OWASP Board Meeting — April 5, 2012

Meeting Minutes

April 5, 2012

Present: Michael Coates Tom Brennan Dave Wichers Matt Tesauro Seba Deleersnyder Eoin Keary

Kate Hartmann Sarah Baso Alison Shrader Kelly Santalucia

Mark Bristow Helen Gao Jason Li

Concern - Training numbers generally down.

• Need a marketing plan and coordinated approach
• For AppSec DC, hired PR with brains and had a clear impact on both conference and training registration as well as good press coverage
• Need more marketing & PR globally - can PR with Brains help? May be better to engage someone locally (instead of one stop shop)
• Who in the staff can be contributing and help with this heavy lifting?
• Can we talk with John Wilander about documenting the work flow he used for Sweden Research...

What else are we doing or aren’t we doing for events?

• Besides direct sponsorship - what else can we do?
• Marketing packs to all parties involved
• Separate wiki page to document what’s working and what’s not - metrics, another with simple tools
• Can Sarah be focused on conferences to prioritize over other tasks such as Chapters Support.
• 12 month conference plan for global appsec conferences - Q2 objectives for Sarah - set timeline and “check-ins” at 12 months out, 9 months out, 6 months out. Then Board to help enforce deadlines.

How are things going for Membership and Business outreach?

• Kelly sent survey to committee chairs and board members to get their thoughts on “the value of membership”? She will continues to work on getting feedback …
• Kelly working with Sarah to coordinate compiling contacts in SalesForce. With RegOnline things were not able to integrate well with regonline, now if move to cvent this should improve.

Board Treasurer report (Matt)

• Matt’s only input was addressing was concerns re: conference losses, which has been covered

IT Support Role

• Matt and Kate have inventoried possible IT tasks for OWASP, who currently handles/has access, and what isn’t being covered. Have also reviewed applications.
• What is cost of moving to managed support at rackspace? At projected levels, should fall under the $1200/month budget
• Matt has put together a list of responsibilities to communicate to job applicants
• Kate/Matt -- action item to post list to wiki, and look at hiring a “manager of IT” to oversee volunteer IT support activities/roles.
• Kate has contacted 40 individuals who are willing to assist, 15 on a volunteer basis. She is waiting for direction from the Board on next step.
• Is this something a project manager (taking Paulo’s position) could handle?
• Michael would like to see a dedicated paid resource (part time) that excels at IT management.
• Kate and Michael to look at list of applicants for potential for the IT Management role.
• Eoin - how much would it take to have rackspace do everything? Matt - rackspace doesn’t do everything we need (and no commercial entity found that does).
• Mark - also need someone to do “change management” so things like wiki text changes don’t result in all the tabs going down.

Helen - New Membership Wording https://docs.google.com/a/owasp.org/document/d/1_z2MA1FT1Fmz5yDFKttq3gHQuHTUPf3EbOcsyiMW4uk/edit#

• Barter-in-trade → OWASP Partner or Organizational Supporter, does not imply any tangible financial incentives to avoid tax implications.
• Dave - we want to promote “Organizational Supporter” as an equal to “Paid Supporter” so as to not disincentivize
• Name for “Barter-in-Trade” to become “Organizational Supporter”
• “Corporate Supporter” changed to “Organizational Supporter” on wiki, now we are giving that name to new barter-in-trade
• Need to distinguish between “discounted conference sponsorship rates” for Corporates/Organizational Supporters (currently exists) and discounted individual membership rates for paid OWASP members who attend conference (currently does not exist). That is, employees of a company that is a corporate supporter or organizational supporter, does not qualify for the individual discounted membership registration rate at conferences.
• Local level - difference between a “Chapter Supporter” (who buys pizza for a meeting) and a “Corporate Member” (paid membership). The latter should get a vote as a paid member the supporter

Vote to approve as is: --Matt, Dave, Michael, Matt, Seba, Eoin

• Q: Alison - does 90/10 split (chapter/foundation) for local supporter still exist? A: yes
• Q: Seba - supporter but not a member, why approved by membership committee? A: Because of bigger membership picture/structure

