Monday, April 24, 2017

Connector April 2017

OWASP Connector
FOLLOW US

           
  COMMUNICATIONS |  PROJECTS |  EVENTS |  CHAPTERS |  MEMBERSHIP  
Mon, April 24, 2017
OWASP CONNECTOR
Communications

OWASP in the News


Operations Update

The April Operations Update includes vital information about OWASP's infrastructure initiatives, project activity, and Chapters. Read it for an overview of what is happening in OWASP.
 
Projects

Project Releases

OWASP Samm has released version 1.5 Updates to SAMM allow users to assess their programs with greater granularity. The new version also shares case studies to help departments plan how to handle their (matt what is the phrase?!)
OWASP ZAP released API and browser extensions. The full release also includes a new JxBrowser add-on as well as platform specific webdrivers to make it easier to use ZAP on any web browser.
OWASP would like to welcome our new incubator project, OWASP Threat Dragon, to the fold. Threat Dragon is an online threat modelling application which includes system diagramming and a rule engine to auto-generate threats/mitigations. The tool focuses on UX design, a powerful rule engine and integration with other development lifecycle tools.
The Release Candidate for the OWASP Top 10 2017 is now available for Download. Please forward it to all the developers and development teams you know. The primary change is the addition of two new categories:
  • 2017-A7: Insufficient Attack Protection
  • 2017-A10: Underprotected APIs
The final version of the OWASP Top 10 - 2017 is planned to be released in July or August 2017 after the public comment period ends June 30, 2017. Comments on this OWASP Top 10 - 2017 Release Candidate should be forwarded via email to OWASP-TopTen at lists.owasp.org. Private comments may be sent to dave.wichers at owasp.org. Anonymous comments are welcome.
Your feedback is critical to the continued success of the OWASP Top 10 Project. Thank you all for your dedication to improving the security of the world’s software for everyone.

Project Summit Belfast Activities Grow in 2017

The OWASP Project Summit at AppSec Europe in Belfast this year is shaping up to be an exciting event with nine projects already committed and several activities planned to improve projects.
Project Summits at Global events include working sessions that allow project leaders and contributors to work together face to face in intense and productive environments to move their projects forward. This is a great opportunity for local contributors or those attending the conference to become more deeply involved in OWASP Projects.
Project summits also include other working sessions such as the the Project Review session, where participants will help us review projects for advancement through our Incubator>Labs>Flagship structure, as well as sessions meant to gather feedback from project leaders to shape the growth of OWASP Projects as a whole. As a participant you will have a direct influence on the future of the OWASP Projects program.
You can sign up today to join a project working session or see if you qualify for sponsorship as a project leader.

Ads are not endorsements and reflect the messages of the advertiser only. They represent co-marketing arrangements with other organizations in
support of the OWASP Community.  CLICK HERE for more information on Advertising.
 
Events

Free Training at the AppSec Eu Developer Summit

The OWASP Developer Summit educates developers about common vulnerabilities present in web and mobile applications, including how to use tools like OWASP ZAP to implement a secure software development lifecycle. 2017 AppSec Eu Developer Summit sessions are free hands-on workshops where attendees will learn how to do actual penetration tests on vulnerable and real applications as well as implement a secure pipeline.
This year, sessions will include on-deploy testing, hacking real mobile banking apps, and understanding vulnerabilities in your apps. The Developer Summit is in depth hands on training perfect for any developer regardless of background in security.
Come by yourself or grab a couple of friends, but registration is necessary.

