OWASP Board Meeting — December 10, 2014

Chairman’s report –

• AppSecUSA 2015, one of OWASP's largest fundraisers of the year, is progressing nicely in planning. I am serving as the primary planner (with Laura, staff and volunteers). Initial information has been sent to the leaders list and many more updates will follow.

Vice Chair report –

• Surveys
  • Denver meeting - OWASP health and wellness survey.
  • Feedback on Paul Ritchie involvement thus far.
• 2013 Taxes - Question as to completion of tax paperwork.
  • Paul confirmed that the taxes were completed on time.
• DHS Swamp - Meeting with Kevin Green to enroll DHS Swamp as an OWASP project.
• IEE - outreach event in Louisiana with medical device (pacemaker) makers. 2 day offsite, 12 hour per day collaboration on medical device security.
• OWASP Bugcrowd Bug Week
  • Questions of use of brand and endorsing products.
  • Questions as to whether there is a process around this?
  • Fabio was involved and may be the key contact with BugCrowd.
  • Tom wondering if there is an agreement.
  • Kelly reports that there is a contract in place.
    • TODO: forward copy of contract to board.
• Motion (email): nominate from roles. Has this as an agenda item and it will be discussed later.

Treasurer report - N/A. Secretary report - N/A. BoD Members at Large report - N/A.

Executive Director Report. https://docs.google.com/a/owasp.org/document/d/1vMBMHSvIKGeXHZXoIeX_rsDSHBOrwMY1p55V2b_BM4U/edit

• Paul

  • Item 1 from ED Report:
    • Backfill for Laura but trouble finding Spanish speaking person to asisst with LATAM tour.
  • Item 3 from ED Report: OWASP EU Legal Entity
    • No recommendation yet.
    • Time and effort involved versus current benefit may not be worth it.
  • Item 4 from ED Report: Impact of Virtual
    • Can employees have official employer be OWASP instead of Virtual/Insperity? Answer is basically no unless OWASP has >= 15 people.

• Finance

  • No red flags.
  • Working to clarify how to track what we owe to chapters (liabilities).
    • TODO: Josh and Paul to work on this.

• Membership update:

  • https://www.owasp.org/index.php/November_2014_Membership_Report

• A comprehensive Events management report:

  • https://docs.google.com/a/owasp.org/document/d/1tDy6GiAY_zlbzhjIrxlOlEFWUCcvqt2oxKL7t4qtWc4/edit?usp=sharing

Other Action Items

• Whistleblower Policy
  • Josh introduces policy.
  • Josh moves to approve OWASP Whistleblower policy. Tobias (seconds).
    • Michael - YES. Tom - LEFT. Eoin - YES. Josh - YES. Tobias - YES.
    • (Shadow) Andrew - YES. Matt - YES.
    • Approved.
  • Next steps: replace one on the wiki.
    • TODO: Josh - Martin and community.
    • TODO: Paul - note to staff that whistleblower policy has changed.

New Agenda Items

• Code of Ethics Discussion
  • TODO: Michael to follow up with Martin (already partly done)
• Motion to change Interim Executive Director to Executive Director
  • Discussion around report from Virtual and overall direction.
  • Table for next month.
    • TODO: Add to agenda for next month.
• Determining 2015 Roles
  • Process not currently documented.
  • Brainstormed Options:
    • Special meeting? Do it in 2014? Assumed to do in last 2014 meeting and makes sense to do before Jan 1.
    • Do via email. Position by position. Do it over the board list.
      • Have outgoing board member facilitate.
  • TODO: Try to establish roles by email. Start with chair and see who is interested, then vice chair, then treasurer, then secretary. Idea being to eliminate the need for an additional meeting to vote if all aligns.
  • TODO: Eoin to facilitate discussion on board list about roles.
  • EU entity will continue to exist for at least 3 months, and maybe forever. So it still needs board members and signatories.
    • Need Seba to stay engaged.
    • Tobias volunteered to fill that.
    • TODO: Paul to follow up for volunteers.
    • Could US staff do the release? Seems yes, but have to be face to face. Would mirror what is done in the US. TODO: Paul to follow up and work through process.
• Motion
  • Tobias moves to have another meeting to discuss budget and strategic goals. (Second by Josh)
  • TODO: Paul will co-ordinate - Targeting Thursday 12/18.
• 2015 Budget (Paul)
  • Skipping due to time, but encouraged all to review here: https://drive.google.com/a/owasp.org/file/d/0BxjNZI6rYJRKZk1ycVNlbGhuYzA/view
• Reiterate many thanks to Tom and Eoin.
  • Eoin parting words: “It will be good to think of some radical stuff. We have sometimes failed with new things, but sometimes the craziest ideas might be the most needed.”

Open Action Items from Prior meetings

• Nov. 12 - Josh to update Whistleblower policy & review at December meeting - DONE
• Oct. 8 - Review ‘Interim’ status of Executive Director & discuss conversion to full time ED. Michael leading this discussion. Still Open per Dec. 10 meeting.
• Oct. 8 - Board to review how website in China is being used and the financial arrangement to ensure it is in line with OWASP Foundation policy. Still Open. To be discussed following AsiaPac Tour.
• Sept. 16 - 2015 Strategic Planning. Board to address with new Board members.
• Sept. 16 - 2014 Goals & accomplishments to be presented by owners of goals. Still Open. Would be good content for 2014 Annual Report.

Next Board Meeting – Wednesday, January 14, 2015. Start-time 09:00 Pacific / 12:00 Eastern / 18:00 CET

Dec 10 Board Meeting was adjourned at 10:00 Pacific by unanimous consent.