OWASP Belgium

Welcome to the Belgium chapter homepage. The chapter leaders are Lieven Desmet, Bart De Win, David Mathy, Stella Dineva and Maxim Baele.

With the Belgium chapter, we aim to organize 4 local chapter meetings per year and co-organize the yearly BeNeLux Day. Any suggestions for speakers or venue? Feel free to reach out to us!

Upcoming events

November 14th, 2024: Lamot (Mechelen)

This meeting is co-located with the CyberSecurity event “Strategic Rsearch and Industry Impact”

Agenda:

  • 17h30-19h00: Welcome and refreshments
  • 19h00-19h10: OWASP Update
  • 19h10-20h00: A Mobile Security Crash Course: Application Security, Resilience, and Malware by Jeroen Beckers (Mobile Solution Lead at NVISO)
  • 20h00-20h45: LanShield: Control your apps, defend your network by Jeroen Robben and Angelos Beitis (DistriNet, KU Leuven)

Registration: https://www.meetup.com/nl-NL/belgium-owasp-meetup-group/events/303275189/


Save the Date !!

The following chapter meetings are currently being planned - more info will follow soon.

Make sure to already mark your agenda!

  • November 28th and 29th, 2024: OWASP BeNeLux Days 2024 (Utrecht)

    Our meetings are open to the public, and you do not need to be a member to attend. Please do consider joining OWASP if you find our community, projects, and meetings valuable, or sponsoring this chapter.

Chapter sponsors

OWASP Belgium thanks its structural chapter supporters for 2023 and the OWASP BeNeLux Days 2023

Vest Guardsquare Contrast Security ArmorCode Cegeka Zimperium Snyk Veracode SecureFlag Synopsys Approach Cyber

Example

Put whatever you like here: news, screenshots, features, supporters, or remove this file and don’t use tabs at all.

Upcoming OWASP Belgium Chapter Meetings

April 24th, 2025 @KdG (Antwerp)

On April 24th, we organize our next OWASP Belgium chapter meeting at Karel de Grote Hogeschool (Antwerp).

We are please to welcome Robbe Verwilghen and Hendrik Noben!

Location:

KDG Campus Groenplaats Nationalestraat 5 2000 ANTWERPEN

Agenda

*17:30-18:00: Welcome with snacks & drinks *18:00-18:10: OWASP update *18:10-19:00: Robbe Verwilghen - Understand what you hack, not how you hack it. *19:10-20:00: Hendrik Noben - Real Stories from Behind the SSDLC Curtain; A Game of SSDLC Mistake Bingo *20:30: End of the meetup

Registration

Our chapter meetings are open for everyone, and attendance is free of charge. We ask you to register on Meetup in order to provide you with last-minute updates, if needed.

Registration: https://www.meetup.com/belgium-owasp-meetup-group/events/306971354/

Understand what you hack, not how you hack it. (By Robbe Verwilghen, penetration tester and bug bounty hunter)

Abstract: Many people believe that technical knowledge and programming skills are essential for being a successful hacker. While these skills can certainly be helpful, they are not the key to becoming a great hacker. Through real-world examples of bugs discovered during his work as a bug bounty hunter and penetration tester, Robbe will demonstrate why understanding what you are hacking is more important than understanding how you are doing it.

About Robbe: Robbe Verwilghen is an experienced bug bounty hunter and penetration tester, who spent time at both the hunting and triaging sides. He’s the winner of 2024’s “Hack The Government”, organized by CCB. He’s currenlty consulting as a penetration tester at Toreon with a focus on web and mobile applications.

Real Stories from Behind the SSDLC Curtain; A Game of SSDLC Mistake Bingo (By Hendrik Noben, co-founder at Resilix and BSides Limburg)

Abstract: In this talk, we peel back the curtain on the Secure Software Development Lifecycle (SSDLC) and explore some real war stories. Rather than focusing on idealized process models or textbook solutions, this session highlights some messy, funny, and sometimes frustrating real-world scenarios AppSec professionals face every day. Each phase of the OWASP SAMM framework becomes a round of mistake bingo, revealing lessons learned along the way. You’ll laugh, you’ll cringe, and you’ll likely recognize more than a few of these examples from your own experience.

About Hendrik: Hendrik Noben is the co-founder of Resilix, focusing on cyber incident management and practical security assessments that lead to strategic guidance. As trusted advisor, provinding a pragmatic and people-aware approach to modern security challenges. Hendrik brings a hands-on background as a penetration tester and security architect. He is also the (co-)founder of BSides Limburg, a community-driven security event in Belgium.

Meeting archive

2024 chapter meetings

November 14th, 2024: Lamot (Mechelen)

This chapter meeting will take place at the Lamot Congress Center, in Mechelen.

We are please to welcome Jeroen Beckers and TBD. This meeting is co-located with the CyberSecurity event “Strategic Rsearch and Industry Impact”

Agenda:

Registration

Our chapter meetings are open for everyone, and attendance is free of charge. We ask you to register on Meetup in order to provide you with last-minute updates, if needed.

