTS

OWASP Code Review Table of Contents is now live!
We are currently still recruiting authors that can assist with section development, writing, and editing of the Code Review Guide. This is an excellent opportunity to work on a high profile OWASP Flagship project. Applicants are encouraged to choose to contribute to either a section or the entire chapter. Authors should be knowledgeable about the sections they choose. For more information on the OWASP Code Review Guide, please visit the Project Webpage.

Thank you to the following Companies who have renewed their memberships:

Booz Allen Hamilton
Checkmarx
Nokia
Protviti

OWASP Foundation

www.owasp.org

Contact Us

OWASP Blog

Do you have some news? Submit your item to appear in the next connector HERE

AppSec USA 2013 will be OWASP's biggest event and fundraiser ever! Join 2000+ attendees for over 50 sessions across 3 tracks to learn about the latest and greatest in software security in the heart of NYC.

Register now and save 50%

The first 200 tickets are available until May 15th for the low price of $445. Visit http://appsecusa.org to register for the event and save on your early hotel reservation. this is an extraordinary rate to experience an amazing OWASP and NYC event. In addition to the conference talks, you will have opportunities to practice lockpicking, compete in the CTF, discuss OWASP Projects, look for a new career opportunity, and shop around with all the latest and greatest security vendors.

Want to share your knowledge with the world?

Call for Training and Call for Papers is now open! Learn more about our selection committee and submit your proposals at http://appsecusa.org

AppSec Research 2013

Call for research papers - deadline may 15th- https://appsec.eu/call-for-papers/

Two Day Trainings

Shannon Ross, Dave Wichers: Securing Mobile Devices and Applications
Christian Bockermann: Tactical Defense with ModSecurity
Hemil Shah: Mobile Application Hacking and Security — OWASP Top 10 Way

One Day Training, Tuesday, August 20th

Jim Manico: Web Application, Web Service and Mobile Secure Coding
Frederik Weidemann: SAP ABAP Penetration Testing
Tiago Teles: Defensive Programming for JavaScript & HTML5

One Day Training, Wednesday, August 21st

Paco Hope: Defensive Programming in PHP
Christian Schneider: Java Web Hacking & Hardening
Tobias Gondrom: CISO training – Managing Web & Application Security – OWASP for senior managers

Looking for sponsors!

Registration opening soon - visit appseceu.org for details

UPCOMING PARTNER EVENTS:

OWASP is pleased to announce our upcoming Partner Events:

Central Ohio ISSA Infosec Summit (Columbus, Ohio) May 2, 2013 - May 3, 2013

BSides Boston (Cambridge, MA) May 18, 2013
EC Council (Multiple Locations and Dates)

MARCH 28th GLOBAL WEBINARS SCHEDULED
Topic:
Presentation by Design Foundry and Sisterworks to review the OWASP Marketing Plan - Phase II

April 25, 2013 at 10am EDT

April 25, 2013 at 9pm EDT
(GMT -5)

May 9, 2013 Webinar topic:
the 2013 WASPY awards and the 2013 Global Election
Register for the 10:00am webinar
Register for the 9:00pm webinar
Links to the recordings of previous meetings can be found on the Initiatives Page

There are currently initiative opportunities

To review All of the opportunities, Visit the Initiaives page

START YOUR OWN INITIATIVE

The world celebrates volunteers!

The OWASP Foundation would not exist without the thousands of volunteers who donate their time, talent, and treasure to support our mission! We join with countries around the world to recognize and say thank you to our many volunteers

National Volunteer week USA: April 21-27

National Volunteer week Canada: April 21-27

National Volunteer week Australia: May 13-19

Do you want to host an event or propose OWASP involvement in an outreach event? Submit your event through the OWASP Conference Management System (OCMS)

OWASP's New Executive Director

2013-04-12T10:02:00.001-07:00

The OWASP Board is proud to announce OWASP’s new Executive Director, Sarah Baso.

The OWASP board had many different directions to consider for which type of candidate would be best suited for the new executive director role. Ultimately we felt that an individual with a passion for OWASP, demonstrated excellence, strong leadership and a desire for the mission and community was the best choice. To take OWASP to the next level we need an individual that can execute, seek out new opportunities for OWASP to grow and strategically leverage our resources. The fit for this role was one someone we already knew and trusted

Sarah has been part of the OWASP operations team for the past two and a half years. She has played a pivotal role in coordinating global AppSec conferences, worked within the Global Industry, Chapter, and Conference Committees, and also was part of the 2011 Global Summit planning team. Sarah's educational background includes a Juris Doctor degree in law and she leverages this knowledge in many ways working for OWASP including contract negotiation and risk assessment.

Prior to joining OWASP, Sarah worked as a practicing attorney, focusing on electronic discovery in large class action lawsuits. She also has worked as a volunteer English and computer skills teacher for English language learners assimilating into the United States.

--
Michael Coates
OWASP Board

OWASP Creates Executive Director Position

2013-04-08T16:00:00.002-07:00

OWASP is driven by volunteers and the contributions of thousands all over the world. Behind the scenes there is also a group of dedicated paid staff that focus on critical operations to ensure the OWASP engine keeps running strong. This team has grown organically over the years as OWASP has recognized the need for dedicated full time individuals to focus on specific task items. In each of these areas we've seen great successes from our staff.

