AppSec USA 2014 Offers World-Class Training Sessions

“Something that looks like a protocol but does not accomplish a task is not a protocol—it’s a waste of time.” 
― Bruce Schneier, Applied Cryptography

You won’t want to miss Bruce Scheier’s keynote at the AppSec USA 2014 conference September 16-19 in Denver.  But you also can’t afford to miss AppSec USA’s two full days of training sessions featuring top experts collaborating with you and your peers on the latest application security challenges and industry trends.

Register today for AppSec USA and the training sessions at http://2014.appsecusa.org/

Below are the brief overviews of AppSec USA’s 2014 training sessions. Click the links to learn more about the session and presenters.

Advanced Web Penetration Testing (2 Days)  

Presented by Secure Ideas

The advanced web penetration testing course is designed to be a hands-on course that will expand both internal and external security personnel testing knowledge.

Cryptography for the Modern Develop (1 Day)  

Presented by Blindspot Security LLC

This course is designed to provide attendees with the core concepts required to make informed decisions about what cryptographic primitives and APIs are safest to use in practice. The content will include approximately 50% lecture and 50% labs or other exercises to reinforce the concepts presented.

Malware Analysis Crash Course (2 days)

Presented by Mandiant, a FireEye Company

This course provides a rapid introduction to the tools and methodologies used to perform malware analysis on executables found on Windows systems using a practical, hands-on approach. 

Managing Web & Application Security – OWASP for Senior Management (1 day)

Presented by Tobias Gondrom

Managing and improving your global information security organization; Leverage OWASP and common best practices to improve your security programs and organization; Achieving cost-effective application security; Bringing it all together on the management level.

OWASP Top 10 – Exploitation and Effective Safeguard (2 Days)

Presented by Albero Solutions

This course aims at providing all web developers deep hands-on knowledge on the OWASP Top 10 web application vulnerabilities list.

Ruby on Rails – Auditing & Exploiting the Popular Web Framework (2 days)

Presented by Recurity Labs

After the training the participants will be able to assess, audit and exploit Ruby on Rails applications. This includes knowledge about the inner workings of the framework itself as well as a set of decent payloads for practical demonstration of vulnerabilities.

Securing Mobile Devices and Applications (2 Days) 

Presented by Aspect Security

This hands-on course enables students to understand how easily mobile devices and applications can be attacked. They will learn how to identify, avoid and remediate common vulnerabilities by walking through a threat analysis and learning critical security areas such as those identified in the OWASP Top Ten Mobile Risks and Controls.

OWASP + TrustyCON + BSidesSF / IATC

********BEGIN TRANSMISSION******

Technology should not only be Secure, it should be Trustworthy.
Raise Visibility for the community: https://www.thunderclap.it/projects/8350-the-cavalry-isn-t-coming

If you follow the OWASP Top 10  A2, A4, A5, A6, A9 is why you should join the discussion with your peers -- read on 

o()xxxx[{:::::::::::::::::::::>

OWASP  ** BSIDESSF ** TrustyCON

Background
As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA

 
News Report
http://www.reuters.com/article/2013/12/20/us-usa-security-rsa-idUSBRE9BJ1C220131220

Technical primer
http://arstechnica.com/security/2014/01/how-the-nsa-may-have-put-a-backdoor-in-rsas-cryptography-a-technical-primer/

The Cavalry Isn't Coming  It falls to us. Be a voice of reason. Drive cyber security for public good and public safety - have the discussion and learn about the impact.

o()xxxx[{:::::::::::::::::::::>

TrustyCON
Join us for the first Trustworthy Technology Conference, to be held on 27 February 2014 at the AMC Metreon Theatre in San Francisco, California. We welcome all security researchers, practitioners and citizens who are interested in discussing the technical, legal and ethical underpinnings of a stronger social contract between users and technology.

https://trustycon.org/

o()xxxx[{:::::::::::::::::::::>

BSIDESSF

BSides are about extending conversations in an open environment, not imposing a single point of view on anyone

This year's conference season has begun with controversy; we encourage everyone to speak, attend, and participate in events as they feel personally appropriate.
When: Sunday and Monday, February 23-24, 2014 Where: DNA Lounge (375 Eleventh Street, San Francisco, CA 94103) Times: 9am - 6pm

http://www.securitybsides.com/w/page/70849271/BSidesSF2014

o()xxxx[{:::::::::::::::::::::>

OWASP

The Open Web Application Security Project (OWASP), the premier global not-for-profit devoted to improving software security, is hosting a special security boot camp open to the public for FREE

WHAT:
The course will introduce and demonstrate application assessment techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code and understand fixes.