Registration: https://www.meetup.com/nl-NL/belgium-owasp-meetup-group/events/303275189/

A Mobile Security Crash Course: Application Security, Resilience, and Malware

In this talk, I will take you through the key aspects of mobile security, focusing on three main areas: application security, mobile resilience, and mobile malware. I’ll begin by introducing the OWASP Mobile Application Security (MAS) framework, sharing best practices for securing mobile apps and addressing common vulnerabilities. From there, I’ll dive into mobile resilience, discussing how to protect apps from reverse engineering, tampering, and cheating, with a link back to the OWASP MAS strategies. Finally, I’ll look at the increasing threat of mobile malware, using a recent case in Belgium as an example to show how malware spreads and what steps can be taken to defend against it. By the end of the session, you’ll have a well-rounded understanding of mobile security and actionable insights to protect your mobile apps and users.

Jeroen Beckers

I am the mobile solution lead at NVISO, where I am responsible for quality delivery, innovation and methodology for all mobile assessments. I am actively involved in the mobile security community, and I try to share my knowledge through open-source tools, blogposts, trainings and presentations. I am the lead author and instructor of the SANS 575 course: Mobile device security and ethical hacking and one of the authors of the OWASP Mobile Application Security (MAS) project, which includes the OWASP Mobile Application Security Verification Standard (MASVS) and the OWASP Mobile Application Security Testing Guide (MASTG)

October 3rd, 2024, Diegem

This chapter meeting will take place at E&Y in Diegem.

Location:

Kouterveldstraat 7B 001, 1831 Diegem

Agenda (subject to change)

JWT security and exploitation (by Louis Nyffenegger, founder of PentesterLab)

Abstract: Nowadays, JSON Web Tokens (JWTs) are ubiquitous, serving as session tokens, OAuth tokens, or simply as a means to pass information between applications or microservices. However, by design, JWTs contain numerous security and cryptography pitfalls that can lead to serious vulnerabilities. In this talk, we will explore how to exploit some of these issues. We’ll begin by examining some well-known vulnerabilities, such as the ‘none’ algorithm and brute-forcing or guessing the HMAC secret. Then, we’ll move on to more recent issues, including how an RSA public key can be computed from multiple signatures to exploit algorithm confusion, and how a similar attack can be executed against ECDSA. We will also delve into exploiting weaknesses in the kid, jku, and x5u headers. Finally, we’ll discuss how to leverage CVE-2022-21449 to bypass the signature mechanism entirely.

About Louis Nyffenegger: Louis Nyffenegger is a seasoned security engineer and the founder of PentesterLab, a platform dedicated to teaching web penetration testing. With over a decade of experience in cybersecurity, Louis has focused on penetration testing, architecture analysis, and code reviews. He also launched a YouTube channel, AppSecSchool, further extending his passion for education in application security.

Breaking and securing OAuth 2.0 in frontends (by Dr. Philippe De Ryck, Founder of Pragmatic Web Security)

Abstract: Everyone agrees that Cross-Site Scripting (XSS) is a real threat to browser-based applications, yet many underestimate its true power. Common practices like using Single Page Applications as OAuth 2.0 clients, with techniques such as refresh token rotation, fail to account for real-world attackers.

This talk will demonstrate two concrete hacks against frontend OAuth 2.0 clients, highlighting the underlying vulnerabilities. We will explore how to address these security shortcomings by introducing structural solutions like the Backend-for-Frontend pattern. By the end of this session, you will be fully up to speed with the latest updates to the “OAuth 2.0 for Browser-based Apps” specification, co-authored by the presenter. You will walk away with a solid understanding of OAuth 2.0 security in frontends and best practices for securing sensitive applications.

About Dr. Philippe De Ryck: Philippe De Ryck specializes in making web security accessible to developers and architects, leveraging his Ph.D. from KU Leuven to inform his comprehensive understanding of security challenges. As the founder of Pragmatic Web Security, he provides practical security training and consulting services to organizations worldwide. His online course platform offers a self-paced approach to learning about security. Philippe also actively helps shape OAuth 2.0 best practices as the co-author of the best practices for browser-based apps specification. Philippe is recognized as a Google Developer Expert, acknowledging his contributions to web application and API security. He also organizes SecAppDev, an annual week-long application security course in Belgium.

May 21st, 2024, Brussels

This chapter meeting will take place in BeCentral (Proximus-ADA) in Brussels.

Location:

Cantersteen 12, 1000 Brussels

Agenda (subject to change)

User Privacy in Online Location-Based Services - Victor LePochat and Karel Dhondt (Distrinet - KU Leuven)

Abstract: Location-based services (LBSs) have transformed social interactions and personal experiences in the digital landscape. LBSs stand among the most popular applications on major app stores, appreciated by users for their capacity to enhance social connectivity, enabling them to seamlessly connect with others, share locations, and organize meetups. In this talk, we analyze the inherent privacy and security risks associated with the sharing of personal information and geographical locations in LBSs, with a dedicated emphasis on social privacy. We explore the extent of data exposure and leaks present in two popular categories in LBSs: fitness tracking social networks (FTSNs), where we develop a novel inference attack to circumvent privacy zones, and location-based dating (LBD) apps, where we assess which personal and sensitive data is (inadvertently) shared with other users, including victims’ exact locations.