What to Expect at AppSec Europe in Belfast

AppSec Europe is just around the corner, where a number of experiences await you.
Talks are the heart of every Global AppSec
  • Sessions have been selected and include topics such as breaking CSPs, threat modeling, hacking configuration management systems, hacking contactless payments, GDPR, quantum safe crypto, securing Azure Cloud, Oauth2, bypassing XSS controls, pentesting voice biometrics and even printer security!
  • In addition to that we'll have panels on diversity and hacking elections, along with interactive sessions allowing everyone to get out their laptop and hack a few websites.
  • While this year's tracks are aimed at developers, ethical hackers, CSIOs and DevSecOps, we will also have 'Hallway Tracks' allowing anyone to setup their own talk or discussion session, as well as HackPra AllStars and lightning talks.
Training at AppSec Europe is always top tier
  • Training sessions are available from https://2017.appsec.eu/program/training and include Mario Heiderich on exploiting websites, Robert Seacord on secure Java, mobile, python, machine learning, IoT and SSO exploitation, web app security with Fabio Cerullo, and Docker and DevOps security sessions.
  • ​Of course we are offering 100 euro off if you purchase training with your conference ticket. Spots are limited so register now.
Summits provide you with satisfying pre-conference experiences
  • The Project Summit brings contributors and project leaders together for face to face project work sessions. With additional listening sessions about Hot Topics, this is the place to make your voice heard when it comes to the OWASP Projects program. 2017 is also year we are hosting project reviews live.
  • The Developer Summit is THE place to be to get free AppSec training tailored to developer’s needs. Two days and three sessions of stellar, hands on training will make you a stronger developer or begin the jump to security.
Membership has its perks
  • OWASP is glad to once again bring the Member Lounge to AppSec Europe. A quiet place set aside for members who need to host a meeting, charge their phones or laptops, or just sit and relax a while, the Member Lounge is all about your needs.
  • Coffee, snacks, your membership T-Shirt, and other goodies await you in Belfast!
Social events round out every phase of the conference
  • AppSec EU Belfast comes with a full social calendar, with the main conference dinner taking place in the Titanic Suite of the Titanic Visitor Center, voted the best worldwide tourist attraction in 2016, including drinks, music and a bit of unique entertainment. This venue looks out onto the Game of Thrones studios here in Belfast.
  • In addition there'll be a Pre-Conference drinks event on the Wednesday night, allowing everyone to settle in and mingle at the conference venue.
  • Don't forget to play along in the AppSec Europe Pub crawl, Doors of Westoros tours, or AppSec Bingo
The usual events that make OWASP events so special

Call for Papers for AppSecUSA Open

appsec usa connector header 2
AppSec USA is proud to announce the Call for Papers and Call for Training are open. OWASP AppSec USA is a premier venue for web application security leaders, software engineers, researchers and visionaries from all over the world. OWASP AppSec USA gathers the application security community in a four day event to share and discuss novel ideas, initiatives, and advancements. The 2017 edition will take place in Orlando from September 19-22.
We are looking for "the next", cutting edge research in the context of web applications, secure development, security management, and privacy. Our goal is to give academic researchers and industry practitioners an opportunity to share their latest findings with the rest of the community, including coverage via our media channels.
All talks are 40 minutes in duration. For AppSec USA 2017 we encourage and prioritize submissions in the following themes:
Web Application Security – Research and new work impacting the security of web applications.
DevOps – Research and new work impacting the security of DevOps processes, architectures, and tools.
Cloud Security – Research and new work impacting the security of applications designed for and/or deployed to cloud environments, especially public cloud environments.
Our Call for Training topics are looser, but trainings should be of a practical nature, hands on training is strongly preferred. Trainings may be one or two days in duration. Please refrain from submitting marketing talks or including sales pitches within the training.
To submit your talk or training please make sure to select the appropriate topic(s) from the form and submit:
Your submission packet will be judged in a blind reading so please make sure that your abstract is appropriately thorough. You may attach a preliminary version of your presentation if available. If accepted your biography will be printed 1:1 in the program. The same form is used to apply for both the CfT and the CfP, so please make sure to choose the correct application from the menu.  Talks without all required information may not be considered.


AppSec USA Sponsorships Nearly Soldout

There are only a few remaining sponsorships left for AppSec USA. The expo floor plan designed to maximize foot traffic to YOUR booth, you can be assured that you will maximize lead generation activities. Additionally, the planning team has several events planned to encourage a family friendly atmosphere to drive attendance numbers skyrocketing upwards, and what better place than Walt Disney World?
The vendor booths are located in high track areas so that you can be assured to get the attention of more than 1,000 security decision makers, influencers, and practitioners in the community. This is the opportunity for your company to recruit, generate business,and share ideas. Grab your booth today before space runs out.

