OWASP Board Meeting — June 19, 2018

Board of Directors Report - see report on the wiki

• AppSec EU Registration Reports are done weekly.
• Sponsorships - doing great for both AppSec EU and AppSec USA
• AppSec USA - we will promote once EU is over.
• AppSec USA - registration is open.
• Harold visited OWASP Summit to see how it works.
• Harold to reach out to Project Leaders to highlight Projects in the Connector.
• Dawn is continuing to clean up all Chapters.
• Chapters - one size does not fit all
• It costs 165-200k to support Chapters each year.
• Goto Training - Matt will confirm that this cancelled with Virtual.

Operating Funds

• Andrew - operating reserve is seriously low.
• Suggestion - to take 20% off of the top from all Chapters
• We need to seriously discuss a new model.
• Collections are worked better than before.
• Global event strategy
• Andrew - we have to solve this now, we have to find the solution to fund the operations budget.
• Add Sherif to accounting budget.
• Matt T. will setup a google group and add Sherif
• Karen - the decision on the splits regarding events has to be made.
• Sherif - we should take it slow and be transparent
• Chenxi - we need a event strategy and a financial model
• Suggestion - we need to one thing at a time

Compliance Committee

• Greg - Compliance Committee updates, please review the updated document and comment
• Greg - Setting up a process to make the committee better
• Greg - investigating potential procedures - potential election or call for volunteers, board can not overrule their decision, Board can remove someone from committee if it is not working,
• Outsourcing - 3rd party service is too expensive
• Sherif - will the Committee be trained

• Sherif - discuss the feedback from the community on the global events
  • Set an open meeting to discuss
  • Chenxi - what is the process of coming up with criteria
  • Sherif - Karen is working on it. (Community reviews, Board votes)
  • Karen - Priorities are: accessible, availability of various venues, strong industry in the region
  • Staff should be handling the logistics
  • Community should have the experience discussing the talks
  • Chenxi - not just US and Europe
  • Karen - we should be flexible on the type of the event - 2 day, 3 day, etc. But certain criteria has to be mandatory.
  • Must be held at certain times, so there are no conflicts in dates and times.
  • Board - should not micro manage
  • Karen - suggestion we try to use the same venue so we can lower rates and have something to negotiate with
  • Chenxi - lead times can be different based on the size of the conference

Develop OWASP Board Face to face meeting agenda

• Sherif - Would like to vote on the location for the next AppSec EU to announce at the conference
• Sherif - Is Tel Aviv part of next year
• Sherif - Would like to see 4 events next year

PCI Standards Collaboration: PCI Reached out and they want to reference OWASP to Specific Mobile Security Recommendations. This will increase visibility to OWASP as they have done with the OWASP top ten.