OWASP Board Meeting — October 14, 2015

Tobias suggests that we can skip the reports. Chairman’s report – Vice Chair report – Treasurer report - Secretary report - BoD Members at Large report - Andrew - Jim - Michael -

. ED Updates

High level, still in a good place. Membership at 94% of goal. (292K) Approximately a million in the bank. 2483 members Initial estimates for 2016 conservative for due to lower for DC. SF AppSec expenses > 50K this quarter. Michael: Do we need a line of credit. Events: AppSecEU 2016: June Rome AppSecUSA 2016: September DC + Northern Virginia Note that every single board member completed online anti-harassment training for supervisors. Community Manager Update Positive reaction to the State of the Union message Chapter leader training. 1-2 hours in the evening. 2 days of training. Competed with content. Maybe something to revisit and reconsider. Jim suggests considering chapter leader conference, a day at a conference or a night time meeting. Michael suggests an OWASP day for a day at AppSec. Paul - let’s do monthly hangouts. Project Update Project Summit Summer of Code New project process Matt: Consider doing a knowledge map - Enrico working on this. Director update Operations update Automated merchandising fulfillment. Annual Report. Matt: Comments that Membership update Board Candidates for elections in progress. Schedule & details on Wiki. Kelly pushing out email communication on routine basis to Community Michael: Are we having any of the issues we had last year? Paul: Seem to have communicated substantially and dealt with the honorary memberships.

Next Board Meeting – November 4, 2015. Wednesday Time 1:00 PM PST.

October 14 Board Meeting was adjourned at 20:15 CET by unanimous consent.

Paul notified that recording started. Meeting was called to order and Tobias Gondrom read a roll call of board members in attendance. Tobias notified everyone that recording started. Paul noted that have full quorum with 5 board members. Andrew joined call about 5 minutes late, so quorum achieved with 6 board members in attendance. Community and staff attendance is noted above. Financial Proposal from Josh: Language here: https://www.owasp.org/index.php/Proposal_for_2015-09-25_OWASP_Board_Meeting Voting tracked here: https://docs.google.com/spreadsheets/d/13Hk1A_-yDt40leZxhIt8Gg84BLWHGXbR1YKyxWv8Iw0/edit#gid=1838967326

2: Approved 7 yes, Fabio and Tobias in meeting, others evote. 3: Approved 6 yes, Fabio no. 4: Approved 4 yes (Matt, Josh, Andrew, Jim), 2 no (Fabio, Tobias) 5: Approved 7 yes. 6: Parked. 7: Approved 7 yes. 8: New vote with updated language, 6 yes. Michael absent for vote on updated language but was yes for previous language. 9: Approved 7 yes. 10: Approved with 6 yes, 1 no. Fabio. 11: Approved with 6 yes, 1 no. Fabio. Action Items Related to the Benchmark: Matt to discuss benchmark with Dave. Josh to discuss benchmark with Jeff. Minutes from September 25, 2015 Board meeting were approved. Tobias asks for any objections. No objections. Record in Minutes - All Board members, Compliance officer and Executive Director completed Anti-Harassment Training for Supervisors, per last year’s Audit recommendations. Motion from Tobias to close the meeting. Andrew seconds. No objections. Meeting closed.

Josh funding proposals Language here: https://www.owasp.org/index.php/Proposal_for_2015-09-25_OWASP_Board_Meeting Voting tracked here: https://docs.google.com/spreadsheets/d/13Hk1A_-yDt40leZxhIt8Gg84BLWHGXbR1YKyxWv8Iw0/edit#gid=1838967326 4: Discussion: Tobias expressing concern about control for the funds distributed. Josh believes the foundation is providing a check point. Fabio also believes. 6: Discussion: Andrew asks that it be handled in a standard process for expense reports. Josh asks if modified to have a high limit of 2500 is it then acceptable. Tobias doesn’t care about the cut-off. Tobias doesn’t want to parse through a list of examples. Suggest first trying to define reasonable expenses. Josh notes that the current list is in policy in the chapter leaders handbook. Agree to park this item for now. 8: Discussion: Fabio suggests that the channel should be bringing the budget to the board. New text: “Chapters and projects with $5,000 or more in their account on October 1 are required to create a budget and provide it to the OWASP Foundation prior to November 1 (December 1 for 2015) for inclusion in the Foundation budget for the following calendar year. The budget should identify how they plan to spend the money in their account over the course of the next year. A future projection budget can be included as well for forecasted spending within the next 2 years.” 6 yes and 1 not present. 9: Discussion: Tobias - this is already true. Unanimously yes? 10: Discussion: Tobias says yes. Fabio notes that donors may have funds earmarked. Paul: clarifies the impact of #10. Fabio against. 11: Done.

Benchmark Project Discussion Andrew has concerns about the openness. Need generic rules that govern a benchmark project. Josh has similar concerns. Project lead by one vendor. Results are coming from one vendor. Suggests to put the marketing effort on hold and make it more of an agnostic group before we market the results of the project. Tobias reviewed the project and comments. From a project operations perspective, it is ok. A problem is that the project appears mature when in fact it is still early. Jim points to vendor response, not the project. Jason Lee - points out that Aspect and Contrast are different companies. It is true that Dave has a vested interest in Contrast. Matt - offers to meet with Dave, Tuesday to suggest discussion. Josh - offers to talk with Jeff at LASCON to suggest discussion. Jim noticed “Contrast” was (and is) hard coded into the Benchmark project so there must had been some kind of close coordination. Feel the claim of “different companies” is disingenuous (at best).

Issue: E-Vote timeframes for discussion and voting. Tobias asks how long we should wait in discussion before moving to a vote? Josh suggests that 24-48 hours should be enough discussion time before moving to a vote. Tobias suggests that everyone should have a chance to participate in the discussion. Andrew 3-4 days worth of discussion and then 24 hours for a vote. Matt says that quick turnaround is ok and evote can help us to be more productive. Paul suggests that a typical time limit should be 48 hours. Also an evote ‘usually’ requires unanimous participation to be valid, but section 3.09 of OWASP Bylaws permits E-Votes to occur as long as they are agreed to by a majority of board members.

New Agenda Items