About Victor Le Pochat: Victor is a postdoctoral researcher in web security and privacy at the DistriNet research unit of KU Leuven. His research interests lie in exploring large web ecosystems, understanding how to detect and mitigate harmful online content, and both analyzing and improving current research methods.

About Karel Dhondt: Karel is a researcher whose interests lie in the security and privacy of online location-based services.

Signaling New Frontiers: SS7 Insights - Jeremy Schmidt (Proximus ADA)

Abstract: SS7 is an old protocol without any built-in security controls. Threat actors across the globe regularly attempt to abuse this protocol in order to perform malicious activities on mobile networks. This presentation details how Proximus detects, blocks and shares malicious activities observed on our SS7 network.

About Jeremy Schmidt: Jeremy is a seasoned Cyber Security and Incident Response Specialist at Proximus, with a distinguished tenure of over seven years. He specializes in SS7 traffic analysis, threat detection, and intelligence sharing, playing a crucial role in safeguarding telecommunications networks. In the past two years, Jeremy has been at the forefront of investigating and identifying SS7 threats, actively contributing to the GSMA community by sharing his findings and enhancing collective security measures.

May 2nd, 2024, Antwerpen

This chapter meeting took place at the High School “Karel de Grote” in Antwerpen.

Location:

Nationalestraat 5, 2000 Antwerpen

Agenda:

Navigating the Evolving Landscape of Cyber Security Legislation as an IoT Device Manufacturer - Joris Gorinsek (NIKO)

Abstract: The world of IoT security is on the cusp of significant change with the arrival of new regulations like the EU’s Radio Equipment Delegated Act (RED DA), Cyber Resilience Act (CRA) and NIS2 Directive. This presentation will provide a brief overview of these upcoming legislations and their impact on the way we at Niko develop and source IoT devices.

In this presentation we’ll delve into the compliance requirements for manufacturers under the RED DA and share our lessons learned. We’ll outline our strategy for tackling the upcoming CRA for both in-house developed products and those sourced externally. Finally, we’ll share how you, as an application security advocate, can leverage these regulations to promote a more secure future for your organization.

About Joris Gorinsek: For over 20 years, Joris has been deeply involved in the design and development of embedded and IoT devices. His expertise extends from low level bootloaders and Linux kernel internals all the way to smartphone applications and cloud services, with a strong focus on application security for the past 6 years.

Currently, as system architect for Niko’s Home Automation department, Joris champions product security, ensuring their offerings are built using robust security practices. Lately most of his time is spent on analyzing upcoming cybersecurity legislation, assessing its impact on Niko’s products, their way of working and defining optimal strategy for compliance.

Joris is a member of the Agoria industry expert group on cybersecurity legislation and a DPI Certified CISO.

OWASP Cornucopia and Scrum: A strategic approach to introduce threat modeling in an Agile development process - Ive Verstappen & Jef Meijvis (DotNET Lab)

Abstract: In today’s fast-paced software development environments, embedding security within agile frameworks such as Scrum is essential. This presentation introduces OWASP Cornucopia, an effective tool for identifying and integrating security requirements into agile development cycles. We’ll explore how to integrate the Cornucopia game into Scrum processes, particularly during the planning phase, to enhance security without disrupting development flow. Participants will learn practical tips for facilitating Cornucopia games within their teams, using outcomes to improve application security, and scaling the approach based on project complexity and security needs. This presentation will provide valuable insights for Scrum Masters, product owners, developers, and security professionals aiming to better integrate security practices into their agile processes, ultimately leading to safer and more robust software products.

About Ive Verstappen: As the founder of dotNET lab, I am blessed to be able to work with world-class people, all of whom I respect and admire. I’m also pleased to have great, understanding customers from whom I learn a great deal about building a trustworthy business. Every day is a learning-experience for me. We are extremely pleased to have a first-class team of consultants at dotNET lab. Our consultants are professionals and excellent developers. Besides being professional, they are also nice, interesting people with whom I enjoy spending my time. I find the world of Business and IT endlessly interesting and I really enjoy the process of trying to create a company where great people like to work.

About Jef Meijvis: Jef serves as the unit director for the Cybersecurity unit at dotNET lab. With a robust foundation in software development and cloud architecture, his focus lies in enhancing the security within software development teams. He has hands-on experience with securing and moving enterprise applications to a cloud environment, especially in the Microsoft & Azure ecosystem.

2023 chapter meetings

October 17th, 2023, Mechelen (BE)

This chapter meeting will take place at the Lamot Congress Center, in Mechelen.