WHEN:
Monday, Feb. 24, 2014 2pm-5pm

WHERE:
Jillian's Billiards Club of San Francisco
175 Fourth Street, San Francisco, CA 94103

(Across the street from Moscone Center where the RSA Conference is being held.) The boot camp will be followed by an open Happy Hour sponsored by the Bay Area OWASP Chapter from 5pm-7pm, also at Jillian's.

COST:
The training is a FREE service of OWASP, open to anyone interested in securing their code.

Pre-registration is recommended to guarantee a spot in the training, but we will accept walk-ins based on available space. The Happy Hour is open to the public and no registration is required. To register for training, visit: http://www.eventbrite.com/e/free-owasp-training-tickets-10302967453

About OWASP Foundation

The Open Web Application Security Project (OWASP) is dedicated to making application security visible by empowering individuals and organizations to make informed decisions about true software security risks. As a 501(c)(3) not-for-profit worldwide charitable organization, OWASP does not endorse or recommend commercial products or services. Instead, we allow our community to remain vendor-neutral with the collective wisdom of the best individual minds in software security worldwide.


https://www.owasp.org/index.php/OWASP_Statement_on_the_Security_of_the_Internet_2014


o()xxxx[{:::::::::::::::::::::>

The Cavalry Isn't Coming
It falls to us.
Be a voice of reason.
Drive cyber security for public good and public safety.
http://www.iamthecavalry.org/

Technology should not only be Secure, it should be Trustworthy.
Raise Visibility for the community https://www.thunderclap.it/projects/8350-the-cavalry-isn-t-coming

***END TRANSMISSION*********

12 Days of Christmas w/ Hacker Claus

Ok builders, breakers and defenders.... gather around the FIREwire and sing with me;

On the 1st day of Christmas a malicious hacker faxed to Johnny <pause> poof of SQLi in his production website (database using SELECT * FROM members WHERE username = 'admin'--' AND password = 'password') with a username list

On the 2nd of Christmas the hackers gave to Johnny Cross Site Scripting vuln in his high risk web application <IMG SRC="javascript:alert('XSS');"> that his automated scanner missed and a link to OWASP Cheat Sheets and Core Rule Set  suggestions for monitoring and potentially blocking the input, output, or system service calls. 

On the 3rd day of Christmas the hackers gave to Johnny Insecure Direct Object Reference on a critical system that provided full admin access to the application because....  Johnny made a mistake and forget to add a rule to deny any to a obscure management port  http://yourwebsite.com/secret/adminconsole:8050

On the 4th day of Christmas the hackers gave to Johnny.... A FREE .PDF Book on how to find application security flaws and the NEW video series from AppSecUSA 2013 (43) Videos and 32 hrs of content

On the 5th day of Christmas the malicious hackers parked in front of Johnnies favorite coffee shop and conducted a man-in-the-middle hot-spot honeypot -- then proved to Johnny that "Password1" is not a good password and how quickly a hash can be cracked

On the 6th day of Christmas the hackers gave to Johnny code snips of critical system code on the new secret internal project that they picked up from PasteBin

On the 7th day of Christmas a hacker breached Johnnies door using a "9999" cut bump key on door #1, a shim on the padlock that secured important information and placed a "boom" sign inside my top right desk draw that was locked to prove a point about my lame physical security... --- seems they also drank his 18 year old scotch too!

On the 8th day of Christmas the hackers returned to Johnny a bag of dumpster diving treasure to point out lack of cross-cut shreder  that included bills from trusted vendors with account info, credit card carbons, internal printed emails, customer data and more...

On the 9th day of Christmas hackers hacked Johnny via an email aimed at his wife concerning a refund of a holiday purchase with targeted malware using a custom packer that bypassed my installed and updated corporate AV investment.  After getting a remote shell they then popped Johnnies work laptop that was also connected to my home network that was unpatched due to the holiday freeze then exported the cert on the VPN client installed a keystroke logger on the computer that I use for business to capture the password....  ouch..

On the 10th day of Christmas the hackers gave to Johnnie a FREE audio blog to help educate him

On the 11th day of Christmas the hackers knocked down my e-commerce website during the busy online shopping season with a Denial of Service Tool 

On the 12th day of Christmas hackers mailed a link... Johnny noticed his company was on the list of incidents involving the breach of personally identifying information (PII) and his information may have been in a dump of over 2M users due to his machine was infected with malware from Day #1

...... as a result he reached out to the LOCAL OWASP Chapter and started to ask questions, review the OWASP Foundation website and intresting projects including the  Enterprise Security API (ESAPI), Free Videos, Guidance on Mobile Security, Jobs Postings from around the world and over 100+ other projects: https://www.owasp.org/index.php/Category:OWASP_Project

May all your Christmases be #FFFFFF