As OWASP continues to grow we must also ensure our structure and supporting operations team grows too. The next step in that growth is the creation of the OWASP Executive Director role. The individual in this role will lead the focus and resourcing of our operations team to ensure we execute on our strategic goals each year. This individual will ultimately be responsible for leading the operations team to success and will report directly to the OWASP board. This role will maximize the value our operations team provides to our community, projects and the world.

This is an exciting step forward for OWASP and a demonstration of the continued growth of our community.

--
Michael Coates
OWASP Board

2013-04-01T10:04:00.001-07:00

Call for Papers, Trainers & Early Bird Tickets

Visit: www.appsecusa.org

http://owasp.com/images/8/87/OWASP_Membership_Flyer_2013_NEW_Updated.pdf

OWASP Connector March 26, 2013

2013-03-26T15:36:00.000-07:00

OWASP Connector March 26, 2013

NEW OWASP PROJECTS

OWASP Droid Fusion - Droid Fusion is a platform for android mobile for doing malware analysis, development, application pen-testing, and forensics. You can use it in any mobile security research, and if you have Droid Fusion, you don't need to worry about finding tools. There are more than 60 tools and scripts and it is free.

OWASP iSABEL Proxy Server - The idea of the OWASP iSABEL Proxy Server Project is to gain a deeper knowledge about securing web applications from different threats and attacks coming from external sources. This can be achieved by developing intermediary software that runs between the client and the server. This intermediary software will be based on a proxy server that will be implemented on layer 7 (Application) of the OSE model (Open Systems Interconnection), and its function is to accept network traffic from different client's trying to access resources from the web server. Once the client successfully established a connection, the proxy will inspect all incoming network packets coming from the clients for malicious parameter, and files such as viruses, worms, trojans.

PROJECT ANNOUNCEMENTS

Authors Needed for the OWASP Code Review Guide!
We are currently recruiting authors that can assist with section development, writing, and editing of the Code Review Guide. This is an excellent opportunity to work on a high profile OWASP Flagship project. Applicants are encouraged to choose either a section or the entire chapter to contribute to. Authors should be knowledgable about the sections they choose. For more information on the OWASP Code Review Guide, Please visit the Project Webpage.

Mohammed Aldoub, the OWASP Kuwait Chapter Leader, is representing OWASP at the 2013 Cyber Security Summit in Prague. He will be speaking about mitigations that system administrations can use to patch up and secure their systems. The talk will focus on open source tools, especially OWASP Projects, such as the OWASP ModSecurity CRS. His talk is scheduled on the 11th of April. To learn more about Mohammed's talk, please visit the Cyber Security Summit Website.

CISO SURVEY STILL OPEN

Are you a CISO or an Information Security Manager?
If YES, please take a few moments to complete the Industry CISO Survey!

Pass the invitation on to your contacts:

OWASP Foundation

www.owasp.org

Contact Us

OWASP Blog

Do you have some news? Submit your item to appear in the next connector HERE

Thank you to the following Companies who have renewed their memberships:

HP

IBM

AppSec Research 2013

The deadline for the Call For Papers is approaching: This is your opportunity to present your research, findings, or best practices to an audience of over 400 international developers, software security professionals, and managers. Sponsorship opportunities are still available as well.

CALL FOR PAPERS
SPONSORSHIP INFORMATION

UPCOMING PARTNER EVENTS:

OWASP is pleased to announce our upcoming Partner Events:

HITB Amsterdam 2013 (Amsterdam, Netherlands) April 10-11, 2013

2013 Cyber Security Summit (Prague, Czech Republic) - April 11-12, 2013

Information Security Summit (Warrensville Heights, OH) - April 17-18, 2013

BSides Boston (Cambridge, MA) May 18, 2013

National Collegiate Cyber Defense Competition (San Antonio, TX) - April 19-20, 2013

Do you want to host an event or propose OWASP involvement in an outreach event? Submit your event through the OWASP Conference Management System (OCMS)

ATTENTION EUROPEAN CHAPTER LEADERS!

Following the success of the LATAM TOUR, 2013 OWASP will be initiating and promoting a similar tour across European chapters. To participate in this EUROPEAN tour, please join us for a webinar on April 2 at 9am EDT to outline the details including dates, sponsorships, content, and training

OWASP Social Media

Linkedin

Twitter

Google +

Facebook

NING

StackOverFlow

Did you know that your individual, paid OWASP membership ...

directly support our local chapters and our projects
gets you a significant discount at all OWASP events
entitles you to partner event discounts several times each year
gives you a voice in the OWASP Global Elections
entitles you to communicate professionally via an owasp.org email address
can be a matching donation allocation through your US employer

MARCH 28th GLOBAL WEBINARS SCHEDULED
Topic:
OWASP Chapters:
If you are a current chapter leader, have been considering becoming a chapter leader, or if you have any great suggestions for how OWASP Chapters and Chapter Leaders can collaborate Globally to support the OWASP Mission, please plan on attending
MARCH 28, 2013 at 10am EDT