We are please to welcome Asuman Senol and Georges Bolssens. This meeting is co-located with the CyberSecurity event “Strategic Rsearch and Industry Impact”

Agenda:

Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission

Web users enter their email addresses into online forms for a variety of reasons, including signing in or signing up for a service or subscribing to a newsletter. While enabling such functionality, email addresses typed into forms can also be collected by third-party scripts even when users change their minds and leave the site without submitting the form. Email addresses—or identifiers derived from them—are known to be used by data brokers and advertisers for cross-site, cross-platform, and persistent identification of potentially unsuspecting individuals. In order to find out whether access to online forms is misused by online trackers, we present a measurement of email and password collection that occurs before the form submission on the top 100,000 websites. We evaluate the effect of user location, browser configuration, and interaction with consent dialogs by comparing results across two vantage points (EU/US), two browser configurations (desktop/mobile), and three consent modes. Our crawler finds and fills email and password fields, monitors the network traffic for leaks, and intercepts script access to filled input fields. Our analyses show that users’ email addresses are exfiltrated to tracking, marketing and analytics domains before form submission and without giving consent on 1,844 websites in the EU crawl and 2,950 websites in the US crawl. While the majority of email addresses are sent to known tracking domains, we further identify 41 tracker domains that are not listed by any of the popular blocklists. Furthermore, we find incidental password collection on 52 websites by third-party session replay scripts.

Asuman Senol

Asuman Senol is a last year PhD student at COSIC under the supervision of Assistant Prof. Gunes Acar and Prof. Claudia Diaz. She works on online tracking and web privacy. Her research involves conducting large-scale web measurement studies to investigate privacy and security issues on the Web. Before starting her doctoral studies, she worked as a full-stack web developer for 5 years. She contributes to various open source software projects thanks to her background in the industry and current academic interests in privacy and security.

Cyber breaches and how to prevent them

This talk explains the common threats for software applications from an attacker point of view, by using real-world data breaches and what the attacked companies could have done to prevent it.

We have selected breaches of which technical details are well understood, so we can use them as case studies, which we will approach using the following questions:

  • What happened?
  • Why did this happen?
  • What were the consequences?
  • How can you prevent it?

Georges Bolssens

Georges Bolssens embarked on his coding journey in the early 1990s and delved into the realm of application security in 2017. With an inherent passion for teaching, Georges is not only a seasoned developer but also an adept communicator. His unique talent lies in simplifying intricate subjects through relatable analogies, making him an engaging and effective speaker.

Having undertaken numerous consulting assignments, Georges has assumed the role of a cybersecurity educator for a diverse spectrum of professionals. His guidance has illuminated the path for individuals ranging from legal experts at renowned “Big 4” consulting firms to ethical hackers and all those in between.

In his capacity as an Application Security Consultant at Toreon, Georges has been instrumental in assisting numerous clients in constructing comprehensive threat models for their digital assets. His expertise and commitment led to his appointment as a co-instructor for Toreon’s distinguished “Advanced Whiteboard Hacking – a.k.a. Hands-on Threat Modeling” course. Notably, he co-taught this course at the esteemed “BlackHat USA” conference in 2023.

November 23-24th, 2023, Hasselt (BE)

Join us in Hasselt for the 2023 version of Owasp BeNeLux days.

2022 chapter meetings

November 24-25th, 2022, Tilburg (NL)

Join us in Tilburg for the 2022 version of Owasp BeNeLux days.

September 13th, 2022, Mechelen

This chapter meeting will take place at the Lamot Congress Center, in Mechelen.

This event is co-located with the CyberSecurity event “Strategic Rsearch and Industry Impact”

Agenda

14 June 2022 meeting (Leuven)

17 May 2022 meeting (Antwerpen)

Agenda:

  • 17h-18h: Welcome and refreshments
  • 18h-18h10: OWASP Update
  • 18h10-19h: Securing a World of Physically Capable Computers (by Bruce Schneier)

Venue: Hosted by Karel de Grote University of Applied Sciences and Arts

2021 chapter meetings

OWASP Belgium Virtual Chapter Meeting Series 2021

To kickstart 2021, we plan a series of virtual chapter meetings. Every 3rd Thursday of the month, we invite a renowned, international speaker to join us in a focused evening session.

Previous events of 2021:

Our chapter meetings are open for everyone, and attendance is free of charge. We ask you to Register via the OWASP Belgium Meetup group in order to provide you with last-minute updates, if needed.

16 September 2021: The OWASP Top 10 2021 (by Andrew van der Stock)

This virtual chapter meeting will host Andrew van der Stock!

The OWASP Top 10 2021

The OWASP Top 10 2021 is the latest version of the venerable project. During this session, Andrew will take you through how we designed and improved the data collection, the results of the data analysis, the Top 10 2021 itself - with a brief description of each item, along with how you can best adopt and promote this awareness piece. Also, a brief introduction to the work Andrew is doing on the ASVS 5.0, due in 2022.

Andrew van der Stock

Andrew is a seasoned web application security specialist and enterprise security architect. He is the Executive Director at OWASP, taking the Foundation through organizational change and taking our mission to the next level. Andrew has worked in the IT industry for over 25 years. Andrew has researched and developed the web application security and architecture fields since 1998. He is a Lifetime member of OWASP, former Director, and co-leads the OWASP Application Security Verification Standard and OWASP Top 10 projects. An Australian ex-pat of Melbourne and Sydney, he currently lives in the USA with his family.