Up Coming Events

Global AppSec Events

Regional and Local Events

 

Project Summits


 

Developer Summits

Partner and Promotional Events

 

Chapters

You are Invited to the Leadership Workshop

Project and chapter leaders are invited to the Leader’s Workshop at AppSec Europe in Belfast. The Leader’s workshop is the place where leaders can give face to face feedback about the OWASP Chapter and Projects programs. This session will focus on upcoming changes in the OWASP association management tool (AMS) which will give leaders unprecedented control over their interactions with volunteers, the owasp volunteer program, and the new replacement for Mailing Lists through Mailman. Join us at 18.45 Wednesday night in room 1 of the Waterfront Center.

Welcome New Chapters

Senegal    Da Nang    Cordoba    Cali    Little Rock
 
Membership

April 2017 Corporate Members

 
April 2017 Corporate Members
We would like to thank the following companies for supporting the OWASP Foundation.  The companies listed below have contributed this month by either renewing their existing Corporate Membership or joining OWASP as a new Corporate Member.  Details about Corporate Membership can be found here.
Contributor Corporate Members
 
Denim Group is a custom software development firm skilled in large-scale development projects across multiple platforms, languages and applications. What makes Denim Group unique is that the company brings significant core competencies in software security to the table, offering an innovative blend of secure software development, testing and training capabilities that protect a company’s biggest asset, its data. Denim Group customers span an international client base of commercial and public sector organizations across the financial services, banking, insurance, healthcare and defense industries. Its depth of experience building large-scale software development systems in a secure fashion has made the company's leaders recognized experts in their fields. Denim Group has been recognized as one of the 5,000 Fastest Growing Company's by Inc. Magazine several years in a row, and has won multiple awards including its recent accolades as one of the best places to work in San Antonio.
For more information, please visit: http://www.denimgroup.com

Kiuwan provides an end-to-end Software Analytics platform that offers objective data to make informed decisions ro secure, analyze and control the entire SDLC of any application portfolio. With Kiuwan Code Security, the scope in threat mitigation is unparalleled, with over 4000+ custom rules, ability to suppress defects and create tailored action plans while meeting the most stringent industry standard requirements. In constant evolution, it boasts broad language support and integration with Jira, Jenkins and Github to name but a few of the possibilities brought about by the platform.
For more information, please visit: https://www.kiuwan.com/

SpringCM delivers an innovative document workflow and management platform, powering the leading contract management application. SpringCM empowers companies to become more productive by reducing the time spent managing mission-critical business documents. Intelligent, automated workflows enable document collaboration across an organization from any desktop or mobile device. Delivered through a secure cloud platform, SpringCM’s document and contract management solutions work seamlessly with Salesforce or as a standalone solution. Every day, more than 600 companies use SpringCM to improve the customer experience and get more done, faster. For more information about SpringCM, visit www.springcm.com

Symantec Corporation (SYMC) is an information protection expert that helps people, businesses and governments seeking the freedom to unlock the opportunities technology brings -- anytime, anywhere. Founded in April 1982, Symantec, a Fortune 500 company, operating one of the largest global data-intelligence networks, has provided leading security, backup and availability solutions for where vital information is stored, accessed and shared. The company's more than 20,000 employees reside in more than 50 countries. Ninety-nine percent of Fortune 500 companies are Symantec customers. To learn more go to www.symantec.comor connect with Symantec at: www.symantec.com/social/


Want your company name here?  Find out how by visiting our Corporate Member information page, or contact Kelly Santalucia, our Membership & Business Liaison today!

Thank you to all of our Premier and Contributor Corporate Members for your support!
The OWASP Foundation, 1200C Agora Drive #232, Bel Air, Maryland, 21014, USA

Labels: , , , , , , , ,

Friday, February 24, 2017

Project Review Session at OWASP Project Summit during Belfast APPSEC EU 2017

We have an open session for two days for Project Reviews during our OWASP Project Summit EU 2017 Belfast. We are looking for some volunteers to review projects and helping make OWASP Projects move to the next level with your expertise and feedback.

