Project Review Session at OWASP Project Summit during Belfast APPSEC EU 2017

We have an open session for two days for Project Reviews during our OWASP Project Summit EU 2017 Belfast. We are looking for some volunteers to review projects and helping make OWASP Projects move to the next level with your expertise and feedback.

Please Sign Up and join us in APPSEC EU 2017 in Belfast!

We currently have these leaders attending and want to send thank you for stepping up to the challenge and thank Johanna Curiel, our current Vice Chair on the Board, for helping us lead this effort.

• Azzeddine Ramrami
• Talal Albach
• Kuai Hinojosa
• Nabin Kc

Overview of Project Reviews:

OWASP is reviewing projects who wish to graduate from Incubator to Lab to Flagship.  The purpose of this assessment is to determine whether a project meets the minimum criteria to graduate as outlined in the Project Health Assessment Criteria Document.  The review process begins with an initial self-assessment done by the project leader and reviewed by Matt Tesauro.  Next, the assessment enters the peer review phase where we ask volunteers in our OWASP Community to participate and finalize the results. I have included a Sample of a Project Assessment for your review and consideration.

December 21, 2016 | www.owasp.org | Contact Us | Brought to you by the OWASP Foundation

2016 in Review; Looking Ahead OWASP Operations Update OWASP in the News!	Project Reviews New Projects in 2016! ESAPI's New Project Leader	AppSecEU 2017 Global AppSec Events Local and Regional Events Training Events Partner and Promotional Events
Chapter Handbook Review OWASP is Testing Meetup Pro Request for Blog Content	New and Renewing Corporate Members	OWASP Foundation Social Media

---

OWASP Communications

2016 in Review; Looking Ahead 2016 has been a period of radical change for OWASP, some of it was sudden and devastating, other changes were the culmination of months of small improvements. OWASP Foundation invites you to aid us in harnessing the energy from these changes to foment a period of radical growth in 2017. The year in Review: This year we lost our Executive Director, Paul Richie. He brought order and professionalism to OWASP. He raised our own high expectations and delivered on the things he set out to do. He made all of us that worked closely with him better and more effective. He will be greatly missed. AppSec Europe and AppSec USA were both successful, with AppSec USA in DC selling a record number of tickets. Two Successful Project Summits during AppSec EU and AppSec USA 2016 that allowed approximately 30 thirty Project Leaders to jump in with 'hands-on' work on a variety of OWASP Projects. Our experiments with hosting a Member’s Lounge at global AppSec events where you can charge your electronics, lounge in a quiet space with colleagues, and grab some swag and a snack have been wildly successful. We are happy to have nearly doubled our Premier Corporate Membership. We gained a significant number of chapters in Asia, Africa, and Latin America. We hired our new Senior Technical Coordinator, Matt Tesauro and Community Manager, Tiffany Long to help drive our Projects and Community-based programs forward. There are so many more achievements in 2016 and all can be found in back issues of our OWASP Connector newsletters. Looking Forward: The OWASP Staff had developed a new communication strategy, The majority of which will be implemented 2017. The OWASP Website Reboot began with the evaluation by Sooryen in 2016 and continues into 2017. You can see the plan here. Owasp will implement our new association management system. This will integrate various back-end systems and lead to improved user experience for the OWASP global community. We look forward developing our volunteer program in 2017. OWASP is choosing a strategic objective for 2017, you can help by discussing the current suggestions or contributing your own. On behalf of the entire Operations team, we look forward to making 2017 an exciting and productive year for OWASP. Best, Tiffany Long OWASP Community Manager Tiffany.Long@owasp.org OWASP Operations Update Starting in December 2016 and continuing throughout 2017, the staff are going to post monthly updates on the OWASP Blog so the community can keep up with what the OWASP Foundation is doing to make OWASP just that much better. We’re also open to starting brief weekly updates if the community wants to follow our direction more closely. Read the December 2016 Operations Update here. OWASP in the NEWS! What The Galactic Empire Could Learn from OWASP – Stormpath, December 17, 2016 Privacy Commissioner, infosec boffins, call for reform of anti-hack Bill – The Register, December 18, 2016 Protecting Yourself From Online Scammers – Fox2Now, November 30, 2016 Application Security Conference: AppSec USA – Resolute Technology Solutions, December 16, 2016 Security! experts! slam! Yahoo! management! for! using! old! Crypto! – The Register, December 15, 2016 IT security skills dearth lifts SA's risk profile – IT Web Access Control, December 12, 2016 Security Awareness Program 2017: How Hospital Leaders Can Handle Cybersecurity Threats in the Coming Year – Insights, December 10, 2016

