Call For Papers and Call For Trainers

Global AppSec DC September 9-13, 2019

Vist the event site to submit.

Call for submittal of papers for OWASP AppSec USA San Jose CA Event

Submit papers for OWASP AppSec USA San Jose CA Deadline April 13,2018

OWASP Project Releases

OWASP ZAP 

New Release 2/6/17

• Change Session to no longer call/use ExtensionActiveScan.
• Change ActiveScanController to obtain the excluded URLs (session and global) instead of having the Session to set them.
• Change ExtensionActiveScan to allow to set a list of excluded URLs and to not change running active scans, normalizing the behavior with the normal spider.

OWASP Code Pulse

New Release 1/19/2017 Latest Release Version 1.1.4

Code Pulse 1.1.4 brings along updates to the distributed stack:

• ASM has been updated to version 5.1 - this enables Java 8 tracing support
• Java, Jetty, and NW.js have been updated to the latest versions
• Dependency-Check has been updated to the latest version

OWASP Juice Shop

New Release 1/30/2017 Latest Release Version v2.21.2

• The name field of all challenges was changed to a more human- and CTF-friendly form (see #264)

OWASP Off  The Record 4 Java

OWASP Foundation would like to welcome Project Leader Jigar Joshi !

Type of Project: Code Project

Project: OWASP Off  The Record 4 Java

Brief Description:

Privacy is daily reality for many internet users. Eavesdropping user's content and using it for various reason is not desired by many of the application users. Putting trust on communication channel, service provider or government not to intercept your content is not a good idea.

OTR framework solves this problem by cryptographically processing the users content in transit and at rest. No eavesdropper can read the content, not even the service provider.

OWASP Calls for Papers

Summer is a HOT time for OWASP!  Check out these active CFPs:

OWASP Cyber Security Conference in Morocco

The first OWASP regional conference in Africa, this two day conference in No includes a day of training and will take place in Marrakesh. Submissions are due by September 17th.

They encourage and prioritize submissions covering research and new work impacting:

• Secure Engineering: secure coding, static analysis, intelligent application threat modelling with real use case, web frameworks security, countermeasures, SDLC, DevOps, etc.
• Cognitive Security (Machine Learning and Big Data applied to find cyber security threats with high accuracy precision)
• Mobile security: Development and/or testing devices and the mobile web
• Cloud security: Offensive and defensive considerations for cloud-based web applications
• Infrastructure security: Database security, VoIP, hardware, identity management
• Penetration testing: Methodologies, tools, exploit development, evasion techniques, OSINT, etc.
• Emerging web technologies and associated security considerations
• Applied Cryptography: Relevant research, new models, algorithm usage, interesting attacks, and other applications.
• Incident response: Threat detection, triage, malware analysis, forensics, rootkit detection
• OWASP tools and projects in practice
• Policy and legal: Legislation, privacy, regulations and compliance, C-level considerations, etc.
• Cool hacks and other fun stuff: cryptography, social engineering, etc.

To submit a proposal, please submit an abstract of your intended presentation (500 to 4000 characters), a brief biography (150 to 800 characters), a head shot, and a signed copy of the speaker agreement. Talks without all required information may not be considered. Your planned presentation time is limited to a maximum of 15 minutes (excluding ~5 minutes for discussion and change of speaker). Feel free to attach a preliminary version of your presentation if available. Any proposal submitted is subject to a democratic vote by the program committee. Keep in mind: The better your description of the talk, the better picture the program committee will have to review your submission. Please proofread your submission; after approval your abstract, biography, and head shot will be published verbatim into the program and website.

OWASP Bucharest AppSec Conference 2016

This annual one day security and hacking conference is FREE.  It takes place on October 6th at the Sheridan Bucharest hotel.  You can register and submit your presentation here.  

Their audience includes:

• Application Developers
• Application Testers and Quality Assurance
• Application Project Management and Staff
• Chief Information Officers, Chief Information Security Officers, Chief Technology Officers, Deputies, Associates and Staff
• Chief Financial Officers, Auditors, and Staff Responsible for IT Security Oversight and Compliance
• Security Managers and Staff
• Executives, Managers, and Staff Responsible for IT Security Governance
• IT Professionals interested in improving IT Security
• Anyone interested in learning about or promoting Web Application Security

Rugged DevOps

The CFP for Rugged DevOps closed on the 18th, but their presentations will be hosted as part of AppSecUSA 2016 in Washington DC.   If you are a security practitioner interested in working with DevOps automation concepts and methodologies as part of the software development lifecycle this event is for you!                                                        Washington DC, October 11 - 14

ARMSec

OWASP Armenia is hosting their annual conference September 16- 17th in Yerevan at the American University of Armenia.  You can apply to their CFP here they are accepting talks from 20 min to 1 hour as well as 2 or 4 hour trainings.