Please Sign Up and join us in APPSEC EU 2017 in Belfast!

We currently have these leaders attending and want to send thank you for stepping up to the challenge and thank Johanna Curiel, our current Vice Chair on the Board, for helping us lead this effort.
  • Azzeddine Ramrami
  • Talal Albach
  • Kuai Hinojosa
  • Nabin Kc

Overview of Project Reviews:

OWASP is reviewing projects who wish to graduate from Incubator to Lab to Flagship.  The purpose of this assessment is to determine whether a project meets the minimum criteria to graduate as outlined in the Project Health Assessment Criteria Document.  The review process begins with an initial self-assessment done by the project leader and reviewed by Matt Tesauro.  Next, the assessment enters the peer review phase where we ask volunteers in our OWASP Community to participate and finalize the results. I have included a Sample of a Project Assessment for your review and consideration.


Labels: , , ,

Monday, January 16, 2017

OWASP 2017 Graduation Reviews - Volunteers Needed!

OWASP is reviewing projects who wish to graduate from Incubator to Lab.  The purpose of this assessment is to determine whether a project meets the minimum criteria to graduate as outlined in the Project Health Assessment Criteria Document.  The review process begins with an initial self-assessment done by the project leader and reviewed by Matt Tesauro.  Next the the assessment enters the peer review phase where we ask volunteers in our OWASP Community to participate and finalize the results.   


It is our goal to have at least two or three reviewers per project to provide their expertise and feedback for each OWASP Project listed below.  If you would like to help sign up by February 15th.

I have included a Sample of a Project Assessment for your review and consideration.


 



Type of Project:  Tool
Project Leader: Bjoern Kimminich
Project Name: OWASP Juice Shop Project
Wiki Page:  https://www.owasp.org/index.php/OWASP_Juice_Shop_Project
Github Link: https://github.com/bkimminich/juice-shop

Description:​
OWASP Juice Shop is a professionally developed application using all sorts of quality assurance tools and automation processes to ensure it is working as intended. The project is in development since October 2014 and just recently joined the OWASP project inventory. It would be unfortunate to leave it in "Incubator" state longer that absolutely necessary given the maturity the project gained over the last 2 years.





Type of Project:  Code
Project Name: OWASP DefectDojo Project
Project Leader:  Greg Anderson
Project Web Page:  https://www.owasp.org/index.php/OWASP_DefectDojo_Project
Project Github: https://github.com/OWASP/django-DefectDojo

Description:
An open source vulnerability management tool that streamlines the testing process by offering templating, report generation, metrics, and baseline self-service tools.  DefectDojo is a tracking tool written in Python / Django. DefectDojo was created in 2013 and open-sourced on March 13th, 2015. The project was started to make optimizing vulnerability tracking less painful. The top goal of DefectDojo is to reduce the amount of time security professionals spend logging vulnerabilities. DefectDojo accomplishes this by offering a templating system for vulnerabilities, imports for common vulnerability scanners, report generation, and metrics.




Type of Project: Tool 
Project Name: OWASP Benchmark Project
Project Leader:  Dave Wichers
Project Web Page:  https://www.owasp.org/index.php/Benchmark
Project Github: https://github.com/google/benchmark

Description:
An enormous amount of work has gone into this project already and we are planning to do a lot more. The ability to run the Benchmark in just a few minutes, and then score a large set of tools automatically once their results files have been produced is a significant capability that required a huge amount of work to produce. There is nothing else like it in the industry and the quality of the scorecard output is very high.






Project Type: Code
Project Name: OWASP Node.js Goat Project
Project Leader:  Chetan Karande
Project Web Page:  https://www.owasp.org/index.php/OWASP_Node_js_Goat_Project
Project Github: https://github.com/OWASP/NodeGoat

Description:
Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.