---

OWASP Projects

Project Reviews OWASP Project Inventory has 93 Projects (Code, Tools, or Documentation) produced by the efforts of volunteers. Projects are divided into three categories, Incubator, Lab and Flagship status. We currently have about 39 Projects in Flagship or Lab Status and the balance are in Incubator status. The main purpose for project reviews is to provide an evaluation based on a defined criteria which provides an incentive and measurement of a projects maturity as they grow from Incubator to Flagship. Project reviews may be requested by the Project Leaders or flagged during each project's annual health check. The evaluation is based on defined criteria which attempt to gauge the project's quality, health (activeness), and stage within our incubator to lab to flagship continuum. The review consists of an initial self-assessment done by the project leader which is peer reviewed by volunteers from OWASP. Next, OWASP staff take look over all the feedback on the project and ensure it meets the requirements for graduation. Once a project is ready for graduation, all the review feedback is presented to the community for any final comments or +1’s. You can view the four most recent reviews and share your thoughts here. New Projects in 2016! OWASP Inventory added New Projects in 2016! Documentation: OWASP Anti-Ransomware Guide Project OWASP Mobile Security Testing Guide Tools: OWASP Basic Expression Lexicon Variation Algorithms (Belva) Project OWASP VBScan OWASP AppSec Pipeline OWASP Juice Shop Project OWASP Bug Logging Tool Code: OWASP Secure Headers Project OWASP Vicnum Project ESAPI's New Project Leader OWASP Enterprise Security API  Welcomes New Leader Matt Seil — By Kevin Wall It is with mixed emotions that I am making this announcement, that Chris Schmidt is stepping down as long-time ESAPI co-leader and that Matt Seil will be taking over that position and attempting to fill Chris' shoes. On one hand, I'm saddened because Chris was such a great leader and contributor for ESAPI. Chris took over as co-leader sometime in May 2011, at the same time that I did, when Jim Manico handed over us the reigns, but Chris' contributions to ESAPI go back way before my involvement and his contributions are much broader than mine. While I focused mostly on ESAPI's crypto and provided some occasional general ESAPI bug zapping, Chris had his hands in almost everything ESAPI (and I mean that in a good way). For instance, he single-handedly created the ESAPI for JavaScript and the ESAPI Spring Authenticator mini-projects. Chris also played the major role in the ESAPI 2.x's release management as well as creating the outline for the ESAPI 3.x interfaces. His wisdom, insigh, and broad experience will be sorely missed by ESAPI. However, Chris should be admired in admitting that as of late, because of job and personal obligations, he has lacked the "time to really provide any value to the ESAPI team" and therefore is stepping down in the best interest of ESAPI. I personally have enjoyed working with Chris for these past 5.5 years and have learned a lot from him. I hope that he periodically finds time to continue to contribute ESAPI in whatever way possible. On the other hand, I am eagerly looking forward to working with Matt Seil as the new ESAPI co-lead. Matt was a major contributor to bug fixes for the ESAPI 2.1.0.1 release last February. He and I worked well together and I think he is highly respected in the OWASP community by those who know him. Shortly after this New Years, Matt and I hope to get together and discuss future plans for ESAPI, both short-term and long-term goals. Once we have the initial groundwork for that recorded in electrons somewhere, we will share them with the broader ESAPI community to get feedback and then revise them as needed. (In the meantime, if you have some suggestions that you would like us to potentially consider, please email them to Matt Seil and me. In the meantime, I hope that along with me, you will extend your thanks and appreciation to Chris for his labor of love on ESAPI and extend your welcome to Matt as the new ESAPI project co-lead. Thank you and Happy Holidays!