MARCH 28, 2013 at 9pm EDT
(GMT -5)

Links to the recordings of previous meetings can be found on the Initiatives Page

The process works well - so don't hesitate to submit your request for assistance

There are currently 16 NEW initiative opportunities

To review All of the opportunities, Visit the Initiaives page

A couple of Highlights are:

Foundation Advisory Board of Critical Infrastructure Organizations

WASPY Awards

Membership Drive

International Podcast Series

Implementation of Badges

START YOUR OWN INITIATIVE

A Message from Tom Brennan, Global Board Member and Chapter Leader

As we complete Q1, 2013 I wanted to shine a light on the over 200 active chatpers in the US, Canada, Latin America, Europe, Asia Pacific, Middle East, and Africa and say,
Thank you!!!
Your active volunteerism with local chapters is a core community aspect of the OWASP Foundation. Many other fine professional associations are available for you to invest your time in, however you have selected the OWASP Community.

As an active chapter leader, OWASP expects that you have read the current chapter leader handbook.

This announcement is a formal request to pull together those experienced and new chapter leaders as well as your members to contribute to the 3.0 version of the best practices and requirements that will govern local chapters

Sign up to participate in this task force

OWASP at Black Hat EU 2013

2013-03-18T11:08:00.001-07:00

OWASP was well represented in Amsterdam this past week at Black Hat EU. Members from the UK, Portugal, and from across the Netherlands volunteered their time at the conference. We would also like to thank the OWASP Netherlands Chapter for inviting our volunteers to the local chapter meeting, and we would like to extend a special thanks to Colin Watson and Georgia Weidman for speaking that evening. We would also like to thank Martin Knobloch, Anil Pazwant, and Dennis Groves for managing our booth at Black Hat. To view more of our event images, please visit the OWASP Flickr page.

OWASP Connector March 6, 2013

2013-03-07T08:16:00.000-08:00

OWASP Connector March 6, 2013

NEW OWASP PROJECTS

OWASP Scada Security Project - The primary aim of OWASP SCADA Security project is to gather information about different ICS/SCADA security threats related to WEB-applications and their environments, starting from econnaissance ("footprinting") stage to vulnerabilities exploitation.

PROJECT ANNOUNCEMENTS

OWASP Periodic Table of Vulnerabilities Project: Working Group Forming
A working group is now forming under the leadership of James Landis to produce the 1.0 draft of the OWASP Periodic Table of Vulnerabilities.
The goal of this project is to identify the ideal solution target for known web application vulnerability classes as a first step toward eliminating many classes of vulnerabilities altogether. If you would like to have a hand in shaping the future of web application technologies toward solving vulnerabilities like cross-site scripting and SQL injection forever, your contributions would be greatly appreciated! Click here to sign up for this task force.

OWASP iGoat Project V.w.0 Released!
The OWASP iGoat tool is a stand-alone iOS app (distributed solely in source code) designed to introduce iOS developers to many of the security pitfalls that plague poorly-written apps. Like it's namesake, OWASP's WebGoat tool, iGoat is intended to teach software developers about these issues by stepping them through a series of exercises, each of which focuses on a single aspect of iOS security
OWASP iGoat is an ideal tool to use in a classroom setting to teach iOS developers (and technically minded IT Security staff with at least some exposure to object oriented programming). We invite the OWASP community to download and try iGoat, and we welcome your suggestions for improvements. We're always looking for willing participants to contribute to the project as well!
DOWNLOAD OWASP iGOAT 2.0

CISO SURVEY LAUNCHED

Are you a CISO or an Information Security Manager?
If YES, then we need your participation in this indursty survey that will report current trends in Application and Information Security, provide new insights across industries, and help OWASP align our projects for maximum impact for the end user and developer community.

Pass the invitation on to your contacts:

OWASP Foundation

www.owasp.org

Contact Us

OWASP Blog

Do you have some news? Submit your item to appear in the next connector HERE

UPCOMING EVENTS:

Front Range OWASP Conference (SnowFroc)

The Colorado OWASP chapters are proud to present the 5th annual SnowFroc. Join 300 other developers, business owners, and security professionals for a day-and-a-half of presentations, training and Birds-of-a-Feather (BoaF) sessions.

The conference will begin on Thursday, March 28th and will feature four primary tracks:

High-Level Technical

Deep-Dive/Hands-on Technical

Management

Legal

Additional activities include a CTF competition, a moderated panel discussion featuring top industry leaders, and a FREE (yes, FREE) secure coding course

REGISTER NOW TO RESERVE YOUR SEAT

UPCOMING PARTNER EVENTS:

Cloud Matters (Alberta, Canada) March 11-12, 2013
BlackHat EU (Amsterdam, Netherlands) - April 10-11, 2013
HITB Amsterdam 2013 (Amsterdam, Netherlands) April 10-11, 2013
2013 Cyber Security Summit (Prague, Czech Republic) - April 11-12, 2013
Security B-Sides, Orlando (Orlando, Florida, USA) - April 13-14, 2013

Just a reminder to mark you calendar for the 2013 North American AppSec Conference in New York City November 18th-21st at the Marriott Marquis in the heart of Times Square. We have a fantastic event shaping up and sponsorships are selling fast. If you are interested in sponsoring, please complete this request for information

Do you want to host an event or propose OWASP involvement in an outreach event? Submit your event through the OWASP Conference Management System (OCMS)

The 2013 LATAM Tour is scheduled for training and plenary sessions visiting 9 different chapters in the Region!