Project Type: Documentation
Project Name: OWASP Automated Threats to Web Application
Project Leader (s):  Colin Watson & Tin Zaw
Project Web Page: https://www.owasp.org/index.php/OWASP_Automated_Threats_to_Web_Applications
PDF Doc Link: https://www.owasp.org/index.php/File:Automated-threat-handbook.pdf

Description:
Web applications are subjected to unwanted automated usage – day in, day out. Often these events relate to misuse of inherent valid functionality, rather than the attempted exploitation of unmitigated vulnerabilities. Also, excessive misuse is commonly mistakenly reported as application denial-of-service (DoS) like HTTP-flooding, when in fact the DoS is a side-effect instead of the primary intent. Frequently these have sector-specific names. Most of these problems seen regularly by web application owners are not listed in any OWASP Top Ten or other top issue list. Furthermore, they are not enumerated or defined adequately in existing dictionaries. These factors have contributed to inadequate visibility, and an inconsistency in naming such threats, with a consequent lack of clarity in attempts to address the issues.




Labels: , , , , , ,

Monday, January 9, 2017

OWASP Project Graduation Update


Congratulations to Project Leaders below on moving your project forward to the next level!

New Flagship Project:
Lab to Flagship Status
Project Name: OWASP Security Shepherd
Project Leader:  Mark Denihan
Project Web Page:  https://www.owasp.org/index.php/OWASP_Security_Shepherd


New Lab Projects:

Project Name: OWASP Seraphimdroid
Project Leaders: Nikola Milosevic, Kartik Kholi


Incubator to Lab Status Project Review Report
Project Name: OWASP Security Logging Project

Project Leader:  Sytze van Koningsveld


-- 

Labels: , , , , ,

Thursday, December 22, 2016

OWASP Connector | December 21, 2016
Communications

2016 in Review; Looking Ahead

OWASP Operations Update

OWASP in the News!

projects

Project Reviews

New Projects in 2016!

ESAPI's New Project Leader

Conference

AppSecEU 2017

Global AppSec Events

Local and Regional Events

Training Events

Partner and Promotional Events

chapters

Chapter Handbook Review

OWASP is Testing Meetup Pro

Request for Blog Content

membership

New and Renewing Corporate Members

Social Media

OWASP Foundation Social Media



Communications
OWASP Communications

2016 in Review; Looking Ahead

2016 has been a period of radical change for OWASP, some of it was sudden and devastating, other changes were the culmination of months of small improvements. OWASP Foundation invites you to aid us in harnessing the energy from these changes to foment a period of radical growth in 2017.
The year in Review:
  • This year we lost our Executive Director, Paul Richie. He brought order and professionalism to OWASP. He raised our own high expectations and delivered on the things he set out to do. He made all of us that worked closely with him better and more effective. He will be greatly missed.
  • AppSec Europe and AppSec USA were both successful, with AppSec USA in DC selling a record number of tickets.
  • Two Successful Project Summits during AppSec EU and AppSec USA 2016 that allowed approximately 30 thirty Project Leaders to jump in with 'hands-on' work on a variety of OWASP Projects.
  • Our experiments with hosting a Member’s Lounge at global AppSec events where you can charge your electronics, lounge in a quiet space with colleagues, and grab some swag and a snack have been wildly successful.
  • We are happy to have nearly doubled our Premier Corporate Membership.
  • We gained a significant number of chapters in Asia, Africa, and Latin America.
  • We hired our new Senior Technical Coordinator, Matt Tesauro and Community Manager, Tiffany Long to help drive our Projects and Community-based programs forward.
  • There are so many more achievements in 2016 and all can be found in back issues of our OWASP Connector newsletters.
Looking Forward:
  • The OWASP Staff had developed a new communication strategy, The majority of which will be implemented 2017.
  • The OWASP Website Reboot began with the evaluation by Sooryen in 2016 and continues into 2017. You can see the plan here.
  • Owasp will implement our new association management system. This will integrate various back-end systems and lead to improved user experience for the OWASP global community.
  • We look forward developing our volunteer program in 2017.
  • OWASP is choosing a strategic objective for 2017, you can help by discussing the current suggestions or contributing your own.
On behalf of the entire Operations team, we look forward to making 2017 an exciting and productive year for OWASP.
Best,