21 October 2021: Component Analysis vs SCA - How SBOMs are the driving force for change (by Steve Springett)

This virtual chapter meeting will host Steve Springett!

Component Analysis vs SCA - How SBOMs are the driving force for change

This walk would dive into the CycloneDX Software Bill of Materials specification and world-wide efforts to identify and reduce risk in the global software supply chain.

Steve Springett

Steve educates teams on the strategy and specifics of developing secure software. He practices security at every stage of the development lifecycle by leading sessions on threat modeling, secure architecture and design, static/dynamic/component analysis, offensive research, and defensive programming techniques. Steve’s passionate about helping organizations identify and reduce risk from the use of third-party and open source components. He is an open source advocate and leads the OWASP Dependency-Track project, OWASP Software Component Verification Standard (SCVS) project, CycloneDX software bill of materials standard, and participates in several related projects and working groups.

2020 chapter meetings

23-27 November 2020: OWASP BeNeLux Days

Block your agenda for 4 online evening sessions - more info will follow soon (see https://www.owaspbenelux.eu/)!!

28 October 2020: OWASP BE Local virtual security day

This virtual security day / conference is free to join for everybody and we have an amazing line up of interesting speakers and topics. Also we have multiple workshops you can attend for free.

Agenda Talks

  • 9h - 9h15: OWASP Kickoff (by Sebastien Deleersnyder & Glenn ten Cate)
  • 9h15 - 10h: OWASP SAMM (by Sebastien Deleersnyder)
  • 10h - 11h: Making the web secure by design (by Riccado ten Cate)
  • 11h - 11h45: Zerologon - taking over an AD domain in three seconds (by Tom Tervoort)
  • 11h45 - 12h45 break
  • 12h45 - 13h30: Phoenix - Proactively detect and fight phishing attacks (by Davide Cioccia and Stefan Petrushevski)
  • 13h30 - 14h15: Using oldschool techniques to turn software to malware (by Hidde Westerhof)
  • 14h15 - 15h State of the internet (by Peter Massini)
  • 15h - 15h05: OWASP Closing word

Agenda Workshops

  • Workshop Malware general (by Zsombor Kovacs)
  • Workshop OWASP-SKF (by Riccardo ten Cate)
  • Workshop OWASP-SAMM (by Sebastien Deleersnyder)
  • Workshop Malware / Red Teaming (by Tom Kallo)

6-7 June 2020: OWASP Chapters All Day (24 conference)

Leaders from OWASP Chapters throughout the world invite you to join us for 24 hours of non-stop AppSec!

This OWASP Chapters All Day conference is scheduled for June 6-7, and features among others 2 local speakers: chapter lead Seba Deleersnyder (on OPEN SAMM v2) and PhD researcher Victor Le Pochat (on the Avalanche botnet takedown).

The festivities will kick off with Welcoming Remarks and a Keynote presentation at 2pm local time (12:00 noon UTC) on Saturday, 6 June. Then, each hour, the (virtual) floor will be handed over to a leader from another OWASP Chapter, who will introduce speakers from their chapter/region. At 2pm local time (12:00 noon UTC) on Sunday, 7 June, a brief recap and closing remarks will wrap up the Chapters All Day conference.

The OWASP Belgium time slot (with Sebastian and Victor) is scheduled at 3pm local time on Saturday!!

The full schedule and details are available at https://owasp.org/www-community/social/chapters_all_day/ .

29 April 2020: OWASP - ING Open security conference (Brussels)

POSTPONED Due to the COVID-19 related restrictions, the chapter meeting will be postponed.

ING Belgium is proud to organize an open security conference in collaboration with OWASP.

Venue

The event will take place @ at ING Brussels on 29th of April 2020

  • A couple of workshops will be hosted during the day
  • The event will be for 300 people max
  • No marketing pitches

11 March 2020 meeting (Leuven)

CANCELLED Due to the COVID-19 related cancellation of the Secure Application Development course, the chapter meeting will be cancelled as well.

Venue

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development, a unique AppSec course held in Leuven from 2020-03-09 to 2020-03-13.

Agenda

  • 18h00 - 18h50: Welcome & sandwiches
  • 18h50 - 19h00: OWASP Update
  • 19h00 - 20h00: The hitchhikers guide to secrets for cloud environments by Abhay Bhargav (CEO we45)
  • 20h00 - 20h10: Break
  • 20h10 - 21h10: Blueprint for secure JavaScript development by Marcin Hoppe (Senior Manager, Product Security, Auth0)

2019 chapter meetings

25 November 2019 meeting (Leuven)

Venue

Hosted by DistriNet Research Group (KU Leuven)

The event is co-located with a briefing and industry opportunity meeting of the Flanders Cyber Security impuls program. Feel free to register for this co-located event if interested.

Agenda

23-27 September 2019: Global AppSec Amsterdam

Together with the OWASP staff and the OWASP Netherlands chapter, the OWASP Belgium chapter supports and contributes to the organisation of the Global AppSec Amsterdam 2019. We kindly invite all our chapter members to join us in Amsterdam in September!