A EUROPEAN Tour is being planned for the end of May - Stay tuned for More Information on that - If your chapter would be interested in participating in this tour LET US KNOW
OWASP Social Media

Linkedin

Twitter

Google +

Facebook

NING

StackOverFlow

MARCH GLOBAL WEBINARS SCHEDULED
Topic:
OWASP Marketing Initiative
Sisterworks Publishing will be presenting their phase one research on OWASP background material to be used in marketing and brand strategy for the organization
MARCH 14, 2013 at 9am EST
Please Note the 9am time change for this call
(GMT -5)

MARCH 14, 2013 at 9pm EST
(GMT -5)

Links to the recordings of previous meetings can be found on the Initiatives Page

The Number of Individual, Unique Volunteers who have signed up for a posted Initiative is now over 250!

This is what volunteers have signed up for!

The process works well - so don't hesitate to submit your request for assistance

Thank you to the following Companies who have renewed their memberships:

Adobe
PwC Technology
Rakuten, Inc

Did you know that your individual, paid OWASP membership ...

directly support our local chapters and our projects
gets you a significant discount at all OWASP events
entitles you to partner event discounts several times each year
gives you a voice in the OWASP Global Elections
entitles you to communicate professionally via an owasp.org email address
can be a matching donation allocation through your US employer

AppSec APAC 2013

2013-02-28T02:40:00.002-08:00

We would like to thank the South Korea chapter for putting on an excellent conference last week. Guests traveled from all parts of the globe to attend the AppSec APAC 2013 conference that took place on Jeju Island. Below are a few images taken by a handfull of our guests. To view the rest of our images for this conference, please visit our OWASP Photo Gallery Page.

2013-02-26T12:25:00.006-08:00

OWASP iGoat Project:

Thanks to iGoat lead developer, Sean Eidemiller, it gives me great pleasure to announce the immediate release of OWASP iGoat version 2.0! See the project web site at:

https://www.owasp.org/index.php/OWASP_iGoat_Project

for more information, or go directly to the source repository to download at:

http://code.google.com/p/owasp-igoat/

The OWASP iGoat tool is a stand-alone iOS app (distributed solely in source code) designed to introduce iOS developers to many of the security pitfalls that plague poorly-written apps. Like its namesake, OWASP's WebGoat tool, iGoat is intended to teach software developers about these issues by stepping them through a series of exercises, each of which focuses on a single aspect of iOS security.

OWASP iGoat is an ideal tool to use in a classroom setting to teach iOS developers (and technically minded IT Security staff with at least some exposure to object oriented programming).

Exercises include many typical problem issues (and their solutions) including:
- Securing sensitive data in transit
- Securing sensitive data at rest
- Securely connecting to back-end authentication services
- Side channel data leakage (e.g., system screen shots, cut-and-paste, and keystroke logging via the autocorrection feature)
- Making use of the system keychain to store small amounts of consumer-grade sensitive data

New to version 2.0:

- iGoat is now a true Universal app, so it builds and runs on iPhones, iPod Touches, as well as iPads. Full screen views are supported on all of these devices. (It also runs on the iPhone simulator included with XCode, of course -- which is ideal for a classroom environment.)

- A few "behind the scenes" improvements were made to the iGoat platform itself, making it easier to work with and develop new exercises. These include:
o Storyboards for main screen navigation.
o ARC support for object memory management.

- General code clean-ups.

Requirements:

To build and run iGoat, you'll need a Mac running OS X (real or virtual machine), with XCode installed. iGoat was built for Mountain Lion, but should run fine on any OS X newer than Snow Leopard. We recommend the latest XCode and built iGoat using XCode version 4.6. Similarly, iGoat was built on iOS 6.1, but should be backwards compatible with at least version 5.x.

We invite the OWASP community to download and try iGoat, and we welcome your suggestions for improvements. We're always looking for willing participants to contribute to the project as well!

Cheers,

Ken van Wyk
OWASP iGoat Project Leader

Security: Looking Forward - Protecting Critical Applications with OWASP

2013-02-25T07:19:00.001-08:00

Headed to RSA?

Speaker(s):
Michael Coates - OWASP Global Board Chair & Director of Security Assurance at Mozilla, Mozilla

Session DescriptionTop 10 application security risks, free online security training, advanced application security testing tools, guidance on secure development lifecycle – these are all free resources produced by the OWASP open source community. Join this session and find out how to support and leverage the OWASP organization to help the fight for secure applications!

Security: Looking Forward - Protecting Critical Applications with OWASP

AppSecUSA 2013 Sponsorship Registration is NOW OPEN

2013-02-20T10:34:00.000-08:00

OWASP AppSecUSA 2013 Sponsorship Registration is

NOW OPEN!