BeNeLux OWASP Day

The annual event will host trainings on the 24th, and the conference on the 25th of November in Leuven, Belgium. Submissions close September 11th and can be made here. Topics should focus on the technical and social aspects of security, they will encourage and prioritize submissions covering research and new work impacting:

• Secure development of web applications.
• Security testing of web applications.
• Security of DevOps processes, architectures, and tools.
• Security of applications designed for mobile devices.
• Security of Internet of Things devices and platforms.
• Cloud platform security
• Browser security
• HTML5 security
• OWASP tools or projects in practice

To submit a proposal, please submit an abstract of your intended presentation (500 to 4000 characters), a brief biography (150 to 800 characters) and a head shot (combine multiple files in one zip file). Your planned presentation time is 40 minutes (excluding ~5 minutes for discussion and change of speaker). Feel free to attach a preliminary version of your presentation if available. Any proposal submitted is subject to a democratic vote by the program committee. Keep in mind: The better your description of the talk, the better picture the program committee will have to review your submission.

ASC Mobile & IoT Security Summit 2016

The OWASP China Chapter is co-hosting the  ASC Mobile & IoT Security Summit 2016 October 25th-26th, 2016 in Shenzhen, China.  Submissions close Aug. 31st.  The event will have three focus areas:
Part One-- Mobile & IoT Security Forum

• Mobile device & Mobile connectivity platform Security Technology
• Mobile, Web and Cloud Security
• Application Security Testing and Latest Attacks and Protection
• Privacy Protection in web based apps
• Chip Security

Part Two-- Incident Response Sub Forum

• Incident Response Tools and Procedures
• Data Protection
• Vulnerabilities Handing Solutions
• Incident Response System Building
• Automatic Security Operation

Part Three—S-SDLC Sub Forum

• S-SDLC processes, architectures, and tools
• Security assessment in S-SDLC (Code review, penetration testing, etc.)
• Security development processes
• S-SDLC in Agile Development

Events Looking for OWASP Presentations:

HackFest∞

OWASP Quebec and OWASP Montreal will be hosting a booth at the annual HackFest∞ November 1st through 5th.  They are looking for a speaker to talk about OWASP.  You can apply to HackFest∞ here.

Rochester Security Summit

A general InfoSec conference taking place October 5th and 6th. RSS features a keynote by Jeremiah Grossman and a dedicated OWASP Track.  They are looking for great OWASP AppSec presentations  The CFP has been extended, you can follow up here.

OWASP + TrustyCON + BSidesSF / IATC

********BEGIN TRANSMISSION******

Technology should not only be Secure, it should be Trustworthy.
Raise Visibility for the community: https://www.thunderclap.it/projects/8350-the-cavalry-isn-t-coming

If you follow the OWASP Top 10  A2, A4, A5, A6, A9 is why you should join the discussion with your peers -- read on 

o()xxxx[{:::::::::::::::::::::>

OWASP  ** BSIDESSF ** TrustyCON

Background
As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA

 
News Report
http://www.reuters.com/article/2013/12/20/us-usa-security-rsa-idUSBRE9BJ1C220131220

Technical primer
http://arstechnica.com/security/2014/01/how-the-nsa-may-have-put-a-backdoor-in-rsas-cryptography-a-technical-primer/

The Cavalry Isn't Coming  It falls to us. Be a voice of reason. Drive cyber security for public good and public safety - have the discussion and learn about the impact.

o()xxxx[{:::::::::::::::::::::>

TrustyCON
Join us for the first Trustworthy Technology Conference, to be held on 27 February 2014 at the AMC Metreon Theatre in San Francisco, California. We welcome all security researchers, practitioners and citizens who are interested in discussing the technical, legal and ethical underpinnings of a stronger social contract between users and technology.

https://trustycon.org/

o()xxxx[{:::::::::::::::::::::>

BSIDESSF

BSides are about extending conversations in an open environment, not imposing a single point of view on anyone

This year's conference season has begun with controversy; we encourage everyone to speak, attend, and participate in events as they feel personally appropriate.
When: Sunday and Monday, February 23-24, 2014 Where: DNA Lounge (375 Eleventh Street, San Francisco, CA 94103) Times: 9am - 6pm

http://www.securitybsides.com/w/page/70849271/BSidesSF2014

o()xxxx[{:::::::::::::::::::::>

OWASP

The Open Web Application Security Project (OWASP), the premier global not-for-profit devoted to improving software security, is hosting a special security boot camp open to the public for FREE

WHAT:
The course will introduce and demonstrate application assessment techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code and understand fixes.