---

OWASP Events

AppSecEU 2017 The call for presentations and training are now open for AppSecEu 2017, which will take place in Belfast from May 8th to 12th 2017. OWASP's Global AppSec events serve a diverse audience of security professionals at all stages of their careers. We seek interesting perspectives and training to drive visibility and evolution in the safety and security of the world’s software. We have opportunities for multi-day trainings, talks, lighting trainings, lightning talks, arsonal and activities. Our topics of interest for talks include, but are not limited to the following: Novel web vulnerabilities and countermeasures New technologies, paradigms, tools OWASP tools or projects in practice Secure development: frameworks, best practices, secure coding, methods, processes, SDLC Browser security Mobile security and security for the mobile web Cloud security REST/SOAP security Security of frameworks Large-scale security assessments of web applications and services Privacy risks in the web and the cloud Management topics in Application Security: Business Risks, Awareness Programs, Project Management, Managing SDLC OWASP Trainings should be practical in nature--hands-on class will receive stronger consideration. Topics of interest for include but are not limited to: Secure development: frameworks, best practices, secure coding, methods, processes, SDLC Vulnerability analysis: code review, pentest, static analysis Threat modelling Mobile security Cloud security Browser security HTML5 security OWASP tools or projects in practice New technologies, paradigms, tools Privacy in web apps, Web services (REST, XML) and data storage Operations and software security Management topics in Application Security: Business Risks, Outsourcing/Offshoring, Awareness Programs, Project Management, Managing SDLC While we understand that your submission might be a work in progress, we strongly encourage that all submissions be as thorough as possible to allow us to make the best decision. The program committee will review your submission based on a descriptive abstract of your intended presentation. Feel free to attach a preliminary version of your presentation if available, or any other supporting materials. Please review your proposal thoroughly as accepted abstracts and bios submitted will be published 1:1 on our site. If your presentation is accepted for inclusion in the conference program, you are free to submit a white paper describing your work, to be added to the website. To ensure the best talks available are presented at AppSec Europe we are incorporating blind reading as part of our process. This means that names and job titles will be removed when the paper's abstract is being reviewed. Submissions for training will not be read blind. All speakers will be given access to speaker mentorship, we especially encourage first time speakers to take advantage of this service. Marketing and sales pitches will not be accepted in the talks or trainings. Submit a Presentation Submission deadline: January 9th, 2017 Notification of acceptance: February 6th, 2017 Conference days: May 11th – 12th 2017 Submit a Training Deadline for proposals: January 2, 2017 Notification to training providers: January 23, 2017 Training: May 8, 9, 10 Global AppSec Events AppSec Europe 2017 May 8 - 12, 2017, Belfast, UK Call for Papers, ends January 9 Call for Trainings, ends January 2 Call for Lightning Trainings Call for Activities Call for Arsenal AppSec USA 2017 September 19 - 22, 2017, Orlando, Florida, USA Regional and Local Events AppSec Cali 2017 January 23 - 25, 2017, Santa Monica, CA, USA AppSec Africa 2017 February 1 - 2, 2017, Casablanca, Morocco SnowFROC 2017 March 16, 2017, Denver, CO, USA Latam Tour 2017 April 3 - 28, 2017, South America OWASP Middle East Cyber Security Conference 2017 May 3 - 4, 2017, Dubai, UAE Training Events Boston Training January 25 - 27, 2017, Waltham, MA, USA Partner and Promotional Events IoT Tech Expo Global 2017 January 23-24, 2017   Olympia, London   OWASP members save 20% by using discount code: OWASP20 Cyber Resilience & InfoSec 2017  February 6-7, 2017   Abu Dhabi, U.A.E. SC Congress London   February 23, 2017   London, UK CyberCentral   April 4-6, 2017   Prague, Czech Republic QuBit Conference 2017   April 4-6, 2017   Prague, Czech Republic   OWASP members save 10% by using discount code: QB17OWASP Cyber Security North Africa Summit   April 26-27, 2017   Cairo, Egypt   SC Congress New York   May 2, 2017   New York, NY Techno Security & Digital Forensics Conference  June 4-7, 2017   Myrtle Beach, SC SC Congress Toronto   June 13-14, 2017   Toronto, Canada

---

Ads are not endorsements and reflect the messages of the advertiser only.They represent co-marketing arrangements with other organizations in support of the OWASP Community.   CLICK HERE for more information on advertising.

---

OWASP Chapters

Chapter Handbook Review The Chapter Handbook goes under periodic review. This is your opportunity to be heard at OWASP. Each chapter is listed in its own doc, please comment to tell us where you think the handbook needs clarification, further guidance, or updates. Please confine your activity to the comments and do not directly edit the pages. Comments will remain open for one month. Chapter One - Handbook Overview Chapter Two - Mandatory Chapter Rules Chapter Three - How to Start a Chapter Chapter Four - Chapter Administration Chapter Five - Governance Chapter Six - Chapter Activity Chapter Seven - Organizing Chapter Meetings OWASP is Testing Meetup Pro OWASP has been listening to you and we are proud to announce that we began testing the new MeetUp Pro service this month. MeetUp Pro will provide an umbrella under which the chapter groups would be gathered. This means that all of our chapters would be uniformly branded and advertised on our master homepage. From the chapters’ point of view, the meetup would function the same as before with the only changes being that the leaders are listed as “local leaders” and only the official OWASP account would have the ability to start and eliminate chapters. There are a lot of benefits for chapters of going pro, not only will your meetups be more searchable, but the cost of the service, currently born from your chapter budgets, will be absorbed by the foundation budget. A significant “silent” benefit is that the API should allow us to mirror the information on the MeetUp page on the Chapter wikis thereby eliminating a large amount of work that we currently ask our leaders to do, but do not enforce. After MeetUp Pro is out of Beta, All chapters will once again be required to keep their wiki pages up to date. Our goal is to remove the onerous time sink of doing this. If you would like to see what the new Pro pages look like check out this page, where the first 7 chapters have joined. Request for Blog Content OWASP would like to start spotlighting chapter activity on our blog. If your chapter hosted and recorded an amazing talk that just NEEDS to be shared, or perhaps you ran a great event and would like to help other chapter follow suite think about writing a blog post to be shared on the OWASP Blog. Contact our community manager, Tiffany Long for more details.