AppSecUSA 2013 is being held November 18th - 21st in New York City at the NY Marriott Marquis located in the heart of Times Square!

Conference sponsors will have access to over 2000 attendees exclusively focused on Software Security.
Space is limited, so don't wait! Complete the form now to be part of the action in the Big Apple.

Want to save on the price of your conference sponsorship? Become a Corporate Member today and take advantage of the Discounted Sponsorship Rates for OWASP Corporate Members!

Press Release

OWASP Connector February 19, 2013

2013-02-19T13:27:00.000-08:00

OWASP Connector February 19, 2013

OWASP PROJECT VOLUNTEER JOBS:

The following volunteer opportunities can be accessed through the global initiatives page

AppSensor Writers - We are writing v2 of the AppSensor book and need help from the software community. Can anyone help identify or tell us about real-world examples of AppSensor (application-integrated attack detection and response) or AppSensor-like functionality in any type of software application? Please sign up via the initiatives page if interested.

MediaWiki Ninja: Development Guide 2013 Project Assistance Needed - The OWASP Development Guide 2013 would like to have the different versions of the Guide available via a drop down menu similar to MSDN (say compare the different versions of ASP.NET API) or Technet (say compare the versions of Windows), so that we can develop and translate the OWASP Development Guide 2013 here at OWASP without disturbing existing content. MediaWiki experience is essential!!!!!

AppSensor Cover Photographer - we are writing v2 of the AppSensor project book and need a photograph for the front cover ... somewhat like those used on the Testing Guide or Developer's Guide of an insect in color. No photo library images, or images taken from other places without permission please.

Help Wanted for OWASP ZAP project - various roles - the OWASP ZAP project is currently recruiting for various volunteer roles to help support the current development team with their project milestones. We have many different roles available ranging from developer roles to graphic design and marketing. This is an excellent opportunity to work on a high profile OWASP project, while working in a supportive environment where help is readily available. Check out the Get Involved section of the Zap project page

OWASP Foundation

www.owasp.org

Contact Us

OWASP Blog

PARTNER EVENTS

SecAppDev - Leuven 2013 is the 9th annual presentation of a week long Secure Application Development immersion course by secappdev.org, a non-profit dedicated to raising the bar in secure software engineering. The course is run from March 4th - 8th in the Faculty Club, Leuven, Belgium. Register Here

Canadian Cloud Council is hosting an exciting event "Cloud Matters" that will challenge how Canada views the cloud. Visit the event page for a list of the dynamic speaker lineup. OWASP members receive a $100 discount with the code: cccOWASP.

Information Security Summit - Cleveland, OH, USA - ISS is joining with NEOSA and COSE to present the Spring IT Summit during Tech Week. OWASP, the ISC2 Cleveland Chapter, IT ThinkTank, and the Cleveland Chapter of CSA have collaborated to produce an exciting agenda. Pre-conference training is scheduled for April 17th and the event will be held on April 18th. CPEs will be awarded for attendance. The finalized agenda and event information can be found here.

This year's North American AppSec Conference will be held in New York City November 18th-21st at the Marriott Marquis in the heart of Times Square. We have a fantastic event shaping up and sponsorships are selling fast. If you are interested in sponsoring, please complete this request for information

OWASP Social Media

Linkedin

Twitter

Google +

Facebook

NING

StackOverFlow

FEBRUARY GLOBAL WEBINARS SCHEDULED

February 28, 2013 at 10am EST
(GMT -5)

February 28, 2013 at 9pm EST
(GMT -5)

Links to the recordings of previous meetings can be found on the Initiatives Page

Read a Message from Michael Coates, Chairman of OWASP Board of directors regarding the transition to the Global Initiatives

We would like to extend a big THANK YOU and Welcome to the newest Corporate Members:

Architect Group and Twitter

Also, Thank you to the following Companies who have renewed their memberships in 2013:

Accuvant Labs, DBAPP Security, Denim Group, FishNet, Mozilla, Oracle, Qualys, and VeraCode

Do you have some news? Submit your item to appear in the next connector HERE

Moving to Global Initiatives Program & Retiring Committee Structure

2013-02-14T05:33:00.003-08:00

OWASP has grown significantly over our 10+ years of existence. As we’ve grown the community has adapted and changed in many ways. Nearly five years ago at the first OWASP Summit we created the global committees. This structure created new channels where interested OWASP’ers could help shape and grow the OWASP organization. Over those five years we’ve seen many great results from the committees and many people have contributed countless hours to further OWASP.

As we’ve continued growing it is now time to make another pivot. The committee structure provided many successes but now there is a better structure that will accommodate a growing population of interested OWASP volunteers.

At this time we are retiring the committee structure and completely moving to the Global Initiatives Program (https://www.owasp.org/index.php/OWASP_Initiatives_Global_Strategic_Focus). The Global Initiatives program will be the new way for any interested individual to find and volunteer to assist with OWASP activities. The Global Initiatives program is a single place where individuals can post new ideas to rally a team or can look for other activities that are in need of assistance.