WHEN:
Monday, Feb. 24, 2014 2pm-5pm

WHERE:
Jillian's Billiards Club of San Francisco
175 Fourth Street, San Francisco, CA 94103

(Across the street from Moscone Center where the RSA Conference is being held.) The boot camp will be followed by an open Happy Hour sponsored by the Bay Area OWASP Chapter from 5pm-7pm, also at Jillian's.

COST:
The training is a FREE service of OWASP, open to anyone interested in securing their code.

Pre-registration is recommended to guarantee a spot in the training, but we will accept walk-ins based on available space. The Happy Hour is open to the public and no registration is required. To register for training, visit: http://www.eventbrite.com/e/free-owasp-training-tickets-10302967453

About OWASP Foundation

The Open Web Application Security Project (OWASP) is dedicated to making application security visible by empowering individuals and organizations to make informed decisions about true software security risks. As a 501(c)(3) not-for-profit worldwide charitable organization, OWASP does not endorse or recommend commercial products or services. Instead, we allow our community to remain vendor-neutral with the collective wisdom of the best individual minds in software security worldwide.


https://www.owasp.org/index.php/OWASP_Statement_on_the_Security_of_the_Internet_2014


o()xxxx[{:::::::::::::::::::::>

The Cavalry Isn't Coming
It falls to us.
Be a voice of reason.
Drive cyber security for public good and public safety.
http://www.iamthecavalry.org/

Technology should not only be Secure, it should be Trustworthy.
Raise Visibility for the community https://www.thunderclap.it/projects/8350-the-cavalry-isn-t-coming

***END TRANSMISSION*********

12 Days of Christmas w/ Hacker Claus

Ok builders, breakers and defenders.... gather around the FIREwire and sing with me;

On the 1st day of Christmas a malicious hacker faxed to Johnny <pause> poof of SQLi in his production website (database using SELECT * FROM members WHERE username = 'admin'--' AND password = 'password') with a username list

On the 2nd of Christmas the hackers gave to Johnny Cross Site Scripting vuln in his high risk web application <IMG SRC="javascript:alert('XSS');"> that his automated scanner missed and a link to OWASP Cheat Sheets and Core Rule Set  suggestions for monitoring and potentially blocking the input, output, or system service calls. 

On the 3rd day of Christmas the hackers gave to Johnny Insecure Direct Object Reference on a critical system that provided full admin access to the application because....  Johnny made a mistake and forget to add a rule to deny any to a obscure management port  http://yourwebsite.com/secret/adminconsole:8050

On the 4th day of Christmas the hackers gave to Johnny.... A FREE .PDF Book on how to find application security flaws and the NEW video series from AppSecUSA 2013 (43) Videos and 32 hrs of content

On the 5th day of Christmas the malicious hackers parked in front of Johnnies favorite coffee shop and conducted a man-in-the-middle hot-spot honeypot -- then proved to Johnny that "Password1" is not a good password and how quickly a hash can be cracked

On the 6th day of Christmas the hackers gave to Johnny code snips of critical system code on the new secret internal project that they picked up from PasteBin

On the 7th day of Christmas a hacker breached Johnnies door using a "9999" cut bump key on door #1, a shim on the padlock that secured important information and placed a "boom" sign inside my top right desk draw that was locked to prove a point about my lame physical security... --- seems they also drank his 18 year old scotch too!

On the 8th day of Christmas the hackers returned to Johnny a bag of dumpster diving treasure to point out lack of cross-cut shreder  that included bills from trusted vendors with account info, credit card carbons, internal printed emails, customer data and more...

On the 9th day of Christmas hackers hacked Johnny via an email aimed at his wife concerning a refund of a holiday purchase with targeted malware using a custom packer that bypassed my installed and updated corporate AV investment.  After getting a remote shell they then popped Johnnies work laptop that was also connected to my home network that was unpatched due to the holiday freeze then exported the cert on the VPN client installed a keystroke logger on the computer that I use for business to capture the password....  ouch..

On the 10th day of Christmas the hackers gave to Johnnie a FREE audio blog to help educate him

On the 11th day of Christmas the hackers knocked down my e-commerce website during the busy online shopping season with a Denial of Service Tool 

On the 12th day of Christmas hackers mailed a link... Johnny noticed his company was on the list of incidents involving the breach of personally identifying information (PII) and his information may have been in a dump of over 2M users due to his machine was infected with malware from Day #1

...... as a result he reached out to the LOCAL OWASP Chapter and started to ask questions, review the OWASP Foundation website and intresting projects including the  Enterprise Security API (ESAPI), Free Videos, Guidance on Mobile Security, Jobs Postings from around the world and over 100+ other projects: https://www.owasp.org/index.php/Category:OWASP_Project

May all your Christmases be #FFFFFF

OWASP Security Spending Benchmarks Project Report for Q2 Published

from Boaz Gelbord

The OWASP Security Spending Benchmarks Project Report for Q2 was published on June 30, 2009.