---

OWASP Membership

We would like to thank the following companies for supporting the OWASP Foundation. The companies listed below have contributed this month by either renewing their existing Corporate Membership or joining OWASP as a new Corporate Member. Details about Corporate Membership can be found here. Premier Corporate Member Signal Sciences is the industry’s first Web Protection Platform using both Next Generation WAF as well as RASP technologies. Signal Sciences WPP was built in response to our own frustrations of trying to use legacy WAFs while enabling business initiatives like DevOps, cloud adoption and CI/CD. The Signal Sciences NGWAF works seamlessly across cloud, physical, and containerized infrastructure, providing security without breaking production traffic. To learn more, please visit http://www.signalsciences.com Contributor Corporate Member Parasoft helps organizations perfect today’s highly connected applications by automating time-consuming testing and analysis tasks while providing management the analytics necessary to focus on what matters – eliminating the deployment of security vulnerabilities that could lead to system failure, data loss, and loss of life. Parasoft’s software security solution analyzes code, generates and executes tests, and processes the data collected throughout the SDLC to ensure compliance with security policy across all layers of the software stack. In addition, Parasoft can analyze and automatically prioritize defects that lead to security vulnerabilities and kick-off security verification and remediation tasks across the team. Learn more at www.parasoft.com/appsec Want your name here? Find out how by visiting our Corporate Member information page, or contact Kelly Santalucia today! Thank you to all of our Premier and Contributor Corporate Members for your support in 2016!

---

	OWASP Social Media
OWASP Social Media Sites OWASP YouTube Channel LinkedIn Twitter Google + Facebook StackOverflow GitHub Trello Slack

Opportunities to Present at OWASP AppSec Europe

AppSec Europe seeks to bring together developers and security professionals at all points in their careers to be the thriving global community that drives visibility and evolution in the safety and security of the world’s software.  We understand that robust security requires diversity of thought and practitioners.  We also know that a conference that meets the needs of our community must provide a buffet of learning and teaching experiences.  We are currently seeking submissions for the following in conference events:

• Arsenal: Do you have an opensource tool to share with the world?  The AppSec Arsenal is the place to stand out from the crowd and demo your open source tool to potential users and collaborators. Successful applicants will have grown beyond proof of concept and represent a range of tools from the well known, to the newly established; the point-solution to the broad.  Watch for submission updates.
• 
  
• Lightning Training:  Important training comes in all sizes.  Our Lightning training sessions are the perfect 1-2 hour training on the go.  Your Lightning training session will be free to the public and can be in lecture or hands on mode. This a great place teach a concept swiftly, or allow new trainers to get experience. Apply for your Lightning training now!
• 
  
• Lightning Talks: Simplicity is beautiful and provocative ideas don't necessarily take an hour to express. Lighting Talks are the place to share everything from exciting vulnerabilities, to humorous lessons learned, to new ways of securing an application in 10-15 minuets.  Share your idea on the OWASP stage!
• 
  
• Activities: Conferences aren't all talk, sometimes you just need to DO! So whether it’s a Capture the Flag event, an Escape room, lock picking demonstrations or something else we want to facilitate your Activity. Preference given to those activities with a with a more security focused theme.  You can submit your Activity for May 11/12 here.

Pre-Conference Training:  AppSec Europe hosts paid single and multi-day training on the days leading up to the conference. Hands on training is strongly preferred to read more about our Training guidelines please read this previous blog post.

Deadline for proposals:  January 2, 2017
Notification to trainers: January 23, 2017
Training: May 8, 9, 10

Present at our Conference:  The deadline for presenting at our conference is coming up! We are looking for “the next”, cutting edge research in the context of web applications, secure development, security management and privacy. Academic researchers and industry practitioners have the opportunity to share their latest findings with the rest of the community, including coverage via our media channels. We will consider particularly good presentations that have been submitted elsewhere. 

Submission deadline: January 9th, 2017
Notification of acceptance: February 6th, 2017
Conference days: May 11th – 12th 2017

AppSecEu 2017 Call for Presentations and Training Now Open

The call for presentations and training are now open for AppSecEu 2017, which will take place in Belfast from May 8th to 12th 2017. OWASP's Global AppSec events serve a diverse audience of security professionals at all stages of their careers. We seek interesting perspectives and training to drive visibility and evolution in the safety and security of the world’s software.