This transition will allow for further involvement within OWASP by:

Creating smaller, task focused objectives for OWASP’ers to volunteer
Minimize barriers and red tape for OWASP’ers
Create projects with natural end dates so OWASP’ers aren’t required to make multi-year commitments just to get involved
Provides tasks that are short or long term commitments – OWASP’ers can match their availability and desired commitment with the best initiative in need of resources
Enables easier recognition for all the great contributions from our OWASP’ers

The efforts put forth in the committees was truly valued. While the structure may be changing, we encourage and welcome all of the great volunteers from the former committees to continue growing OWASP through the Global Initiatives program.

We’re all excited about this new transition and hope to see many more OWASP’ers contributing and spreading application security.

Want to talk more about the OWASP global initiatives program? Join the monthly call. Next meeting is February 14^th
.
REGISTER FOR THE UPCOMING WEBINARS

February 14, 2013 10am EST (GMT -5)

February 14, 2013 9pm EST (GMT -5

--
Michael Coates | OWASP | @_mwc

OWASP Board

OWASP HR Information

2013-02-13T15:41:00.000-08:00

OWASP Community Members,

I wanted to take a minute and share the OWASP hiring process for the IT Support Position. Although we need to work on our timing a bit, I'm comfortable that the process is fair and impartial.

In early November, two positions were posted on the OWASP jobs board and included in the OWASP Connector, and applications were submitted via the contact us form. The IT candidates information was forwarded to the Board for review.

Actual interviews were not conducted until late January and early February. During the delay, several additional candidates submitted their resumes for consideration.

I interviewed the candidates for their non-technical skills: management, interpersonal and communication skills, areas of interest, and general knowledge and passion for OWASP. Jim Manico interviewed the candidates for their technical ability and reported that to Sarah Baso and me.

The candidates were evaluated on all factors and a decision was promptly made. Those candidates who interviewed were notified of the decision prior to the announcement.

Kate Hartmann

Director

OWASP Foundation

kate.hartmann@owasp.org

OWASP Connector February 5, 2013

2013-02-05T14:56:00.000-08:00

OWASP Connector February 5, 2013

NEW OWASP PROJECTS:

OWASP Embedded Application Security Project - There are many challenges in the embedded field including limited memory, a small stack and the challenge of pushing firmware updates. The goal of this project is to identify the risks in embedded hardware applications, create a list of best practices and draw on the resources OWASP already has and bring that to the embedded world. Please contact Aaron Weaver if you wish to contribute to the project.

OWASP OpenStack Security Project - The OWASP OpenStack Security Project is an effort to provide security testing techniques and tools to assess the security of the OpenStack code base. Generally speaking, the OpenStack community is primarily developers of OpenStack and companies which are implementing all or parts of OpenStack. This project provides a bridge between the OpenStack community and the OWASP community of security professionals. The project leader is also a member of OpenStack and is a member of the OpenStack Security Group. OpenStack has the desire to be the Linux of Cloud infrastructure, and OWASP can be the community that ensures the security of that Cloud. Please contact Matt Tesauro if you wish to contribute to the project

PROJECT ANNOUNCEMENTS

OWASP ZAP 2.0.0 is now available for Download

Simon Bennetts, OWASP Zap's Project Leader, is planning to host a Google hangout demonstrating many of these features at 17:00 UTC on Friday 8th Feb. Details to be announced via twitter
https://twitter.com/zaproxy

For more information on Zap 2.0 new features, please visit the OWASP Official Blog

OWASP AntiSamy Version 1.5 is finally released!

AntiSamy V1.5 promises to be significantly faster than previous releases; your mileage will vary anything from just some percent to a full 5 times faster, depending on use cases. A lot of attention has been put to typical "server" validation cases in this release. This version requires java 1.5.

For more information on this initiative, please visit the OWASP AntiSamy Project Page

OWASP Foundation

www.owasp.org

Contact Us

PARTNER EVENTS

OWASP & Black Hat EU - OWASP is proud to once again partner with Black Hat Europe in 2013. Join us in Amsterdam, March 12-15, 2013 for the premiere conference on information security. Take advantage of an exclusive 15% discount off Black Hat Europe Briefings. OWASP members may simply enter the following code: 15OwaSpBHeu13 when completing the registration process. Click Here to Register

OWASP & RSA Conference 2013 - New for this year, OWASP has partnered with the RSA conference taking place February 25-March 1, 2013. Register today to access the industry's most in-depth intelligence over five information packed days in San Francisco. Use the following code to receive an additional $100 off the current registration price: 1213OWASPDL100.

While attending the conference, come check out our talk on Friday, March 1 in the Association Track "Security: Looking Forward - Protecting critical applications with OWASP" presented by Michael Coates, Chairman of the OWASP Global Board of Directors

Call for 2014 Global AppSec Conference Proposals

We are currently solicitating proposals for our four OWASP Global AppSec conferences in 2014. Conferences will be selected to facilitate on Global AppSec conference in each quarter of the year. Conferences will be held in North America, South America, Europe, and the Asia Pacific regions. New for 2014, we will be moving the North American event to Q2!