[Discussion] New Group Discount for OWASP Individual Membership

• Tom - no, no discounts( revised to 101+ memberships = 5% discount as a example ), +1 Eoin
• $50 is standard rate, $20 memberships available based on GDP for country. Are we evaluating this on a yearly basis.
• Michael - why not incentivize? Doesn’t it spread our mission to get more... and if an abuse case comes up we can deal with it then.
• Need more specifics on proposal before vote. Membership to work on it

[Discussion] OWASP Organization Structure / Governance (see email)

• Michael - Board needs to provide guidance to rest of Org - what is our overall strategy as an organization?
• Tom - view membership model as representative of larger org (60 foundation/40 chapter) split
• Example provided by Mark - do we want a chapter to be able to build up money to seed their own events and make enough money to make their own decisions about putting the foundation at risk (up to the amount in their chapter bank account)?
• Goal of global appsecs is raising money for the organization -- if central foundation is doing most of the heavy lifting, they should get most of profits. But if local chapter is doing heavy lifting (regional/local events) -- then they should get a split
• Discussion - where is the appropriate place for the responsibility and work load for Global AppSec Events.
• We don’t currently have the infrastructure in place to completely control all foreign events.
• All comes back to, what should the split be? 60/40 split all around? What should the oversight be in the chapter budget and spending?
• Tom - committees are there to set policy (task force), not be traffic cops. Employees have role of execution.
• Mark - not clear communication set to committees on where decisions are made...
• Seba - conferences should be managed by the conf. committee - 60/40 split. Local events should be managed by chapters committee.
• Mark - what is a “local event”? Critical question: Can a chapter have $40 or $50,000 in bank account and do what they please with it?
• Pilot new model (profit split) and challenge people to do the right thing?
• All on call in agreement that a change needs to be made to existing model...
• Dave, Kate & Seba to create a proposal for the next board meeting

[Discussion] Can Sarah have signing authority on contracts? (2nd employee - Kate also has authority)

• Approval vote -
  • Yes - Michael, Eoin, Dave, Seba, Matt, Tom
• Kate to fill out credit application for global foundation’s name -- so credit cards can be issued to employees as needed/deemed appropriate

Cvent vs RegOnline

• Proposal by Kate (supported by Sarah, Alison, and Kelly) to move forward with getting a contract to switch back from RegOnline to Cvent.
• No objections from Board

Project Reboot (Eoin)

• Slide presentation https://docs.google.com/open?id=0B5Z9zE0hx0LNSUZvOWVKd1JRWnlVaGJMcjB3SEN3Zw
• Jason - concern from a project perspective - need to reward/incentivize projects that have made momentum, not pay leaders/contributors for inactive projects (rewarding those project leaders for doing nothing)
• Slide 11 - 75 responses from OWASP Leaders list
• How are numbers computed for projected budget? Arbitrary values based on projected amount of work needed on individual projects.
• General support? Yes. Now, how do we execute -- where does the money come from?
  • Vote in principal on projects reboot? Michael, Matt, Tom, Eoin, Seba, Dave
• Where will the money come from?
  • Tom - use $3,800 that is already allocated to projects as a starting point
  • Need to look at funds as currently budgeted (not current money in the bank).
  • Tom - proposed phase 1 “sprint” with $25-$50,000 - ask chapters to “support” with 25% of current funds.

2012 Summit Proposal (Cruise) - Mark

• Is Board in support of moving forward with Cruise Venue?
  • Seba - neutral on forum for event as long as working on projects and getting things done. Also, reservations on “appearance”. As currently exists - can’t sign $350,000. Less risk, smaller scale.
  • Eoin - Last summit was great/productive and in support - but mindful on how much we are spending and prioritization of funds. Not in favor of spending $350,000 on cruise... [Eoin drop]
• Michael - is bringing 300 people to one space the best goal (and way to spend money) or 4 smaller groups in each region.
• Need concrete results - i.e. need next release
• Proposal - defer summit in order to consider new proposals, agenda, and budget. Board members will set new direction in next few months. Vote to cancel Summit in current form -- Michael, Tom, Dave,
• Michael “This is not a reflection of the committee’s abilities, but more about how should we, what direction, be spending the Foundation’s funds.”

Dave, Kate & Seba - action item to work on and write a proposed split for conferences.

Training split - 60/40 split but can change it in the favor of OWASP.