OWASP Board Meeting — January 24, 2018

Karen Staley - overview of 2017 (see slides on recording)

Membership

Andrew van der Stock - wanted to know if we have the 2016 Membership reports to compare to.

Kelly Santalucia - will send 2016 Membership Reports to the Board.

Chenxi Wang - who is responsible for membership

Andrew van der Stock - Executive Director’s responsibility

Chenxi Wang - can the Board help here and help the membership grow

Martin Knobloch - sure everyone should be involved in the mission

Karen Staley - we appreciate any help we can get, which Sherif is helping with.

Andrew van der Stock - in the past the staff has done membership drives. I believe we should do 4 drives a year. Example: One individual, one corporate, etc.

Karen Staley - I think events are a great opportunity to drive memberships. Kelly and I are going to work on a plan to go after members. However, we have to service the members we have and providing them with the benefits we believe they should be getting.

Chenxi Wang - I will be able to help with the driving of membership

Karen Staley - Chenxi, we can do a conference call with Kelly to discuss further.

Martin Knobloch - can we report on how many on renewals or new members.

Kelly Santalucia - since the Salesforce migration we are unable to do that. But we are working to see if we can bring that data back.

Owen Pendlebury - on the portal, I request that we have it more visible to have recurring membership option.

Karen Staley - I think we have a great opportunity to review how it worked in the pass and where we can find greater successes. In the next few months, we can view and have a plan.

Sherif Mansour - If we can have reporting based on regions, so we can see where we need improvement. Idea: is lower pricing for certain regions.

Andrew van der Stock - we currently do that. Last year we went through a process of doing a pay anything model, but it did not get approved by the Board. I would like to revisit that.

Dawn Aitken - when Kate Hartmann did the migration in May, Regional Membership was shut down. I am in the process of adding it back on and it should be done by next week.

Kelly Santalucia - I was under the impression that the sliding scale for membership was approved last year.

Andrew van der Stock - it was not approved.

Karen Staley - obviously we have some work to do on how we process membership and what we offer. Projects

Claudia - list of the new Projects for 2017 and the status of all Projects (see slides)

Andrew van der Stock - please check about the OWASP Toolbox, since it is working.

Chenxi Wang - can we clean up the inactive projects

Claudia Aviles-Casanova - Matt Tesauro was unable to give me his review before he left. So I am working with Rick Mitchell on that.

Chenxi Wang - can we put Projects that have no activity after a certain time, put them in “inactive” status. If we could have some type of published criteria, I think it would help.

Claudia Aviles-Casanova - we do that every six months. However, since Matt Tesauro was doing some much operational tasks, it did not get completed.

Chenxi Wang - it looks like that we don’t have a criteria to clean up old Projects. If you go to the wiki, there are some many Projects that have not been touched in many, many months. I believe that when someone comes to the wiki page they should be able to see the current active Projects. So how do we clean this up?

Martin Knobloch - there is a Project status process. However cleaning up the wiki is ongoing topic.

Chenxi Wang - maybe this will happen with the overall wiki clean up.

Claudia Aviles-Casanovas - Chenxi, I will reach out to you to discuss further.

Karen Staley - we currently do not have a technical person on staff, so we have some challenges. Claudia currently does not any help to do that and we are working on that.

Chapters

Tiffany Long - do the Board Members have any specific questions

Owen Pendlebury - the status of number of Chapters or new Chapters

Tiffany Long - I am in the process, which will be completed this week or early next week. The statistics I have now are too raw. Since we moved to four meetings per year, some Chapters are having a little of difficult with that.

We have more engagement with the current Chapters. However, some of our new Chapters have not taken off as well as we would like and I am working on that.

The number of Chapters will fall a little bit, since we are going to be getting rid of some Chapters. These Chapters have not responded, so we need to open those areas up again. The growth this year was small because for several months this year we were not accepting new Chapters.

Jessica Robinson - what is the approval process for new Chapters and was this year process different than other years.

Tiffany Long - The approval process is: if a person applies to an area that does not currently have a Chapter and will not compete with another Chapter that exists, they have to attend an orientation and then they will be automatically approved.

In 2016 we added the orientation process, which has lead to move new Chapters meeting on yearly requirements.

Karen Staley - just to be clear, there are certain criteria to become a Chapter and then a second level of criterias to remain a Chapter.

We also found the Chapters are meeting the criteria to form a Chapter, but are having challenges having the Chapter meetings, etc.

Tiffany Long

To start the Chapter:

• they must attend the orientation and
• to maintain the Chapter you must show good faith in having four meetings a year.

Issues:

• Several have failed in the first year because they have good intentions but never have their meetings.
• It cost money to have a meeting, renting a venue, etc. We try to remind them if they get a second leader than can getting refunding, etc.
• Putting the time in to promote the meeting, social media, etc.
• Don’t have enough time to invest in the process

Karen Staley - we have some opportunities here, by allowing meetings to host virtual meetings, etc. We need to review this process to provide Chapter to have more opportunities for success.

Owen Pendlebury and Jessica Robinson are happy to get involved with the process.