Global AppSec Asia Pacific - Q1 (Applications due by March 1, 2013)
Global AppSec North America - Q2 (Applications due by April 1, 2013)
Global AppSec Europe - Q3 (Applications due by July 1, 2013)
Global AppSec Latin America - Q4 (Applications due by September 1, 2013)

Those interested in submitting a proposal, should learn more about the recommended planning steps here and submit your application to the OWASP Event Management System

If you have any questions or need assistance with your application, do not hesitate to contact Sarah Baso or the Global Conferences Committee

FEBRUARY GLOBAL WEBINARS SCHEDULED

February 14, 2013 at 10am EST
(GMT -5)

February 14, 2013 at 10pm EST
(GMT -5)

Please add your recommendations for discussion to the meeting agenda

Links to the recordings of January's meetings can be found on the Initiatives Page

The 2013 OWASP LATAM Tour is being scheduled for March/April 2013. Each location will host a day of training and a day of talks. If you are interested in submitting a training proposal, or are interested in sponsoring this event, please visit the LATAM 2013 web page.

NEW CITATION: The new document from PCI SSC references OWASP -
Information supplement: PCI DSS E-commerce Guidelines

Other Citations of National & International Legislation, Standards, Guidelines, Committees and Industry Codes of Practice

OWASP Social Media

OWASP Blog

OWASP at FOSDEM 2013

2013-02-05T10:01:00.000-08:00

OWASP had a great presence this year at FOSDEM 2013 held in Brussels, Belgium. Dedicated members from Amsterdam, Belgium, and the United Kingdom attended on behalf of OWASP. Simon Bennetts spoke about OWASP ZAP at the event, and helped share our mission with Sebastien Deleersnyder and Martin Knobloch. Thank you for your dedication and support, gentlemen.

FOSDEM is a community driven event whose goal is to provide Free Software and Open Source developers a place to get together and share ideas. FOSDEM is a non-commercial, two-day event organized by volunteers to promote the widespread use of Open Source software.

Image via FOSDEM 2013

2014 Call for Global AppSec Conference Proposals

2013-02-04T14:49:00.000-08:00

OWASP Leaders -

Are you interested in hosting a Global AppSec Conference for 2014? Now is the time to submit your proposal!

Each year OWASP hosts four international AppSec conferences that are aimed at raising money for the Foundation while fulfilling our mission of improving the security of software through awareness and education. OWASP Global AppSec Conferences include 2 days of pre-conference training, followed by 2 days of conference talks. For more information about Global AppSec conferences, see the How to Host a conference page (http://www.owasp.org/index.php/How_to_Host_a_Conference).

We are currently soliciting proposals for four Global AppSec conferences in 2014. Conferences will be selected to facilitate one Global AppSec conference in each quarter of the year with conferences held in North America, South America, Europe and the Asia Pacific regions. New for 2014, we will be moving the North American event to Q2!

· Global AppSec Asia Pacific - Q1 (Applications due by March 1st 2013)

· Global AppSec North America – Q2 (Applications due by April 1st 2013)

· Global AppSec Europe - Q3 (Applications due by July 1st 2012)

· Global AppSec Latin America - Q4 (Applications due by September 1st 2012)

Putting on a Global AppSec conference is a rewarding experience, but also a tremendous amount of work. Having a team of volunteers (or at least a core group of individuals) willing to lead the event planning efforts, with experience with a local or regional event is strongly recommended.

Some things to consider before sending in an application:

· First, review the How to Host a conference page (http://www.owasp.org/index.php/How_to_Host_a_Conference). This page hosts a variety of information about planning an OWASP event, as well as various requirements and policies that have been put in place by the foundation to govern Global AppSec Conferences.

· Gather a small team together who are interested in working the event. Trust us, you can’t do it all yourself.

· Work with your local planning team to acquire some basic information (location, tentative dates, possible venues, costs, theme, etc) about your event.

· Prepare a rough budget plan using the OWASP Budget Planning Tool (http://www.owasp.org/index.php/Conference_Budget_Planning_Tool). We understand that you may not have quotes and good estimates for all of the budget items but please put forward the best information you have.

· Some events have chosen to put together a short presentation describing the organizing committee, previous conference experience, existing local supporting organizations, local attractions, access to transportation, local culture and more. In general, these are presentations to 'pitch' your city to the committee. Examples of successful presentations http://bit.ly/i9rgA1 andhttp://bit.ly/gsA2wI.

· Submit your application at https://ocms.owasp.org/

We really appreciate every proposal we receive. Just by submitting an application, you are demonstrating your commitment to OWASP by offering to host one of its best public outreach initiatives. Please keep in mind that there are many factors that go into selecting Global AppSec Conference locations and not every proposal will be approved. We also realize that this could be very early in your planning process, and therefore challenging for you to provide detailed information, just provide the best available information.

If you have any questions or need assistance with your application, do not hesitate to contact Sarah Baso (sarah.baso@owasp.org) or the Global Conferences Committee (global_conference_committee@lists.owasp.org).

We look forward to your proposals!