Tiffany Long
OWASP Community Manager
Tiffany.Long@owasp.org



OWASP Operations Update

Starting in December 2016 and continuing throughout 2017, the staff are going to post monthly updates on the OWASP Blog so the community can keep up with what the OWASP Foundation is doing to make OWASP just that much better. We’re also open to starting brief weekly updates if the community wants to follow our direction more closely.
Read the December 2016 Operations Update here.



OWASP in the NEWS!

What The Galactic Empire Could Learn from OWASP – Stormpath, December 17, 2016
Protecting Yourself From Online Scammers – Fox2Now, November 30, 2016
Application Security Conference: AppSec USA – Resolute Technology Solutions, December 16, 2016
IT security skills dearth lifts SA's risk profile – IT Web Access Control, December 12, 2016

projects
OWASP Projects

Project Reviews

OWASP Project Inventory has 93 Projects (Code, Tools, or Documentation) produced by the efforts of volunteers. Projects are divided into three categories, Incubator, Lab and Flagship status. We currently have about 39 Projects in Flagship or Lab Status and the balance are in Incubator status. The main purpose for project reviews is to provide an evaluation based on a defined criteria which provides an incentive and measurement of a projects maturity as they grow from Incubator to Flagship.
Project reviews may be requested by the Project Leaders or flagged during each project's annual health check. The evaluation is based on defined criteria which attempt to gauge the project's quality, health (activeness), and stage within our incubator to lab to flagship continuum.
The review consists of an initial self-assessment done by the project leader which is peer reviewed by volunteers from OWASP. Next, OWASP staff take look over all the feedback on the project and ensure it meets the requirements for graduation. Once a project is ready for graduation, all the review feedback is presented to the community for any final comments or +1’s. You can view the four most recent reviews and share your thoughts here.



New Projects in 2016!

Documentation:

Tools:

Code:




ESAPI's New Project Leader

OWASP Enterprise Security API  Welcomes New Leader Matt Seil — By Kevin Wall
It is with mixed emotions that I am making this announcement, that Chris Schmidt is stepping down as long-time ESAPI co-leader and that Matt Seil will be taking over that position and attempting to fill Chris' shoes. On one hand, I'm saddened because Chris was such a great leader and contributor for ESAPI.
Chris took over as co-leader sometime in May 2011, at the same time that I did, when Jim Manico handed over us the reigns, but Chris' contributions to ESAPI go back way before my involvement and his contributions are much broader than mine. While I focused mostly on ESAPI's crypto and provided some occasional general ESAPI bug zapping, Chris had his hands in almost everything ESAPI (and I mean that in a good way). For instance, he single-handedly created the ESAPI for JavaScript and the ESAPI Spring Authenticator mini-projects. Chris also played the major role in the ESAPI 2.x's release management as well as creating the outline for the ESAPI 3.x interfaces. His wisdom, insigh, and broad experience will be sorely missed by ESAPI. However, Chris should be admired in admitting that as of late, because of job and personal obligations, he has lacked the "time to really provide any value to the ESAPI team" and therefore is stepping down in the best interest of ESAPI. I personally have enjoyed working with Chris for these past 5.5 years and have learned a lot from him. I hope that he periodically finds time to continue to contribute ESAPI in whatever way possible.
On the other hand, I am eagerly looking forward to working with Matt Seil as the new ESAPI co-lead. Matt was a major contributor to bug fixes for the ESAPI 2.1.0.1 release last February. He and I worked well together and I think he is highly respected in the OWASP community by those who know him.
Shortly after this New Years, Matt and I hope to get together and discuss future plans for ESAPI, both short-term and long-term goals. Once we have the initial groundwork for that recorded in electrons somewhere, we will share them with the broader ESAPI community to get feedback and then revise them as needed. (In the meantime, if you have some suggestions that you would like us to potentially consider, please email them to Matt Seil and me.
In the meantime, I hope that along with me, you will extend your thanks and appreciation to Chris for his labor of love on ESAPI and extend your welcome to Matt as the new ESAPI project co-lead.
Thank you and Happy Holidays!

