OWASP Board Meeting — August 13, 2012

[Status Update] Finalize Conference/Chapters Profit Split

• https://docs.google.com/a/owasp.org/document/d/159bD2oeAmM2yfPNeq5wHvIvHcl10Hl-c3Um2GXAW81Y/edit
• Request for comment sent to both the conference and chapters committees via email and at both committee calls last month. Comments have not yet been incorporated into the document.
  • Comments re: conference committee meeting minutes - https://docs.google.com/a/owasp.org/document/d/1_z5AWzJBd6K6k_lhxyksN_WfZVWf-lTa2M83dRlonQo/edit
  • Comments also received via email thread: “Request for Comment - New Event Profit Split Policy”
• Kate will incorporate comments into document as needed
• Document needs to be socialized to Leader’s list for final comment
• Need to clarify inclusiveness of document - does it cover training?

[Status Update - Sarah] Latam 2011 Conference Payment Information

• No communication received in 1 month from Leonardo Goldim (Last communication was that he was asking his bank account manager to transfer the money owed to us. As of last week we haven’t received anything).
• Sarah to research possible remedies for recovering via collections agency or legal and report back to the Board.
• Suggestion from Tom - may be able to use same law firm to set up OWASP Brazil legal entity. This is a separate action item though and more discussion is necessary before action here.

[Status Update] New Roles

• Additional definition being discussed for clarity

• [Sarah] Plans for AppSec Latam have been solified. Board Member availability to attend AppSec Latam in Montevideo - conference talks Nov. 20-21

  • Michael Coates - checking availability
  • Tom Brennan - NO
  • Matt Tesauro - checking availability
  • Sarah to follow up via email with Board regarding their availability for Nov. 20 - Done, after call on August 13.

• Status Updates for Discussion

  • [Kate] Submitted Tuition Reimbursement Policy Proposal: https://docs.google.com/a/owasp.org/document/d/1DW4343jQ_k_Xx177e1Jm_kT0RaH7vSl4wxsYeMDHuzE/edit
  • [Kate] Verizon Cell Phone Policy - Kate, Kelly, and Alison are on policy already. Sarah joining after family plan upgrade next month.
  • [Kate] Wiki update - Migration completed to Rackspace Managed Server was 1st priority. Next priority is the banner ad rotation.
  • [Matt] - Mailman: working with Achim to do a fresh install of mailman. Also working with Mark to migrate OCMS and the Salesforce Contact Us form. All should be done in approx. 10 days.
  • [Tom] Should be able to take advantage of akamai relationship for content acceleration after migration at rackspace is complete. Estimated 1 month.

• Treasurer’s Report

  • Matt is working with Kate and Alison to take inventory of our current accounts (credit cards, bank accounts, paypal, etc). Current summary of accounts: https://docs.google.com/a/owasp.org/document/d/1UpnKqTEfKPaA6x6kZGvV4U6xX6yTU1NTHKtfUvkU_4k/edit

  • Matt and Kate have also been researching financial options for retirement plans, bank accounts, and credit cards to see how we can better package our accounts for 1) reward points 2) better interest rates 3) possible local spending for event planners 4) cohesion between accounts. Summary of research: https://docs.google.com/a/owasp.org/document/d/1MUm1a61aawhqXfMwdPMa0TuzOFJv4y8kfl-35rzk9Ew/edit

  • [Kate] Follow up questions - Feedback requested from Board:

    • Do we want to continue to bank with SB leveraging Dave Wichers relationship as primary account holder for OWASP and Aspect Security?
    • Do we want to establish a corporate credit card associated with the OWASP TIN #?
    • Do we have a reason to maintain 3 different US accounts
    • Are there other banks to investigate?
    • Considering the current interest rates, are there any investment opportunities relevant to our long term goals?

• [Samantha] Projects update:

  • In addition to general “on-boarding” and getting up to speed with the current status of projects and processes that the GPC has in place....
  • Set up 14 projects in the last 2 weeks and 4 project set-up confirmations
  • Updated the “How to Set up a Project” wiki page
  • Worked with Kate on the DHS funding proposal
  • Current number of projects - 242 + (2: possibles) + (5: pending confirmation)

• [Samantha] Policy on submitting real name vs. handle for OWASP Project

  • In line with the OWASP core value of transparency - we need the project leader’s legal name in order to set up a project, email address, and contact information. If the project leader wants to use the handle as the font facing name on the project, we at least will have the information for our own purposes.

• [Kelly] Membership update:

  • Met with 6 companies at BlackHat and solidified a 7th corporate supporter as a result of meetings at BlackHat
  • Finalized announcement regarding WASPY awards and sent to OWASP Leaders regarding their involvement in the awards. Projects/Chapters must submit their interest to Kelly by September 1st. Awards will be announced during lunch on the first day of the conference.
  • Election - all candidates have been interviewed and interviews will be posted to election wikipage in the next couple of days.

• [Sarah] Event updates

  • Encourage Board members to review status reports
  • AppSec Research estimated profit is $13,000 USD which is significantly lower than the projected revenue for the event set up by the GCC last year ($75,000 USD). The event was a success in terms of participation and spreading the mission of OWASP, but for next year it is important to look at what our measure of success is (especially) for global appsec events. If the primary goal is making money, we should look at strategies to achieve this.
  • AppSec USA - currently 175 people registered and approx $120,000 in sponsorship generated. Current event profit is approx. $25,000
  • Currently no submissions for AppSec USA 2013 received. Sarah has asked Mark to send out another call for submissions.

• [Michael] Anti Harassment Policy

  • Brucon put together an antiharassment policy: http://2012.brucon.org/index.php/Anti_harassment
  • Should “OWASP” adopt a similar policy? Michael to send out an email to Leader’s list socializing/getting input.