Our topics of interest for talks include, but are not limited to the following:

• Novel web vulnerabilities and countermeasures
• New technologies, paradigms, tools
• OWASP tools or projects in practice
• Secure development: frameworks, best practices, secure coding, methods, processes, SDLC
• Browser security
• Mobile security and security for the mobile web
• Cloud security
• REST/SOAP security
• Security of frameworks
• Large-scale security assessments of web applications and services
• Privacy risks in the web and the cloud
• Management topics in Application Security: Business Risks, Awareness Programs, Project Management, Managing SDLC

OWASP Trainings should be practical in nature--hands-on class will receive stronger consideration.  Topics of interest for include but are not limited to:

• Secure development: frameworks, best practices, secure coding, methods, processes, SDLC
• Vulnerability analysis: code review, pentest, static analysis
• Threat modelling
• Mobile security
• Cloud security
• Browser security
• HTML5 security
• OWASP tools or projects in practice
• New technologies, paradigms, tools
• Privacy in web apps, Web services (REST, XML) and data storage
• Operations and software security
• Management topics in Application Security: Business Risks, Outsourcing/Offshoring, Awareness Programs, Project Management, Managing SDLC

While we understand that your submission might be a work in progress, we strongly encourage that all submissions be as thorough as possible to allow us to make the best decision.  The program committee will review your submission based on a descriptive abstract of your intended presentation. Feel free to attach a preliminary version of your presentation if available, or any other supporting materials.  Please review your proposal thoroughly as accepted abstracts and bios submitted will be published 1:1 on our site. If your presentation is accepted for inclusion in the conference program, you are free to submit a white paper describing your work, to be added to the website.                                                                                   
To ensure the best talks available are presented at AppSec Europe we are incorporating blind reading as part of our process. This means that names and job titles will be removed when the paper's abstract is being reviewed. Submissions for training will not be read blind.  All speakers will be given access to speaker mentorship, we especially encourage first time speakers to take advantage of this service.
Marketing and sales pitches will not be accepted in the talks or trainings.

Submit a Presentation

• Submission deadline: January 9th, 2017
• Notification of acceptance: February 6th, 2017
• Conference days: May 11th – 12th 2017

Submit a Training

• Deadline for proposals:  January 2, 2017
  
• Notification to training providers: January 23, 2017
  
• Training: May 8, 9, 10
  

OWASP Connector Newsletter - October 28, 2015

October 28, 2015 || www.owasp.org | Contact Us | Brought to you by the OWASP Foundation

2015 Global Board Election Results OWASP in the News 2015 WASPY Award Winners OWASP Translations: ASVS Women in AppSec: Diversity Leads to Success NEW Tool: Trello	Project Summit at AppSecUSA Latest Releases ZAP Scripting Competition Results OWASP Code Review Guide Survey NEW Initiative: OWASP Research	Global AppSec Events Local and Regional Events Partner and Promotional Events
New OWASP Chapters Chapter Transitions New Student Chapters New Academic Supporters Chapter Activities	Premier Corporate Members Contributing Corporate Members	OWASP Foundation Social Media