Conference
OWASP Events

AppSecEU 2017

The call for presentations and training are now open for AppSecEu 2017, which will take place in Belfast from May 8th to 12th 2017. OWASP's Global AppSec events serve a diverse audience of security professionals at all stages of their careers. We seek interesting perspectives and training to drive visibility and evolution in the safety and security of the world’s software. We have opportunities for multi-day trainings, talks, lighting trainings, lightning talks, arsonal and activities.
Our topics of interest for talks include, but are not limited to the following:
  • Novel web vulnerabilities and countermeasures
  • New technologies, paradigms, tools
  • OWASP tools or projects in practice
  • Secure development: frameworks, best practices, secure coding, methods, processes, SDLC
  • Browser security
  • Mobile security and security for the mobile web
  • Cloud security
  • REST/SOAP security
  • Security of frameworks
  • Large-scale security assessments of web applications and services
  • Privacy risks in the web and the cloud
  • Management topics in Application Security: Business Risks, Awareness Programs, Project Management, Managing SDLC

OWASP Trainings should be practical in nature--hands-on class will receive stronger consideration. Topics of interest for include but are not limited to:
  • Secure development: frameworks, best practices, secure coding, methods, processes, SDLC
  • Vulnerability analysis: code review, pentest, static analysis
  • Threat modelling
  • Mobile security
  • Cloud security
  • Browser security
  • HTML5 security
  • OWASP tools or projects in practice
  • New technologies, paradigms, tools
  • Privacy in web apps, Web services (REST, XML) and data storage
  • Operations and software security
  • Management topics in Application Security: Business Risks, Outsourcing/Offshoring, Awareness Programs, Project Management, Managing SDLC

While we understand that your submission might be a work in progress, we strongly encourage that all submissions be as thorough as possible to allow us to make the best decision. The program committee will review your submission based on a descriptive abstract of your intended presentation. Feel free to attach a preliminary version of your presentation if available, or any other supporting materials. Please review your proposal thoroughly as accepted abstracts and bios submitted will be published 1:1 on our site. If your presentation is accepted for inclusion in the conference program, you are free to submit a white paper describing your work, to be added to the website.
To ensure the best talks available are presented at AppSec Europe we are incorporating blind reading as part of our process. This means that names and job titles will be removed when the paper's abstract is being reviewed. Submissions for training will not be read blind. All speakers will be given access to speaker mentorship, we especially encourage first time speakers to take advantage of this service.
Marketing and sales pitches will not be accepted in the talks or trainings.
  • Submission deadline: January 9th, 2017
  • Notification of acceptance: February 6th, 2017
  • Conference days: May 11th – 12th 2017

  • Deadline for proposals: January 2, 2017
  • Notification to training providers: January 23, 2017
  • Training: May 8, 9, 10




Global AppSec Events

AppSec Europe 2017 May 8 - 12, 2017, Belfast, UK
AppSec USA 2017 September 19 - 22, 2017, Orlando, Florida, USA



Regional and Local Events

AppSec Cali 2017 January 23 - 25, 2017, Santa Monica, CA, USA
AppSec Africa 2017 February 1 - 2, 2017, Casablanca, Morocco
SnowFROC 2017 March 16, 2017, Denver, CO, USA
Latam Tour 2017 April 3 - 28, 2017, South America



