OWASP Board Meeting — July 1, 2016

Chair's Report - Matt Konda

• Developer Initiatives: Chicago Coder Conference, Goto; Chicago, TechNexus Panel on Security, Chicago FTW Start with Security Panel
• Organizational
  • Staff meetings
  • Hiring follow through for STC
• Minimal Bill payments
• 1:1 with staff at AppSecEU

Vice Chair's Report - Josh Sokol

• I've got nothing major to report here so let's save the time for some of the bigger discussions that we need to have.

Treasurer Report - Andrew van der Stock

From January to around at least April, OWASP had operational reserves far less than the target operational reserve target of six months. This is due to a lack of revenue, unbudgeted expenses, and a split model that favors one strategic goal over all others. Luckily, the success of AppSec EU has made a recovery possible, and provides breathing room until this is resolved.

Unfortunately, the 2016 draft budget was never finished, and it was not approved. We need to approve a revised 2016 budget. There will be a budget working party held in Rome to get through this out of cycle budgeting process that will hopefully put in a reasonable budget for the rest of the year until planning can start again at the October face to face board meeting.

I have created a set of financial motions that address revenue, such as a membership fee increase, additional membership classes, a training program, and to invest $250k of our unused earmarked funds in a structured investment program. These measures will collectively increase our membership, particularly in the developing economies, and improve our bottom line by over $100k per year, with an additional $60-75k over five years from investing the earmarked funds.

We will need to work together on structural reform that addresses the profit splitting more equitably so that future operational reserves do not go below six months, and so we can invest in all of our strategic goals, and not just one. This is not optional, because there is a risk that a future AppSec conference does not do well, as happened in 2012, this could bring OWASP down. We need to address this structural reform so that we can grow to a $5m per year organisation, which has far different issues than we do today.

• Josh Comment: AppSecUSA 2012 was the highest grossing AppSec conference ever held at the time. Not sure where this comment comes from, but it is wrong.
• Josh Comment: https://docs.google.com/spreadsheets/d/1GhYNDmDmkxr1xo18e9o6rj9YEILOEJl9KjDBTU-wQ1o/edit?usp=sharing

Chapters - Michael Coates

• Working with Tiffany regarding concerns over a specific chapter election
• Waiting on Sooryen information before further chapter outreach

• Developer Initiatives: Chicago Coder Conference, Goto; Chicago, TechNexus Panel on Security, Chicago FTW Start with Security Panel
• Organizational
  • Staff meetings
  • Hiring follow through for STC
• Minimal Bill payments
• 1:1 with staff at AppSecEU

• I've got nothing major to report here so let's save the time for some of the bigger discussions that we need to have.

From January to around at least April, OWASP had operational reserves far less than the target operational reserve target of six months. This is due to a lack of revenue, unbudgeted expenses, and a split model that favors one strategic goal over all others. Luckily, the success of AppSec EU has made a recovery possible, and provides breathing room until this is resolved.

Unfortunately, the 2016 draft budget was never finished, and it was not approved. We need to approve a revised 2016 budget. There will be a budget working party held in Rome to get through this out of cycle budgeting process that will hopefully put in a reasonable budget for the rest of the year until planning can start again at the October face to face board meeting.

I have created a set of financial motions that address revenue, such as a membership fee increase, additional membership classes, a training program, and to invest $250k of our unused earmarked funds in a structured investment program. These measures will collectively increase our membership, particularly in the developing economies, and improve our bottom line by over $100k per year, with an additional $60-75k over five years from investing the earmarked funds.

We will need to work together on structural reform that addresses the profit splitting more equitably so that future operational reserves do not go below six months, and so we can invest in all of our strategic goals, and not just one. This is not optional, because there is a risk that a future AppSec conference does not do well, as happened in 2012, this could bring OWASP down. We need to address this structural reform so that we can grow to a $5m per year organisation, which has far different issues than we do today.

• Josh Comment: AppSecUSA 2012 was the highest grossing AppSec conference ever held at the time. Not sure where this comment comes from, but it is wrong.
• Josh Comment: https://docs.google.com/spreadsheets/d/1GhYNDmDmkxr1xo18e9o6rj9YEILOEJl9KjDBTU-wQ1o/edit?usp=sharing

• June financial package

• 2016 Draft Budget

Secretary Report - ##########

• Need to assign this role to a current board member to fill vacancy - why

Governance report

open issues

• replacement of resigned board member Jim. Motion appoint next on voted list from last year for the remainder of the term (until Dec-31, 2016).
• brand management
• copyright statement recommendations
• complaints (several complaints open with compliance team, Matt had as chairman communication with some parties).