OWASP Zed Attack Proxy v 2.0.0

2013-01-30T07:10:00.000-08:00

There is a new version of the OWASP Zed Attack Proxy (ZAP) available right now, and there are so many changes in it that we’ve decided to call it version 2.0.0.

If you just want to get stuck in and download it then head over to http://code.google.com/p/zaproxy/downloads/list : it's available for Windows, Linux and Mac OS.

(Note that the Mac OS specific release is coming soon, but the Linux release is actually cross platform and will work fine on Macs)

And if you want to learn a bit more about the changes then read on...

We can only cover the new features at a high level in one blog post, but the plan is to host a Google hangout demonstrating many of these features at 17:00 UTC on Friday 8th Feb. Details to be announced via https://twitter.com/zaproxy

Simon will also be presenting a talk at FOSDEM on Feb 2nd: Practical Security for developers, using OWASP ZAP

New features

An integrated add-ons marketplace

ZAP can be extended by add-ons that have full access to all of the ZAP internals. Anyone can write add-ons and upload them to the ZAP Add-on Marketplace (OK, so its a Google code project called zap-extensions, but you get the idea).

More importantly you can now browse, download and install those add-ons from within ZAP. Most add-ons can be dynamically installed (and uninstalled) so you wont even need a restart.

You can choose to be notified of updates, and even be automatically updated. And as the scan rules are now implemented as add-ons you can get the latest rules as soon as they are published.

A replacement for the 'standard' Spider

The ‘old’ Spider was showing its age, so its been completely rewritten, and is much faster and more comprehensive than the old one. This is still a 'traditional' spider that analyses the HTML code for any links it can find.

A new 'Ajax' spider

In addition to the 'traditional' spider we've added an Ajax spider which is more effective with applications that make heavy use of JavaScript. This uses the Crawljax project which drives a browser (using Selenium) and so can discover any links an application generates, even ones generated client side.

Web Socket support

ZAP now supports WebSockets, so ZAP can now see all WebSocket messages sent to and from your browser. As with HTTP based messages, ZAP can also intercept WebSocket messages and allows you to change them on the fly.

You can also fuzz WebSockets messages as well using all of the fuzzing payloads included in ZAP from projects like JBroFuzz and fuzzdb. And of course you can easily add your own fuzzing files.

Quick Start tab

The first main tab you will now see is a ‘Quick Start’ tab which allows you to just type in a URL and scan it with one click.

This is an ideal starting point for people new to application security, but experts can easily remove it if they find it distracting.

Session awareness

ZAP is now session aware, so it can recognise and keep track of multiple sessions. It allows you to create new sessions, switch between them, and applies to all of the other components, like the Spider and Active Scanner.

User defined Contexts

You can now define any number of ‘contexts’ - related sets of URLs which make up an application. You can then target all URLs in a context, for example using the Spider or Active Scanner. You can also add the contexts to the scope, and associate other information, such as authentication details.

Session scope

The session scope allows you to specify which contexts you are interested at any one time. You can restrict what you see in various tabs to just the URLs in scope, and prevent accidentally attacking URLs not in scope by using the Protected mode.

Different modes

ZAP now supports 3 modes:

Safe, in which no potentially dangerous operations permitted
Protected, in which you can perform any actions on URLs in scope
Standard, in which you can do anything to any URLs

A scripting console

This allows you to access any internal ZAP data structures dynamically using any scripting language that supports JSR 223,

Authentication handling

You can now associate authentication details with any context, which allows ZAP to do things like detect if and when you are logged out and automatically log you back in again. This is especially useful when used via the API in security regression tests.

More API support

The REST API has been significantly extended, giving you much more access to the functionality ZAP provides.

Fine grained scanning controls

The active scan rules can now be tuned to adjust their strength (the number of attacks they perform) and the threshold at which they report potential issues.

New and improved active and passive scanning rules

We have uploaded the results from running ZAP 2.0.0 against wavsep (the most comprehensive open source evaluation project we are aware of) to the ZAP wiki: http://code.google.com/p/zaproxy/wiki/TestingWavsep

Many stability and usability fixes

Many thanks to everyone who has contributed code, language files, enhancement requests, bug reports and general feedback.
And a special mention to the 3 Google Summer of Code students who implemented key features in this release:

Cosmin Stefan : Spider and Session awareness
Guifre Ruiz : Ajax Spider
Robert Koch : WebSockets

If you have any questions about this release then you can add a comment here or post them to the ZAP users group.

OWASP AppSecEU Research 2013: CfPs released

2013-01-25T09:12:00.001-08:00

Hi folks,

After having some luck and with a little bit of work in order to constitute two splendid program committees we're just released the "Call for Ps". One for the research track, one regular industry tracks:

https://www.owasp.org/index.php/AppSecEU2013/CfPresos
https://www.owasp.org/index.php/AppSecEU2013/CfPapers

If you think you can contribute with your presentation or paper something to the topics listed in the CfPs, you're
cordially invited to submit a proposal.

We look forward to a great http://AppSec.EU/ conference this August in Hamburg.

Feel free to spread the word.

Best,

Dirk Wetter