Due to focusing our efforts on the Global AppSec Amsterdam conference, we decided to skip this year’s edition of the OWASP BeNeLux Days. Mark your agenda for next year: 26 and 27 November 2020 in the Netherlands.

Summit working session on OWASP SAMM

OWASP Belgium presents a summit working session on OWASP SAMM in Antwerp on 30 April.

Registration is free but mandatory (via EventBrite): https://www.eventbrite.com/e/open-security-summit-working-session-tickets-60456102831

20 February 2019 Meeting

Venue

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development course held in Leuven from 2019-02-18 to 2019-02-22.

Agenda

2018 chapter meetings

OWASP BeNeLux Days 2018

This conference has its own page: OWASP_BeNeLux-Days_2018.

23 October 2018 Meeting (Bruges)

Hosted by Secure Code Warrior

Agenda

7 September 2018 Meeting (Brussels)

Hosted by the European Commission

Agenda

  • 18h00 - 18h50: Welcome & sandwiches
  • 18h50 - 19h00: OWASP Update by Sebastien Deleersnyder (OWASP BE)
  • 19h00 - 19h10: Intro by the EC by Miguel Soria Machado (Head of Sector CSIRC, DIGIT IT Security Directorate, European Commission)
  • 19h10 - 20h00: Docker Threat Modeling and Top 10 by Dirk Wetter
  • 20h00 - 20h10: Break
  • 20h10 - 21h00: Securing Containers on the High Seas by Jack Mannino (nVisium)
  • 21h00 - 21h30: Networking drink

19 March 2018 Meeting (Brussels)

Hosted by ING Belgium

Agenda

  • 18h15 - 19h00: Welcome & sandwiches
  • 19h00 - 19h10: OWASP Update by Sebastien Deleersnyder (OWASP BE)
  • 19h10 - 20h00: KRACKing WPA2 in Practice Using Key Reinstallation Attacks by Mathy Vanhoef (DistriNet, KU Leuven)
  • 20h00 - 20h10: Break
  • 20h10 - 21h00: Making the web secure by design by Glenn Ten Cate (ING Belgium) and Riccardo Ten Cate (Xebia)
  • 21h00 - 21h30: Networking drink

20 February 2018 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development course held in Leuven from 2018-02-19 to 2018-02-23.)

Agenda

2017 chapter meetings

19 June 2017 Meeting (Brussels)

Hosted by NVISO

Agenda

29 May 2017 Meeting (Machelen)

Hosted by Ernst & Young

Agenda

  • 18h00 - 18h50: Welcome & sandwiches
  • 18h50 - 19h00: OWASP Update by Lieven Desmet (OWASP BE)
  • 19h00 - 19h45: HTTP for the Good or the Bad by Xavier Mertens (freelance security consultant)
  • 19h45 - 20h30: Reverse engineering with Panopticon: a Libre Cross-Platform Disassembler by Kai Michaelis
  • 20h30 - … : Reception

28 February 2017 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development course held in Leuven from 2017-02-27 to 2017-03-03.

Address

2016 chapter meetings

18 October 2016 Meeting (Ghent)

Hosted by UGent

Agenda

8 September 2016 Meeting (Zaventem)

Hosted by PwC

Agenda

23 May 2016 Meeting (Mechelen)

Hosted by is4u at Moonbeat (Mechelen)

Agenda

  • 18h00 - 19h00: Welcome & sandwiches
  • 19h00 - 19h10: OWASP Update
  • 19h10 - 20h00: All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS by Mathy Vanhoef (DistriNet, KU Leuven)
  • 20h00 - 20h10: Break
  • 20h10 - 21h00: Docker Security by Nils De Moor (CTO at WooRank)
  • 21h00 - … : Networking drink

8 March 2016 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development course held in Leuven from 7-11 March 2016.

Agenda

2015 chapter meetings

24 February 2015 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development course held in Leuven from 23 to 27 February 2015.

Agenda

2014 chapter meetings

17 December 2014 Meeting (Mechelen)

Hosted by is4u at Moonbeat (Mechelen)

Agenda

  • 18h00 - 18h45: Welcome & sandwiches
  • 18h45 - 19h00: OWASP Update by Sebastien Deleersnyder (OWASP Belgium Board)
  • 19h00 - 20h00: OWASP Top 10 Mobile Risks / demos by Erwin Geirnaert
  • 20h00 - 20h15: Break
  • 20h15 - 20h30: Investigating software security practices by Koen Yskout and Laurens Sion (DistriNet, KU Leuven)
  • 20h30 - 21h30: OpenSAMM Best Practices: Lessons from the Trenches by Sebastien Deleersnyder and Bart De Win

20 May 2014 Meeting (Brussels)

Hosted by NVISO

Agenda

12 February 2014 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development course held in Leuven from 10 to 14 February 2014.

Agenda

2013 chapter meetings

17 December 2013 Meeting (Leuven)

Jointly organized with (ISC)2

Hosted by DistriNet Research Group (KU Leuven)

Agenda

8 October 2013 Meeting (Diegem)

Hosted by Ernst & Young

Agenda

6 June 2013 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Agenda

Previous Meeting (5th of March 2013) in Leuven

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development course held in Leuven from 4 March 2013 until 8 March 2013.

