OWASP World Tour

This year the strategic goal of OWASP is to raise awareness and spread application security knowledge world-wide by hosting a training world tour.  The 2017 world tour will have three, free mass application security training events.  Each one-day AppSec training course will teach 500 developers, software testers and entry level application security professionals core security topics. 

Our goal is that each training will combine general security principles such as the principle of least privilege, using secure defaults, reducing attack surface with AppSec specific topics such as parameterized queries to prevent SQLi and input validation and encoding.  We are also interested in teaching how OWASP Projects can assist in developing secure software. 

As part of the OWASP World Tour we are inviting all professional trainers to apply to the Call for Training for your opportunity to train in Tokyo, Boston, or Tel Aviv.  Training will close in this month, so apply today!  

If you are interested or know someone who is interested in attending the OWASP World Tour near you, please keep an eye on the OWASP Blog or OWASP World Tour Wiki Page for registration.  

OWASP Bucharest AppSec Conference 2016 - October 6th

OWASP Bucharest team is happy to announce the OWASP Bucharest AppSec Conference 2016, a one day Security and Hacking Conference dedicated to the application security.

It will take place on 6th of October, 2016 - Bucharest, Romania at Sheraton Bucharest Hotel.

• Conference talks are free however, you need to register.

The event will be in English, with cutting-edge topics presented by renowned security professionals: Daniel Kefer, Adrian Hada, Jacco van Tujil, Andrei Daniel Oprisan.

• Workshops:

OWASP Top 10 vulnerabilities – discover, exploit, remediate

Increase the participants’ awareness on the most common web application vulnerabilities and their associated risks.

Each type of vulnerability will be discussed and the attendees will practice manual discovery and exploitation techniques.

Trainers:  Adrian Furtună; Ionuţ  Ambrosie

Secure Web Applications in Java

Learning how to build secure coding and secure code review skills, uncover and protect against some of the most common vulnerabilities in Java code.

Trainers: Cristian Serban; Lucian Suta

Shellcode Development and Exploiting

Learn how to create shellcodes and how to construct basic attack vectors using shellcodes. Obtain a better understanding about how programs and processes work.

Trainers:  Razvan Deaconescu; Mihai Țigănuș

Practical Cryptography on the Internet

The training will feature many guided hands-on activities such as creating certificate hierarchies, configuring custom certificates on clients and servers, modifying security policies, impersonating “seemingly secure” identities, downgrading connections, and extracting information from secure HTTPS sessions

Trainers: Sergiu Costea

• CTF (Capture The Flag)

Capture The Flag contests are popular ways to hone your practical security skills by solving challenges on topics such as web, crypto, reverse, exploiting.

We invite everyone passionate about practical security at the OWASP AppSec 2016 CTF, where you and your team will solve challenges on web, reverse and exploiting.

In order to participate in the CTF competition, please register here: https://owasp-ctf.security.cs.pub.ro/home

The prizes will be as follows:

• 1st place: 1024 euros
• 2nd place: 512 euros
• 3rd place: 256 euros

More information about the agenda can be found at:

https://www.owasp.org/index.php/OWASP_Bucharest_AppSec_Conference_2016

You can register at:

http://www.eventbrite.com/e/owasp-bucharest-appsec-conference-2016-tickets-26882929566

We look forward to seeing you at this event!

AppSec USA 2014 Offers World-Class Training Sessions

“Something that looks like a protocol but does not accomplish a task is not a protocol—it’s a waste of time.” 
― Bruce Schneier, Applied Cryptography

You won’t want to miss Bruce Scheier’s keynote at the AppSec USA 2014 conference September 16-19 in Denver.  But you also can’t afford to miss AppSec USA’s two full days of training sessions featuring top experts collaborating with you and your peers on the latest application security challenges and industry trends.

Register today for AppSec USA and the training sessions at http://2014.appsecusa.org/

Below are the brief overviews of AppSec USA’s 2014 training sessions. Click the links to learn more about the session and presenters.

Advanced Web Penetration Testing (2 Days)  

Presented by Secure Ideas

The advanced web penetration testing course is designed to be a hands-on course that will expand both internal and external security personnel testing knowledge.

Cryptography for the Modern Develop (1 Day)  

Presented by Blindspot Security LLC

This course is designed to provide attendees with the core concepts required to make informed decisions about what cryptographic primitives and APIs are safest to use in practice. The content will include approximately 50% lecture and 50% labs or other exercises to reinforce the concepts presented.

Malware Analysis Crash Course (2 days)

Presented by Mandiant, a FireEye Company

This course provides a rapid introduction to the tools and methodologies used to perform malware analysis on executables found on Windows systems using a practical, hands-on approach. 

Managing Web & Application Security – OWASP for Senior Management (1 day)

Presented by Tobias Gondrom

Managing and improving your global information security organization; Leverage OWASP and common best practices to improve your security programs and organization; Achieving cost-effective application security; Bringing it all together on the management level.

OWASP Top 10 – Exploitation and Effective Safeguard (2 Days)

Presented by Albero Solutions

This course aims at providing all web developers deep hands-on knowledge on the OWASP Top 10 web application vulnerabilities list.

Ruby on Rails – Auditing & Exploiting the Popular Web Framework (2 days)

Presented by Recurity Labs

After the training the participants will be able to assess, audit and exploit Ruby on Rails applications. This includes knowledge about the inner workings of the framework itself as well as a set of decent payloads for practical demonstration of vulnerabilities.

Securing Mobile Devices and Applications (2 Days) 

Presented by Aspect Security

This hands-on course enables students to understand how easily mobile devices and applications can be attacked. They will learn how to identify, avoid and remediate common vulnerabilities by walking through a threat analysis and learning critical security areas such as those identified in the OWASP Top Ten Mobile Risks and Controls.