Karen Staley - I have not approached the Board in detail, but I do think that creating committees is a good idea. Example: Chapter, Project, Membership

Martin Knobloch - we actually had Committees in the past and stopped for various reasons, but I would love to see this start again.

Karen Staley - I will put some information together on this.

Sherif Mansour - how is the status with the Chapter budgets and there any lingering questions

Tiffany Long - I am about three quarters of the way through of reaching out to all of the Chapters Leaders. The questions that have popped up, have been answered to date.

Sherif Mansour - the time when you were updating the Chapter Handbook there was monthly calls, which was quite useful. Can we consider having that availability for Chapters again.

Tiffany Long - the calls were stopped because people stopped joining the call. I am available on Slack, which people reach out to me and they sometimes request a private call. I can however add availability for calls again.

Sherif Mansour - if you could list your availability so everyone can have access to it.

Financials

Tom Pappas - see slides

Cash Balance - $1.213

Payables - $300,000

Chapter - $806,000

Project - $105,000

We are working on the receiveables and Kelly is doing a great job.

Andrew van der Stock - we want the Chapters and Projects to use their money.

Martin Knobloch - where do we stand on the forecast budget for 2018. The 2018 budget is not approved as of now.

Tom Pappas - the forecast was showing a positive net income, approximately $23k

Karen Staley - the next time we meet I hope we have the budget ready to be approved. Personally, I think I need a little more time.

AppSec EU

Karen Staley - as per our conference call Recording: https://drive.google.com/a/owasp.org/file/d/1yXPSr8XcFnO63vXSTOCRTb16tn5YTFww/view?usp=sharing

AppSec EU will be held in London in 2018

Sherif Mansour - I recommend that the Board and community continued to have these types of conferences to discuss our challenges.

Martin Knobloch - I did send an email to the community earlier this week. Community felt the email was too vague, so I sent another email including the conference call with details.

Karen Staley - we want to thank the Israel community for all their hard work.

In 2018, this is the year that we will revisit our procedures and engaging more with the community.

We are now looking for a venue who can accommodate us, we are looking at the first week of July. I have received a proposal that I will review and reach out to the London community.

We are looking into have fixed dates (weeks) each year for our global events.

AppSec USA

Karen Staley

• Laura is working on the website
• We have a signed contract with the venue, Fairmont Hotel.
• Hugo is working on the marketing material
• We had our first conference call on Monday with the local Chapter
• Tiffany is handling the theme of the conference, which will branch off into tracks. The theme will be Security through Enablement
• Tiffany - rewriting the CFT, so we can reach out to new audience and reduce the tracks to three instead of four. Also, build out a track for developers

NYC RFP

Karen Staley

• NYC is writing a RFP to create a cyber city in New York
• OWASP felt it was very important to have our name associated with this.
• We several volunteers and we also hired a contract Beth Kuhan to assist.
• OWASP is the primary presenter
• We are presenting on one portion of the RFP
• We will need the Board to provide their cv’s and bios, so the reviewers can see what the makeup of the Board is.
• The one portion is based on community development and acceleration of new businesses.
• The RFP must be submitted by February 14, 2018.

If we receive a positive response, we would have to set up an Industry Committee. I would like to know if anyone from the community or the Board would be interested in being part of an advisory committee.

Bev Corwin - volunteered for the Advisory Board

Tanya Janca - is this RFP for only New York

Chenxi Wang - who is the beneficiary of this, is it global or NYC Chapter?

Karen Staley - this has nothing to do with the NYC Chapter. OWASP Global will be the beneficiary. Anyone can be on the Advisory Committee, not NYC members

Chenxi Wang - do we have the capacity to handle this?

Karen Staley - we are setting up the structure, so we will have the capacity

Jessica Robinson - volunteered for the Advisory Board

Matt Konda - what does it mean it will be another entity?

Karen Staley - in order to run this, we have discussed about setting up a B Corporation that many non profit set up when operating other businesses within the corporation. It would be owned and operated by OWASP.

Sherif Mansour - my concerns are we doing anything that would be a conflict of interest to our Chapters and/or Projects. Since our community and Project Leaders are working on projects for free, how do you think this will affect the community. For me this is a use case, that we should have communicated with the community on what parts of the RFP we should be presenting.

Martin Knobloch - before we submit the proposal it should be reviewed by a lawyer and by the current Board.

Karen Staley - we do have legal support and who is looking at the structure. I will have them give me an overview and I will include it with a copy of the RFP.

Martin Knobloch - before sending the RFP in.

Karen Staley - the community was informed and we had several conference calls.

Matt Konda - I don’t like the idea that everyone is not allow to view the RFP. i did see the email go out about joining, which I was unable. What I don’t like is that know I don’t know what is going on because I did not sign a NDA. However, I am hesitate to sign a NDA regarding OWASP because we are about openness. By concern is that this will have gravity and take over what OWASP is.

Karen Staley - I will send the RFP and schedule a call with the leader to discuss further.

Sherif Mansour - we also have the review the area that states that the documentation will be for them, meaning it will become their property.