Agenda

2012 chapter meetings

26 September 2012 Meeting (Ghent)

Hosted by PWC

Co-organized with the ISSA (Information Systems Security Association)

Address

12 September 2012 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Co-organized with the IWT-project SPION (security and privacy in online social networks)

Agenda

6 March 2012 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Both speakers are faculty of the Secure Application Development course held in Leuven from 5 March 2012 until 9 March 2012.

Agenda

25 January 2012 Meeting (Brussels)

Hosted by Cisco Belgium

Agenda

2011 chapter meetings

16 June 2011 Meeting (Brussels)

Hosted by Deloitte

Agenda

  • 18h00 - 18h30: Welcome & Sandwiches
  • 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, SAIT Zenitel, OWASP Board)
  • 18h45 - 19h45: The OWASP AppSensor Project (by Colin Watson, Watson Hall Ltd)
  • 19h45 - 20h00: Break
  • 20h00 - 21h00: How to become Twitter’s admin: An introduction to Modern Web Service Attacks (by Andreas Falkenberg, RUB)

23 May 2011 Meeting (Brussels)

Location: LCM, Brussels

Co-organized with the ISSA (Information Systems Security Association)

Agenda

2010 chapter meetings

21 September 2010 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven). Pizza’s sponsored by F5 Networks.

Agenda

16 June 2010 Meeting (Brussels)

Hoste by Zenitel Belgium.

Agenda

  • 18h00 - 18h30: Welcome & Refreshments
  • 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, Zenitel, OWASP Board)
  • 18h45 - 20h00: Advanced SQL Injection (by Joe McCray, Learn Security Online)

1 June 2010 Meeting (Brussels)

Hosted by Cisco Belgium

Agenda

  • 18h00 - 18h30: Welcome & Refreshments
  • 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, Zenitel, OWASP Board)
  • 19h00 - 20h00: The Belgian e-ID: hacker vs developer (by Erwin Geirnaert and Frank Cornelis)
  • 20h00 - 20h15: Break
  • 20h15 - 21h15: Analyzing the Accuracy Of Web Application Scanners (by Larry Suto)

1 February 2010 Meeting (Brussels)

Hosted by Ernst & Young

Co-organized with the ISSA (Information Systems Security Association)

Agenda

2009 chapter meetings

15 September 2009 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven). Pizza’s sponsored by F5 Networks.

Agenda

  • 18h30 - 19h00: Welcome & Refreshments
  • 19h00 - 19h15: OWASP Update (by Sebastien Deleersnyder, Telindus, OWASP Board)
  • 19h15 - 20h00: CSRF: the nightmare becomes reality (by Lieven Desmet, DistriNet Research Group (K.U. Leuven))
  • 20h00 - 21h15: Hacking Web 2.0 Streams – Cross Domain Injection and Exploits (by Shreeraj Shah, founder of Blueinfy)

4 March 2009 Meeting (Brussels)

Hosted by Telindus, Belgacom-ICT

Agenda

  • 18h00 - 18h30: Welcome & Refreshments
  • 18h30 - 18h45: OWASP Update (by Sebastien Deleersnyder, Telindus, OWASP Board)
  • 18h45 - 20h45: A Software Security Maturity Model (by Gary McGraw, CTO of Cigital)

4 February 2009 Meeting (Brussels)

Hosted by Ernst & Young

Agenda

  • 18h00 - 18h30: Welcome & Refreshments
  • 18h30 - 18h40: OWASP Update (by Sebastien Deleersnyder, Telindus, OWASP Board)
  • 18h40 - 19h30: Best Practices Guide Web Application Firewalls (by Alexander Meisel, CTO and founder of Art of Defence)
  • 19h30 - 20h00: I thought you were my friend - Evil Markup, browser issues and other obscurities (by Mario Heiderich)
  • 20h00 - 20h10: Break
  • 20h10 - 21h00: Research on Belgian bank trojan attacks (by Richard Bennett, software consultant)

2008 chapter meetings

17 November 2008 Meeting (Brussels)

Hosted by Isabel, the catering was sponsored by ISSA

Co-organized with the ISSA (Information Systems Security Association)

Agenda

  • 18h00 - 18h30: Welcome & Refreshments
  • 18h30 - 19h00: OWASP / ISSA introduction (by Philippe Bogaerts, OWASP Belgium and Bart Moerman, ISSA Brussels-European Chapter)
  • 19h00 - 20h00: Risky PDF [ZIP] (by Didier Stevens, Contraste Europe)
  • 20h00 - 21h00: .NET Rootkits - Backdoors Inside Your Framework (by Erez Metula, 2BSecure)

23 October 2008 Meeting (Huizingen)

Hosted by RealDolmen

Agenda

  • 18h00 - 18h30: Welcome & Refreshments
  • 18h30 - 19h00: OWASP Update (by Sebastien Deleersnyder, OWASP Belgium)
  • 19h00 - 20h00: Building a tool for Security consultants: A story of a customized source code scanner (by Dinis Cruz, OWASP)
  • 20h00 - 21h00: Logging: not just a good idea (by Eddy Vanlerberghe)