---

---

	OWASP Communications
2015 Global Board Election Results https://www.owasp.org/index.php/2015_Global_Board_of_Directors_Election Turnout 855 (33.0%) of 2587 electors voted in this ballot As a % of 855 Tobias Gondrom 459 53.7% Michael Coates 414 48.4% Tom Brennan 312 36.5% Josh Sokol 304 35.6% Jonathan Carter 226 26.4% Abbas Naderi Afooshteh 178 20.8% Bil Corry 175 20.5% Milton Smith 172 20.1% Nigel Phair 125 14.6% VOTER SUMMARY Total 855 Abstain 36 4.2%
OWASP in the NEWS! OWASP Projects and activities are often the subject of webcasts and podcasts. Sit back and relax as you watch and listen to these recent episodes. Simon Bennetts - OWASP ZAP Q&A session ZAP, Xenotix XSS Exploit Framework, O-Saft and OWTF - 2015 BOSSIE Awards OWASP Top 10 - "Don't Let Your SMB Get Caught With Its Pants Down," Huffington Post Mark Miller - OWASP 24/7 Podcast Series
WASPY Award Winners The results of the OWASP WASPY Awards have been announced and posted to our website. Thanks to all who made a nomination and congratulations to the winners. Open/Leading Category European Region: Eoin Keary United States Region: Jeremiah Grossman Latin American Region: Mateo Martinez Caribbean Region: Johanna Curiel Integrity/Learning Category European Region: Antonis Manaras & Mateo Martinez (OWASP Student Chapters Program Leaders) United States Region: Pedro Peralta Asia/Pacific/Middle East Region: John Patrick Lita Caribbean Region: Johanna Curiel Innovation/Sharing Category African Region: Munir Njiru European Region: Fiona Collins Latin American Region: Diego Ademir United States Region: Jeremy Long Global/Growing African Region: Munir Njiru Asia/Pacific/Middle East Region: John Patrick Lita European Region: Jason Alexander Latin American Region: John Vargas United States Region: Jerry Hoff View the complete results and vote counts at https://www.owasp.org/index.php/WASPY_Awards_2015#Results.
OWASP Translations: ASVS OWASP ASVS — Translation Project has been added to Crowdin. Crowd In is a community translation platform. If you speak another language other than English, we would really appreciate it if you could join Crowd In, and become a member of the ASVS project page and commit some time to developing a translation into your local language.Help us translate OWASP ASVS and bring it to the world! https://crowdin.com/project/owasp-asvs.
Women in AppSec: Diversity Leads to Success Study after study has shown that diverse teams are more successful. Forbes reports that diversity is key driver of internal innovation and business growth. McKinsey & Company study showed that diverse organizations are more likely to have financial returns above their respective national industry medians. The OWASP Women in AppSec (WIA) diversity initiative aims to increase the participation and visibility of women in the applications security field. WIA is seeking volunteers to help with projects in 2016 now! Fill out the WIA planning survey at https://www.surveymonkey.com/r/SRNLD7H and get involved today. Increasing diversity is an effort that relies on all of us to be successful, so all genders are welcome and encouraged to participate.
NEW Tool: Trello Trello is a collaboration tool that organizes your projects into boards. In one glance, Trello tells you what's being worked on, who's working on what, and where something is in a process. The OWASP Foundation has obtained a free premium Trello account for our community. If you are interested in having your own board for your project or chapter, please ping Fabio Cerullo at fcerullo@owasp.org. Some of the projects and chapters using the Trello board are Campinas/Sao Paulo, Delhi, CSRFGuard, ZAP as well as the global Board and the AppSecUSA Chapter Leader Workshop. Visit these boards for ideas on how to use them for collaboration in your group: https://trello.com/owaspfoundation

---

OWASP Projects

Project Summit at AppSecUSA Several OWASP Projects participated in the AppSecUSA Project Summit. A lot of good feedback, Github updates and new documentation served to level up all participating projects. Visit the project pages for updates or contact the leaders to find out how you can get involved: OWASP Security Shepherd Project Mark Denihan, Pol McCana, Philip Payne, Ryan Foushee Updated Github Wiki Created new levels New Specifications made in version 3 Created new level templates Project up for review to Flagship phase Eliminated issues that were blocking the progress of the docker file. OWASP Code Review Gary Robinson, Larry Coklin Editing doc for Release Gained a new contributor Prepared Community Survey: “OWASP is interested in the ownership perception of security controls effectiveness”. Results will be posted on the next board meeting. OWASP Cheatsheet Series & Proactive Controls Jim Manico & Andrew Van Der Stock Open Discussion and collaboration Great discusssions and was much needed OWASP Python Security Enrico Branca Received Feedback from the other project leaders and attendees. Found how to share technical documents and how to organize issues by using ASVS/SKF. Gained valuable information to move the project forward. OWASP Security Knowledge Framework Glenn Tate Cate Shared knowledge, got some some feedback. Helping review ASVS Project Checking with Python Security Project OWASP WAFEC Tony Turner, Rafael Chiles Restart the Project Updating the wiki content and Github Great was a great experience as this was my first Project Summit OWASP O2 Platform Michael Hidalgo Restart the Project Updating the wiki content and Github Great was a great experience and enjoyed the open forum OWASP PodCasts created by Mark Miller offer a great forum for getting an update on projects. Listen to interviews with project leaders at https://soundcloud.com/owasp-podcast. Latest Releases OWASP Security Shepherd Project Mark Denihan Download: https://github.com/OWASP/SecurityShepherd/releases/tag/v3.0 Project Page: https://www.owasp.org/index.php/OWASP_Security_Shepherd Just a heads up that the Security Shepherd Team have dotted the i's and crossed the t's on our latest version. Please share, tweet, blog, smoke signal the milestone and check out the latest release yourself. OWASP Application Security Verification Standard Jim Manico, Andrew Van der Stock, Daniel Cutbert Project Page: https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project#Version_3_.282015.29 I'm really proud to announce that the latest Application Security Verification Standard (ASVS) 3.0 is ready. OWASP Mobile Security Project Milan Singh Thakur, Jonathan Carter Project Page: https://www.owasp.org/index.php/OWASP_Mobile_Security_Project#tab=Guide_Development_Project Download: https://drive.google.com/file/d/0BxOPagp1jPHWczhwYjRQNzZIekU/view?usp=sharing The APPSEC Approach - Download OWASP-Mobile Security Testing Guide BETA OWASP Seraphimdroid v.2 Nikola Milosevec Download: https://play.google.com/store/apps/details?id=org.owasp.seraphimdroid Project Page: https://www.owasp.org/index.php/OWASP_SeraphimDroid_Project OWASP Seraphimdroid V2 has been released as a result of OWASP Summer Code Sprint. The mission of OWASP Seraphimdroid is to create, as a community, an open platform for education and protection of Android users against privacy and security threats. OWASP Searaphimdroid is an Android privacy and security protection application with secondary aim to make mobile security, threats and risks visible to users. ZAP Scripting Competition Results ZAP Scripting Competition results are now available at https://www.owasp.org/index.php/2015-08-ZAP-ScriptingCompetition. For more information about OWASP Projects, please visit the Project Wiki Page OWASP Code Review Guide Survey The OWASP Code Review Guide team surveyed attendees at AppSec USA to find out how attendees rated the effectiveness of various security tools/reviews at finding issues, such as business logic problems, or each of the OWASP Top 10. Our intention was to evaluate if Secure Code Review (the topic of our guide) is seen as an effective security process in an organizations SDLC. The Survey results will be included in the next version of the guide. New Initiative: OWASP Research OWASP Research is an initiative to start developing OWASP projects in the field of innovative research,specifically new ways to protect web applications by applying out of the box concepts and technological developments. Contact Johanna Curiel for details or visit http://www.owasp.org/index.php/Global Initiatives#Research.