(all these topics are important, but not as urgent as getting our expenses in order and deciding on progressing for the ED role, etc. Therefore, I propose to table them until our next board meeting in 3 weeks time, end of July)

Updated from Members at Large - Tom Brennan, Michael Coates, and Tobias Gondrom

• Coates - Chapters

• Gondrom - Governance

• Brennan - Projects

• Need to assign this role to a current board member to fill vacancy - why

open issues

• replacement of resigned board member Jim. Motion appoint next on voted list from last year for the remainder of the term (until Dec-31, 2016).
• brand management
• copyright statement recommendations
• complaints (several complaints open with compliance team, Matt had as chairman communication with some parties).

(all these topics are important, but not as urgent as getting our expenses in order and deciding on progressing for the ED role, etc. Therefore, I propose to table them until our next board meeting in 3 weeks time, end of July)

• Executive Director/Operations Update - Rollup Report
  • Financial Update - [Link| Board Summary Combined] [Link| Combined Balance Sheet]
  • Director Update - Kate Hartmann - see rollup report above
  • Project Coordinator Update -DRAFTClaudia Aviles Casanovas Update
  • Membership Update - Membership Report Kelly Santalucia Update]
  • [Link| Conference Manager Report] - Laura Grau
  • IT Update - [Link| IT Status Report as of 2016-05-17] - Matt Tesauro

Community Initiative Reports

All active board proposals are listed here

• Motion to create Regional Advisory Councils - Please read final draft. Vote held over from January 2016

• Approve a 2016 Budget

• Motion to appoint a replacement secretary for the remainder of 2016

• Motion to appoint a casual vacancy on the OWASP Global Board for the remainder of 2016

• Motion to invest a portion of unused funds in a ladder CD arrangement

• Motion to approve changes to FY17 membership rates

• Motion to establish a pay anything membership class, eliminate honorary membership and establish an annual Paul Ritchie Memorial Award

• Motion to create an OWASP open training platform

• Date/Time: July 1, 2016/6pm-9pm CEST
• TimeZone Converter

Rome Marriott-Park Hotel

Teleconference Information:

https://www3.gotomeeting.com/join/861328838

International Toll Free Calling Information

Board Meeting Attendance Tracker

• Notice to all attendees - board meetings are recorded and publicly available as of March, 2013
• Joining the call acknowledges your awareness of recording and consent to be recorded and public dissemination of the recording.

Meeting Recording

July 1, 2016 Meeting Minutes

May 18, 2016 Meeting Minutes:

Call to Order /OWASP Mission

• Administrative: List of attendees and Agenda bashing (only if last-minute changes to the agenda are needed) (5 min)

Reports

Chair's Report - Matt Konda

• Developer Initiatives: Chicago Coder Conference, Goto; Chicago, TechNexus Panel on Security, Chicago FTW Start with Security Panel
• Organizational
  • Staff meetings
  • Hiring follow through for STC
• Minimal Bill payments
• 1:1 with staff at AppSecEU

Vice Chair's Report - Josh Sokol

• I've got nothing major to report here so let's save the time for some of the bigger discussions that we need to have.

Treasurer Report - Andrew van der Stock

From January to around at least April, OWASP had operational reserves far less than the target operational reserve target of six months. This is due to a lack of revenue, unbudgeted expenses, and a split model that favors one strategic goal over all others. Luckily, the success of AppSec EU has made a recovery possible, and provides breathing room until this is resolved.

Unfortunately, the 2016 draft budget was never finished, and it was not approved. We need to approve a revised 2016 budget. There will be a budget working party held in Rome to get through this out of cycle budgeting process that will hopefully put in a reasonable budget for the rest of the year until planning can start again at the October face to face board meeting.

I have created a set of financial motions that address revenue, such as a membership fee increase, additional membership classes, a training program, and to invest $250k of our unused earmarked funds in a structured investment program. These measures will collectively increase our membership, particularly in the developing economies, and improve our bottom line by over $100k per year, with an additional $60-75k over five years from investing the earmarked funds.

