OWASP Stammtisch #37 Frankfurt,

Transcription

1 OWASP Stammtisch #37 Frankfurt,

2 Info 2

3 Intro 3

4 Intro My name is... I work as... I m here because... 4

5 Agenda Talk Johannes: What is OWASP? (why am I here?) 2 Next meetup 5

6 6

7 7 What is OWASP? Open Web Application Security Project worldwide free and open community focused on improving the security of application software Promotes secure software development Oriented to the delivery of web oriented services An open forum for discussion A free resource for any development team

8 8 What is OWASP? Non-profit (50c3), volunteer driven organization All members are volunteers (save 4 employees) All work is donated by volunteers and sponsors Provide free resources to the community Publications, Articles, Standards Testing and Training Software Local Chapters & Mailing Lists Supported through sponsorships Corporate support through financial or project sponsorship Personal sponsorships from members

9 OWASP Organization Global Board Global Committees Education Chapters Conferences Industry Projects & Tools Membership Employees Volunteers

10 OWASP membership Membership category Annual membership fee Individual Supporters $50 Organization Supporters $5,000 Accredited University Supporters FREE (in exchange of meeting space at least 2x per year) Lifetime Membership $500 Funds OWASP Speakers via OWASP On the Move Funds Season of Code projects Helps Support Local Chapters

11 OWASP Conferences ( ) Denver Spring 2009 Minnesota Oct 2008 NYC Sep 2008 Brussels May 2008 Poland May 2009 San Jose Sep 2009 Portugal Nov 2008 Israel Sep 2008 India Aug 2008 Taiwan Oct 2008 Gold Coast Feb 2008

12 2

13 Write Secure Code Audit Code, Result Control Risk 3

14 Write Secure Code Audit Code, Result Control Risk Software Assurance Maturity Model (SAMM) Mobile Application Security Verification Standard (MASVS) Cheat Sheet Series 4

15 Write Secure Code Audit Code, Result Control Risk Software Assurance Maturity Model (SAMM) 5

16 Write Secure Code Audit Code, Result Control Risk Software Assurance Maturity Model (SAMM) Mobile Application Security Verification Standard (MASVS) Cheat Sheet Series 6

17 Write Secure Code Audit Code, Result Control Risk Software Assurance Maturity Model (SAMM) Mobile Application Security Verification Standard (MASVS) Cheat Sheet Series 7

18 Write Secure Code Audit Code, Result Control Risk Software Assurance Maturity Model (SAMM) Mobile Application Security Verification Standard (MASVS) Cheat Sheet Series 8

19 Write Secure Code Audit Code, Result Control Risk Software Assurance Maturity Model (SAMM) Mobile Application Security Verification Standard (MASVS) Cheat Sheet Series 9

20 Write Secure Code Audit Code, Result Control Risk Software Assurance Maturity Model (SAMM) Mobile Application Security Verification Standard (MASVS) Cheat Sheet Series 20

21 Write Secure Code Audit Code, Result Control Risk OWASP Testing Guide «OWASP Top0» Web, Mobile, IoT OWASP Zed Attack Proxy 2

22 22

23 23

24 24

25 Write Secure Code Audit Code, Result Control Risk OWASP Testing Guide «OWASP Top0» Web, Mobile, IoT OWASP Zed Attack Proxy 25

26 26

27 27

28 28

29 29

30 30

31 3

32 Am I vulnerable to injection? How do I prevent injection attacks? 32

33 33

34 34

35 Write Secure Code Audit Code, Result Control Risk OWASP Testing Guide «OWASP Top0» Web, Mobile, IoT OWASP Zed Attack Proxy 35

36 2 Write Secure Code Audit Code, Result Control Risk OWASP Testing Guide «OWASP Top0» Web, Mobile, IoT OWASP Zed Attack Proxy 36

37 Write Secure Code Audit Code, Result Control Risk OWASP Risk Rating Methodology Threat Risk Modeling OWASP Application Security Guide For CISOs Project 37

38 Write Secure Code Audit Code, Result Control Risk 38

39 Write Secure Code Audit Code, Result Control Risk 39

40 Write Secure Code Audit Code, Result Control Risk 40

41 4

42 42

43 2 Feedback 43

44 Next meetup ??? 2 44

45 Spread the word 2 Mailinglisten OWASP Deutschland Stammtisch Frankfurt Meetup Stammtisch Frankfurt OWASP Germany

46 2 Outro 46

47 47

48 Quellen Intro_to_OWASP_Rochester_v5.ppt Owasp.org 48