21 April 2008 Meeting (Luxembourg, LU)

Location: Centre de Recherche Public Henri Tudor

Agenda

  • 16h00 - 16h30: Welcome & Sandwiches
  • 16h30 - 17h00: OWASP Introduction (by Sebastien Deleersnyder, OWASP BeLux)
  • 17h00 - 18h00: How to break Web Applications (by Philippe Bogaerts, NetAppSec)
  • 18h00 - 18h15: break
  • 18h15 - 19h15: How to secure Web Applications (the OWASP Way) (by Sebastien Deleersnyder, Telindus)

9 April 2008 Meeting (Brussels)

Hosted by Deloitte

Agenda

OWASP at infosecurity.be: 20 March 2008 (Brussels)

OWASP will be present on Infosecurity.be 2008

Agenda:

4 March 2008 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven)

Agenda

  • 18h00 - 18h30: Welcome, Refreshments and drinks
  • 18h30 - 18h45: OWASP Update by Sebastien Deleersnyder (OWASP BeLux)
  • 18h45 - 19h00: CAcert.org and Thawte by Kenneth Van Wyck (KRvW Associates)
  • 19h00 - 20h00: Development life cycle issues by Kenneth Van Wyck (KRvW Associates)
  • 20h00 - 20h15: break
  • 20h15 - 21h15: Structural improvements for SDLs by Bart De Win (DistriNet, KU Leuven)

2007 chapter meetings

20 November 2007 Meeting (Leuven)

Hosted by DistriNet Research Group (KU Leuven). Pizza’s and drinks sponsored by NetAppSec.

Co-organized with the ISSA (Information Systems Security Association)

Agenda

  • 18h00 - 18h30: Welcome, Pizza and drinks
  • 18h30 - 18h45: OWASP Update by Sebastien Deleersnyder (OWASP BeLux)
  • 18h45 - 19h00: ISSA Intro by Tomas Vanhoof (ISSA)
  • 19h00 - 20h00: Operational security impact on developing secure applications by Patrick Debois
  • 20h00 - 20h15: break
  • 20h15 - 21h15: Security awareness programs for development by Herman Stevens & Swa Frantzen (NET2S)

OWASP Day 2007: 6 September 2007 (Brussels)

On September 6th, OWASP organized OWASP Day conferences worldwide triggered by the Global Security Week idea. In Belgium we organized the mini-conference in Brussels.

Hosted by Telindus, Belgacom-ICT at the SURF House

Agenda

22 June 2007 Meeting (Diegem)

Hosted by Deloitte

F5 Networks sponsored Ivan Ristic and Dinis Cruz to come to Brussels.

Agenda

10 May 2007 Meeting (Leuven)

Hosted by ps_testware

Agenda

OWASP at infosecurity.be: 21-22 March 2007 (Brussels)

OWASP will be present on Infosecurity.be 2008

Agenda

23 January 2007 (Brussels)

Hosted by Ernst & Young

Agenda

2006 chapter meetings

JavaPolis 2006: 15/12/2006 (Antwerp)

Stephen de Vries (project leader of the OWASP Java Project) did a talk at JavaPolis in Belgium.

Agenda

  • Security Sins and their Solutions by Spehen de Vries (project lead of the OWASP Java Project)

14 September 2006 Meeting (Antwerp)

Hosted by ING Belgium

Co-organized with the ISSA (Information Systems Security Association)

Agenda

8 May 2006 Meeting (Brussels)

Hosted by Deloitte

Agenda

  • 18h00 - 18h30: Welcome, get drink & snack
  • 18h20 - 18h40: OWASP Update by Sebastien Deleersnyder (Ascure)
  • 18h45 - 19h15: Internet Attack Statistics for Belgium in 2005 by Hillar Leoste (Zone-H)
  • 19h15 - 20h30: Can “Agile” Development Produce Secure Applications? by Johan Peeters (Program Director secappdev.org)

22 February 2006 (Leuven)

Hosted by DistriNet Research Group (KU Leuven). Pizza’s and drinks sponsored by BeeWare.

Agenda

New years drink: 19 January 2006 (Leuven)

On January 19th we had a New Years Drink. It was sponsored by Zion Security

Agenda

2005 chapter meetings

28 September 2005 Meeting (Leuven)

Hosted by Ubizen

Agenda

26 May 2005 Meeting (Ghent)

On 26th of May 2005 we held the first OWASP Belgium Chapter meeting!

It was a big success: we had nearly 40 people attending, despite the Belgium-unlike hot weather.

Agenda

Local sponsors

OWASP Belgium thanks its structural chapter supporters for 2023 and the OWASP BeNeLux Days 2023

Vest Guardsquare Contrast Security ArmorCode Cegeka Zimperium Snyk Veracode SecureFlag Synopsys Approach Cyber

If you want to support our chapter, please contact Stella Dineva.

Watch Star