We will need to work together on structural reform that addresses the profit splitting more equitably so that future operational reserves do not go below six months, and so we can invest in all of our strategic goals, and not just one. This is not optional, because there is a risk that a future AppSec conference does not do well, as happened in 2012, this could bring OWASP down. We need to address this structural reform so that we can grow to a $5m per year organisation, which has far different issues than we do today.

• Josh Comment: AppSecUSA 2012 was the highest grossing AppSec conference ever held at the time. Not sure where this comment comes from, but it is wrong.
• Josh Comment: https://docs.google.com/spreadsheets/d/1GhYNDmDmkxr1xo18e9o6rj9YEILOEJl9KjDBTU-wQ1o/edit?usp=sharing

Chapters - Michael Coates

• Working with Tiffany regarding concerns over a specific chapter election
• Waiting on Sooryen information before further chapter outreach

Financial information

• June financial package

• 2016 Draft Budget

Secretary Report - ##########

• Need to assign this role to a current board member to fill vacancy - why

Governance report

open issues

• replacement of resigned board member Jim. Motion appoint next on voted list from last year for the remainder of the term (until Dec-31, 2016).
• brand management
• copyright statement recommendations
• complaints (several complaints open with compliance team, Matt had as chairman communication with some parties).

(all these topics are important, but not as urgent as getting our expenses in order and deciding on progressing for the ED role, etc. Therefore, I propose to table them until our next board meeting in 3 weeks time, end of July)

Updated from Members at Large - Tom Brennan, Michael Coates, and Tobias Gondrom

• Coates - Chapters

• Gondrom - Governance

• Brennan - Projects

Reports

• Executive Director/Operations Update - Rollup Report
  • Financial Update - [Link| Board Summary Combined] [Link| Combined Balance Sheet]
  • Director Update - Kate Hartmann - see rollup report above
  • Project Coordinator Update -DRAFTClaudia Aviles Casanovas Update
  • Membership Update - Membership Report Kelly Santalucia Update]
  • [Link| Conference Manager Report] - Laura Grau
  • IT Update - [Link| IT Status Report as of 2016-05-17] - Matt Tesauro

Community Initiative Reports

Old Business

All active board proposals are listed here

• Motion to create Regional Advisory Councils - Please read final draft. Vote held over from January 2016

New Business

• Status of filed Trademarks with the USPO and discussion about brand usage and resources

• Co-Marketing Agreements with other conferences

Mailing LIsts @ OWASP - Results of Leader meeting at AppSecEU OWASP-Leaders List = Announcement Only List (Policy, Procedures, Updates) * All Members Only (Projects Leaders, Chapter Leaders etc.. are MEMBERS) OWASP-AppSec List = Discussion List (Place for discussion about any AppSec Topic (moderated for appsec questions and discussion no UCE or general spam)

Motion to pay out on global appsec events by the profit from each event %. Simplify it to avoid "low balling" the projections.

Secretary Assignment / Related, update votes what was not done since Feb., https://www.owasp.org/index.php/OWASP_Board_Votes

Action Items

• Approve a 2016 Budget

• Motion to appoint a replacement secretary for the remainder of 2016

• Motion to appoint a casual vacancy on the OWASP Global Board for the remainder of 2016

• Motion to invest a portion of unused funds in a ladder CD arrangement

• Motion to approve changes to FY17 membership rates

• Motion to establish a pay anything membership class, eliminate honorary membership and establish an annual Paul Ritchie Memorial Award

• Motion to create an OWASP open training platform

Announcements

Adjournment

• Next meeting date/time: July 27th

Motion to close meeting

• Working with Tiffany regarding concerns over a specific chapter election
• Waiting on Sooryen information before further chapter outreach

• Coates - Chapters

• Gondrom - Governance

• Brennan - Projects

• Status of filed Trademarks with the USPO and discussion about brand usage and resources

• Co-Marketing Agreements with other conferences

Mailing LIsts @ OWASP - Results of Leader meeting at AppSecEU OWASP-Leaders List = Announcement Only List (Policy, Procedures, Updates) * All Members Only (Projects Leaders, Chapter Leaders etc.. are MEMBERS) OWASP-AppSec List = Discussion List (Place for discussion about any AppSec Topic (moderated for appsec questions and discussion no UCE or general spam)

Motion to pay out on global appsec events by the profit from each event %. Simplify it to avoid "low balling" the projections.

Secretary Assignment / Related, update votes what was not done since Feb., https://www.owasp.org/index.php/OWASP_Board_Votes