---

	OWASP Events
Global AppSec Events
	Mark your Calendar! AppSECEU 2016 is coming to Rome, Italy on 27 June to 1 July 2016! The Call for Trainings is Now Available! Deadline for proposals: 31 December, 2015. The Call For Papers is open until January 15, 2016. Submit yours soon.
Regional and Local Events AppSec Rio de la Plata 2015, December 1, 2015 - December 3, 2015, Montevideo, Uruguay German OWASP Day, December 1, 2015 - December 3, 2015 OWASP Gothenburg Day, December 8, 2015, Gothenburg, Sweden AppSec Cali 2016, Jan. 25, 2016 - Jan. 27, 2016, Santa Monica, CA New Zealand Day 2016, February 3, 2016 - February 4, 2016, Auckland, New Zealand Conference Videos AppSecUSA Videos from 21 of our sessions and keynotes are now available on YouTube. Look for more uploads to come featuring keynotes, special panels and talks. Videos from our OWASP Eastern European Conference are also available on YouTube. Stay tuned for videos from last week's LASCON (Lonestar Application Security Conference) event in Austin, TX, USA. Partner and Promotional Events OSCON Amsterdam, October 26 - October 28, 2015 Amsterdam, The Netherlands SecureWorld Expo - Bay Area, November 4, 2015, San Jose Marriott, CA, USA 4th Annual CISO ASIA Summit & Roundtable, November 2, 2015 - November 4, 2015 Harbour Grand Kowloon, Hong Kong Blackhat Europe 2015, November 10, 2015 - November 13, 2015 Amsterdam, The Netherlands SC Congress Boston, November 12, 2015 Metro Metting Centers Boston, MA, USA SC Congress Chicago, November 17, 2015 Revel @ Fulton Market Chicago, IL, USA SANS CyberTalent Fair, November 19, 2015, Virtual On-line CyberSecure December 15 - 16, 2015 The Sheraton Times Square New York, NY, USA CodeMash January 5 - 8, 2016 Sandusky, Ohio, USA BSides Lagos January 22, 2016 Nigeria SC Congress London, February 10, 2016 ILEC Conference Centre London, UK SC Congress Toronto, June 1, 2016 - June 2, 2016 Metro Convention Center Toronto, CN

---

Ads are not endorsements and reflect the messages of the advertiser only.They represent co-marketing arrangements with other organizations in support of the OWASP Community.   CLICK HERE for more information on advertising.

