OWASP Board Meeting — December 6, 2017

Tom Pappas - I sent a package to all board members, normally I only send it to the Board Chairman but going forward I will be sending it to all board members.

Review Reports https://www.owasp.org/images/8/87/OWASP_10.31.17_Combined_Summary_Balance_Sheet.pdf" October 2017 Combined Balance Sheet October 2017 Combined Board Summary

*Conference expenses are over budgeted, but revenue is also over budgeted.

Andrew will upload all of the financial records and/or reports once Karen decides what file system we will be using going forward.

Tom Pappas - on both AppSec we were a positive net income, however we did not come close to our budgeted net income.

Tobias Gondrom - Operational budget is supported by the surplus.

Josh Sokol - for the new board members, just to note, even though it shows a positive net income, the operational budget is in a negative. Most of the monies are allocated to the Chapters, but the operational budget borrows until they recover it from an event.

Andrew van der Stock - it does show that we are not doing a good job of allocating costs to the Chapters, they are seeing the upside but not the downside. This has too improve.

Andrew van der Stock - wanted to know if the new board members are able to attend AppSec Cali, Karen would love to meet everyone and have the January board meeting.

Matt Konda - let everyone think about that and we will follow up by email.

Approval - Josh Sokol motions, Andrew van der Stock seconds Minutes are Approved

Old Business

, Karen Staley

Karen Staley - I come from a non-profit world in leisure and tourism and very passionate about non-profits. I am super happy to be here and very impressed with what you do ad how you do it and I am immersing myself with web security

I come to you from Europe and I have lived in Europe for 12 years. I was born in Germany and raised in US. I immigrated in 1976.

I have worked in Europe to care an association and very large conference and trade show. I have done a little bit of everything, marketing, financial management, member engagement, educational programs, FOB, BOE and registrations.

I am very excited to come in on the ground floor, where there will be a great opportunity for OWASP to grow and hugely successful and I will share some of my experiences and thoughts on some the agenda items tonight. What I think will be very beneficial to OWASP in the future especially in 20178.

For the new Board Members coming on in January, it’s too early now but I will be presenting some ideas and thoughts on organizational structures, staffing outlines and also on some ideas on how we can govern better as a foundation and what our governing structure might look like in the future as well as some great opportunities on signature events, AppSec events and where I think we can take them.

Lots going on and becoming very familiar with the staff and SOPs here in OWASP and hoping to streamline things and improve our community and chapter engagement and overall foundation engagement in 2018.

I did send you all a short Board report but we will do these reports moving forward so you can see the details of what we are working on month to month. This way we don’t have to spend your value time on what we are working on on the call.

If there is more documentation you need prior to the call, we will put it on the wiki or email to you.

Matt Konda - on behalf of the Board we are thrilled to have you.

Andrew van der Stock - we have increased the budget by 10%. These are the things we need to take a lead on:

Grants - we would like to review this opportunity Membership Drives Proper Marketing Budget (about 10%) - we have very flat conference registrations this year. Web Site - $100k (new effort) Project Summit - we are putting no income, since we have no sponsorships lined up. Banners - we used to earn quite a bit of money for this, but we are going to review this as potential income. DEFCON - no money set aside this year We definitely need AppSec EU and AppSec USA to go off without a hitch this year. Accounting in the EU - try to reduce the fees, Karen as some ideas IT Support - current contractor is Harold. We are going to review the opportunity to hire a IT Support. Payroll - has gone up quite a bit this year. The amounts will change based on staff changes. Board Travel - added some more money because of the AppSec EU in Tel Aviv

Matt Konda - is this budget ready to be approve?

Tom Pappas - as we stand based on October statements, Josh is correct. We have about $1.2m in the bank, $300k in payables, and the remainder is allocated for Chapter and Projects. Technically we are in a negative of about $25k for the Operational Budget. However we have AppSec Cali, etc. approaching.

Matt Konda - based on this budget are we expecting to be borrowing from the Chapters

Josh Sokol - based on what Tom Pappas stated the answer is yes.

Andrew van der Stock - we need to table this for now, because it is the ongoing topic. We need to remember that OWASP is one entity legally. We need to do something about this and Karen has some ideas.

Change the splits, etc.

Tobias Gondrom - I do believe the amount for board travel is too much.

Israel

Karen - I know that it was approved to go to Israel. I am recommend that we reconsider this and move to a more central location, due to the financial challenges.

I have spoken with the local team and discussed my concerns.

Chenxi Wang - I do not think we have a strong support of sponsors for this location.

Andrew van der Stock - at this point there are no contracts signed and the conference is six months away. This is usually done by now.

Martin Knobloch - Do we have any alternative?

Karen Staley - The alternative is to work with Seba and try to build a relationship with him and have in UK.

I have asked the staff to pull back on marketing of this event because I feel really strongly about this.

Owen Pendlebury - based on emails circulating, Seba has signed a contract for the Summit. Do we know if the venue is going to big enough.

Chenxi Wang - I feel the Board should make the decision whether or not to move the event and than our Executive Director can work out the details. There is no need for the Board to worry about the size of the venue.

Motion - Board recognizes that there are significant issues with the AppSec EU event and empowers our new Executive Director to review and whether it is still the best location for the event and determine if the event needs to move elsewhere.

Tobias Gondrom - just let us not start to not include volunteers, they are main part of this community.

Tom Brennan - give the Israel volunteers an option to bow out.

Vote Josh Sokol - Yes Matt Konda - Yes Tom Brennan - Yes Michael Coates - Yes Tobias Gondrom - Yes Andrew van der Stock - Yes Martin Knobloch - Yes

New Electly Board - shadow votes Chenxi Wang - Yes Greg Anderson - Yes Sherif Mansour - Yes Owen Pendlebury - Yes

Josh - the Board previously voted not to support an individual Summit, that all Summit must be co-exist with an AppSec event.

However the London Summit volunteers went against the Board’s vote and set up the Summit. They are currently using OWASP branding to sell tickets.

We need to uphold our vote.

Matt Konda - can we empower Karen to handle this. No one objects

Martin Knobloch - I have spoken with a lawyer and they are willing to give us some free legal advice.

Matt Konda - can you coordinate with Karen about this.

Tom Brennan - this is an RFP, in summary a city of New York effort in putting $30m in recognizing NYC as a cyber security powerhouse.

Karen Staley - I believe that OWASP is the right foundation to support this initiative. It is a great opportunity.

Tom Brennan - looking for $10,000 to pay a coordinator to help write the RFP. It would be 400 hours at $25.00 an hour.

The Board thinks this sounds interesting and empowers our Executive Director to decide if this is something we want to move forward with.

Meeting Adjourned