Phoenix OWASP - Open Web Application Security
Project<
http://www.facebook.com/group.php?gid=213776715005>
Date: Tuesday, October 6, 2009
Time: 6:30pm - 7:30pm
Location: Executrain - WEST side of bldg
Street: 3600 E University Dr # A1400
City/Town: Phoenix, AZ
*Andre Gironda will be back in Phoenix to present some great information
about using OWASP resources to build an effective Application Security
lifecycle/program, followed by SUNSEC Happy Hour at Casey Moore's, at 7:30!*
*
**
Using ASVS with the Code Review Guide, Testing Guide, and Time Management*
The OWASP Application Security Verification Standards, which defines four
levels of web application security verification, lays down a framework for
security architecture review. While the ASVS includes many requirements for
controls, it does not suggest which tools, techniques, timeline or
methodologies to utilize. The OWASP Code Review and Testing Guides provide
the technical practices and suggest or hint at tools, but also lack the
timeline and methodology necessary to complete an application
penetration-test or SDLC integration project for proper application security
hygiene.
This presentation will provide the 1000 foot view all the way down to the
nitty gritty details of how to perform ASVS activities using OWASP
resources, as well as some OWASP and non-OWASP tools (freeware or demoware).
Example timelines for typical ASVS activities, including reports, will be
discussed so that any sort of application security project can be scoped
properly, delivered on-time, and within budget.
*Andre Gironda* is an application security specialist with a global security
consulting firm providing IT security services to the Fortune 500 and
financial institutions as well as U.S. and foreign governments. Prior to his
current employment, Andre held a number of payment application security
positions in addition to working for the largest online auction website. He
is currently a leader for the Open Web Application Security Project (OWASP),
where he co-produces the global OWASP News Podcast.
--
(623)239-3392
(503)754-4452
www.obnosis.com
http://www.obnosis.com/bt4.html
http://www.obnosis.com/motivatebytruth/gnu-people.jpg
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
.%0A>%20Example%20timelines%20for%20typical%20ASVS%20activities,%20including%20reports,%20will%20be%0A>%20discussed%20so%20that%20any%20sort%20of%20application%20security%20project%20can%20be%20scoped%0A>%20properly,%20delivered%20on-time,%20and%20within%20budget.%0A>%20%0A>%20*Andre%20Gironda*%20is%20an%20application%20security%20specialist%20with%20a%20global%20security%0A>%20consulting%20firm%20providing%20IT%20security%20services%20to%20the%20Fortune%20500%20and%0A>%20financial%20institutions%20as%20well%20as%20U.S.%20and%20foreign%20governments.%20Prior%20to%20his%0A>%20current%20employment,%20Andre%20held%20a%20number%20of%20payment%20application%20security%0A>%20positions%20in%20addition%20to%20working%20for%20the%20largest%20online%20auction%20website.%20He%0A>%20is%20currently%20a%20leader%20for%20the%20Open%20Web%20Application%20Security%20Project%20(OWASP),%0A>%20where%20he%20co-produces%20the%20global%20OWASP%20News%20Podcast.%0A>%20%0A>%20%0A>%20%0A>%20--%20%0A>%20(623)239-3392%0A>%20(503)754-4452%20www.obnosis.com%0A>%20http://www.obnosis.com/bt4.html%0A>%20http://www.obnosis.com/motivatebytruth/gnu-people.jpg%0A>%20---------------------------------------------------%0A>%20PLUG-discuss%20mailing%20list%20-%20PLUG-discuss@lists.plug.phoenix.az.us%0A>%20To%20subscribe,%20unsubscribe,%20or%20to%20change%20your%20mail%20settings:%0A>%20http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss "Reply to this message")
(text/plain)