---

OWASP Chapters

We had a lot of activity in our chapters since our April 21 Connector: 18 New Chapters (red), 13 Leadership Transitions (pink), two New Student Chapters (blue) and six new Academic Supporters (light blue). Click on the map to see our newest chapters. New Chapters Atlantic Canada: Leader, Scott Deveaux, scott.deveaux@owasp.org Bhopal, India: Leader, Akshay Sharma, akshay.sharma@owasp.org Bulawayo, Zimbabwe: Trevor Sibanda leader, trevor.sibanda@owasp.org Cagayan Valley, Philippines: Leader, Charmagne Cumigad,charmagne.cumigad@owasp.org Cape Town, South Africa: Leader, Timo Goosen, timo.goosen@owasp.org Colorado Springs: Leader, Mike Forgione, mike.forgione@owasp.org Cotonou, Benin: Leader, Apollin Moyo, apollin.moyo@owasp.org Columbia, SC, USA: Leader, Frank Catucci, frank.catucci@owasp.org El Salvador: Leader, Nelson Chacon, nelson.chacon@owasp.org Gwalior, India: Sumit Ojha leader,sumit.ojha@owasp.org Kern County, CA, USA: John Stampfli leader, john.stampfli@owasp.org Madurai, India: Leader, M.S. Siva Kumar Odessa, Ukraine: Leader, Vladimir Garbuz, vladimir.garbuz@owasp.org Panay, Philippines: Francis AI Victoriano leader,francis.victoriano@owasp.org Southern New Hampshire, USA: Leaders, James Burroughs, Edmond Holohan and Garrett Klok Spotsylvania, VA, USA: Leader Arnold Webster arnold.webster@owasp.org Stamford, CT, USA: Maria Sette leader,maria.sette@owasp.org Taguig, Philippines: Gil Tario II leader, gil.tario@owasp.org Trinidad and Tobago: Laura Bigram leader, laura.bigram@owasp.org Chapter Transitions Bhopal, India: New Leader added Nandan Yadav, Nandan.Yadav@owasp.org Bristol, UK: Katy Anton and Sash Rigby, katy.anton@owasp.org,sash.rigby@owasp.org Brooklyn, NY, USA: Added leaders Emily Wicki and Nicole Becher,emily.wicki@owasp.org,nicole.becher@owasp.org; Loren Davie is stepping down. Charlotte, NC, USA: New leader Rob Taylor rob.taylor@owasp.org Cyprus: New leaders, Christos Papadopoulos,christos.papadopoulos@owasp.org and Yiannis Ioannides,yiannis.ioannides@owasp.org Iceland: New Leaders, Þröstur Spörri Jónasson, Sigmundur Jónsson, Thorlaug Agustsdóttir, Sverrir Davíðsson, Theodor Gíslason,throstur.sporri.jonasson@owasp.org,sigmundur.jonsson@owasp.org,thorlaug.agustsdottir@owasp.org, ,sverrir.davidsson@owasp.org,theodor.gislason@owasp.org Khartoum, Sudan: New leaders added, Ahmed Abbas ahmed.abbas@owasp.org, Asim Jaweesh asim.jaweesh@owasp.org, and Obay Albadri obay.albadri@owasp.org Kenya/Nairobi: The inactive Nairobi chapter will merge with Kenya. Kenya team is incorporating historical info on past Nairobi meetings on their page. Nairobi leaders have been invited to join Kenya leadership team. Kolkata, India: Added leader Dibyendu Sikdar, dibyendu.sikdar@owasp.org Manila, Philippines: Jan Jancosin (jan.jancosin@owasp.org) added to leadership team Orange County, CA, USA: New leader, Haral Tsitsivas, haral.tsitsivas@owasp.org Pune, India: New leader, Ashwini Paranjpe, ashwini.paranjpe@owasp.org New Zealand: New leader added in Wellington, Kirk Jacksonkirk.jackson@owasp.org New Student Chapters IIT Kanpur Student Chapter, Kanpur, India University Lucian Blaga of Sitiu, Romania New Academic Supporters Anglia Ruskin University, Cambridge, UK De La Salle University, Philippines Masinde Muliro University of Science and Technology, Kenya Philippine Institute of Cyber Security Professionals, Manila, Philippines Rotterdam University of Applied Sciences, Rottterdam, Netherlands Universiti Tecknologi Malaysia, Kuala Lumpur, Malaysia Chapter Activities On October 12 2015, OWASP Panay chapter leader Francis Victoriano presented OWASP Top 10 at Aklan State University and at Filamer Christian University, a future academic supporter, on October 21. Almost 300 students attended the latter event, and they are planning to invite OWASP Panay next year. On October 7, OWASP Kerala hosted sessions at PRS College with an amazing turn out of more than 150 students from various semesters of Computer Science and Electronics Department - organized in multiple sessions throughout the day with back to back non stop sessions. It was a great event and was so exciting to interact with the students. The engineering schools in Kerala, India under the Kerala State University system have signed on as OWASP Academic Supporters. We at the OWASP Global Foundation are looking forward to hearing about more such events in future. Share your chapter's successes! Submit your stories here

---

	OWASP Membership
Premier Corporate Members Salesforce Qualys Contributing Corporate Members Autodesk Veracode Sonatpe Checkmarx Protiviti HERE North America Thoughtworks UPS Rapid 7 Brocade SMARTRAC TECHNOLOGY GMBH CD Networks Information Builders Security Compass Synopsys NE GoSecure AsTech Consulting Imperva Johnson Controls ClassDojo

---

	OWASP Social Media
OWASP Social Media Site OWASP YouTube Channel LinkedIn Twitter Google + Facebook Ning StackOverflow GitHub Trello Slack