Training Events

Boston Training January 25 - 27, 2017, Waltham, MA, USA



Partner and Promotional Events

IoT Tech Expo Global 2017 January 23-24, 2017   Olympia, London   OWASP members save 20% by using discount code: OWASP20
Cyber Resilience & InfoSec 2017  February 6-7, 2017   Abu Dhabi, U.A.E.
SC Congress London   February 23, 2017   London, UK
CyberCentral   April 4-6, 2017   Prague, Czech Republic
QuBit Conference 2017   April 4-6, 2017   Prague, Czech Republic   OWASP members save 10% by using discount code: QB17OWASP
Cyber Security North Africa Summit   April 26-27, 2017   Cairo, Egypt  
SC Congress New York   May 2, 2017   New York, NY
Techno Security & Digital Forensics Conference  June 4-7, 2017   Myrtle Beach, SC
SC Congress Toronto   June 13-14, 2017   Toronto, Canada

Ads are not endorsements and reflect the messages of the advertiser only.They represent co-marketing arrangements
with other organizations in support of the OWASP Community.   CLICK HERE for more information on advertising.
Synopsys Security Compass

chapters
OWASP Chapters

Chapter Handbook Review

The Chapter Handbook goes under periodic review. This is your opportunity to be heard at OWASP. Each chapter is listed in its own doc, please comment to tell us where you think the handbook needs clarification, further guidance, or updates. Please confine your activity to the comments and do not directly edit the pages. Comments will remain open for one month.



OWASP is Testing Meetup Pro

OWASP has been listening to you and we are proud to announce that we began testing the new MeetUp Pro service this month.
MeetUp Pro will provide an umbrella under which the chapter groups would be gathered. This means that all of our chapters would be uniformly branded and advertised on our master homepage. From the chapters’ point of view, the meetup would function the same as before with the only changes being that the leaders are listed as “local leaders” and only the official OWASP account would have the ability to start and eliminate chapters.
There are a lot of benefits for chapters of going pro, not only will your meetups be more searchable, but the cost of the service, currently born from your chapter budgets, will be absorbed by the foundation budget. A significant “silent” benefit is that the API should allow us to mirror the information on the MeetUp page on the Chapter wikis thereby eliminating a large amount of work that we currently ask our leaders to do, but do not enforce.
After MeetUp Pro is out of Beta, All chapters will once again be required to keep their wiki pages up to date. Our goal is to remove the onerous time sink of doing this.
If you would like to see what the new Pro pages look like check out this page, where the first 7 chapters have joined.



Request for Blog Content

OWASP would like to start spotlighting chapter activity on our blog. If your chapter hosted and recorded an amazing talk that just NEEDS to be shared, or perhaps you ran a great event and would like to help other chapter follow suite think about writing a blog post to be shared on the OWASP Blog. Contact our community manager, Tiffany Long for more details.

Membership
OWASP Membership
We would like to thank the following companies for supporting the OWASP Foundation. The companies listed below have contributed this month by either renewing their existing Corporate Membership or joining OWASP as a new Corporate Member. Details about Corporate Membership can be found here.


Premier Corporate Member
Signal Sciences is the industry’s first Web Protection Platform using both Next Generation WAF as well as RASP technologies. Signal Sciences WPP was built in response to our own frustrations of trying to use legacy WAFs while enabling business initiatives like DevOps, cloud adoption and CI/CD. The Signal Sciences NGWAF works seamlessly across cloud, physical, and containerized infrastructure, providing security without breaking production traffic. To learn more, please visit http://www.signalsciences.com


Contributor Corporate Member
Parasoft helps organizations perfect today’s highly connected applications by automating time-consuming testing and analysis tasks while providing management the analytics necessary to focus on what matters – eliminating the deployment of security vulnerabilities that could lead to system failure, data loss, and loss of life. Parasoft’s software security solution analyzes code, generates and executes tests, and processes the data collected throughout the SDLC to ensure compliance with security policy across all layers of the software stack. In addition, Parasoft can analyze and automatically prioritize defects that lead to security vulnerabilities and kick-off security verification and remediation tasks across the team. Learn more at www.parasoft.com/appsec


Want your name here? Find out how by visiting our Corporate Member information page, or contact Kelly Santalucia today! Thank you to all of our Premier and Contributor Corporate Members for your support in 2016!

Social Media
OWASP Social Media

OWASP Social Media Sites

Labels: , , , , , , , , , , , , , ,