This project measures security spending in the development process. This quarter we focused on cloud computing. We were trying to measure how much use companies are making of cloud computing, how this affects spending, and how they are dealing with related legal and business issues.

We are lucky to have some great security folks volunteering their time on this OWASP project - Jeremiah Grossman, Rich Mogull, Dan Cornell, Bob West, and others have all provided valuable feedback and support. We were also very fortunate to have organizations like the Open Group and the Computer Security Institute (CSI) join our project over the last quarter. They join organizations such as eema, Teletrust and companies such as nCircle, Cenzic, Fortify and others that have been actively contributing to this effort. A full list of partners can be found on the project website.

Cloud computing gets some people's eyes rolling because it sounds like a marketing gimmick or meaningless term. But whatever you want to call it, infrastructure, platforms, and software are resources that are increasingly being outsourced or externally hosted. This has enormous security implications because it undermines the traditional notions of ownership and management that security has been based on in the past.

Here are the key findings in the OWASP Security Spending Benchmarks Q2 report:

THE OWASP SSB Q2 SURVEY RESULTS:

1. Software-as-a-Service is in much greater use than Infrastructure-as-a-Service or Platform-as-a-Service. Over half of respondents make moderate or significant use of SaaS. Less than a quarter of all respondents make any use of either IaaS or PaaS.

2. Security spending does not change significantly as a result of cloud computing. Respondents did not report significant spending changes in the areas of network security, third party security reviews, security personnel, or identity management.

3. Organizations are not doing their homework when it comes to cloud security. When engaging a cloud partner, only half of organizations inquire about common security-related issues, and only a third require documentation of security measures in place.

4. The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.

5. Compliance and standards requirements related to cloud computing are not well understood. Respondents report having the greatest understanding of PCI requirements relating to cloud computing and the least understanding of HIPAA cloud requirements.

SURPRISES AND NON-SURPRISES IN OUR SURVEY RESULTS...

1) The fact that SaaS is reported as the most prevalent of all cloud models is not surprising at all. Leveraging Platform-as-a-Service requires a level of expertise and sophistication many companies still do not have. And Infrastructure-as-a-Service has been dogged by performance issues and has yet to really supply an appropriate ROI model.

2) It is more perplexing that organizations do not report significant spending changes as a result of cloud computing. On the face of it, one would expect that cloud computing would result in lower expenses in a number of security areas, particularly network security. The fact that this has yet to occur may mean that organizations have been slow to adapt security budgets as a result of their cloud activities. Over time, both budgets and the role of security management will be increasingly focused on managing and auditing cloud relationships. Which brings us to number 3...

3) It is also somewhat surprising that organizations are not doing their homework when it comes to cloud computing. The survey found that only a third of organizations ask for the security policies of cloud partners. With all the talk of cloud security dangers, you would expect there to be heightened awareness and that companies would take the time to look into cloud partners' security narratives. That this has not been happening indicates that companies see cloud computing in the same vein as other outsourcing arrangements - the actual under-the-hood operations or security are not that important as long as the issues are contractually addressed. This approach may be more a result of necessity than choice, since for a small company with significant operations in the cloud it is hard to see how they could make any significant assessment of their cloud partner's security posture.

4) Data breaches are and will always remain the main fear factor driving the security industry. While compliance has always a bit fuzzy (especially when it comes to non-technical regulations, where there is a lot of wiggle room), the same cannot be said of a breach. You have either been breached or you haven't, which probably accounts for the greater concern survey respondents reported. It is interesting however that despite this very high level of concern with data breaches, organizations are still doing very little to vet cloud partners. Most organizations seem to have come to the conclusion that although there are many data security dangers related to cloud computing, there is not much they can do to mitigate this risk.

(5) Compliance is the issue that is really raining on the entire cloud computing parade. While PCI has fairly detailed supporting documentation to guide companies, other standards and regulations are much more vague so it is easy to see why people are confused. Regulators are still struggling to understand Web 1.0, so I do not expect we will be seeing much concrete guidance in this area in the near future.

MOVING FORWARD...

I gave a whole bunch of caveats the last time we published our survey results about why web surveys need to be taken with a healthy grain of salt. This still holds true for our cloud computing survey, and probably even more so because no one seems to agree on what cloud computing is. But even so there are some important take-aways from the data we collected.

The most significant warning sign in the survey results in my opinion is that companies are moving to the cloud without really inquiring about the security policies and posture of their cloud partners. And when they do ask about these issues, they rarely ask for documentation. This does not bode well for the future security of cloud computing. Although smaller companies rarely have the resources to truly assess the security of their cloud partner, asking for written documentation of security policies at least forces the cloud partner to maintain a security narrative they share with customers. As more customers inquire about security, this security narrative takes on an increasingly strategic role for the cloud partner.

You can read the full report here.