OWASP Orlando

Tuesday 12/4/2018 Presentation Meeting

• Intro to Frida - for binary and mobile app analysis - David Incorvaia

This is an introductory level presentation on Frida. What the tool can open up to the engineer and basic reverse engineering adventures with the tool.

• Are you ready for the worst? - Tanya Janca

No matter the size of your IT shop, if the first time you think about the security of the software is during a major incident, it’s not going to go well. I will teach developers and security teams to prepare for, manage, and hopefully prevent, application security incidents. Starting with preparation; do you have a proper application inventory? How do you manage your technology stack? Disaster Recover? Backup strategy? Do you have a WAF? Monitoring? Tools that are at the ready when the s* hits the fan? During an incident; who’s managing the incident? Do you know? What is triage? Who does the investigation? Do you have a “safe” place to do potentially destructive testing? This talk outlines an immediate plan for the audience to get started, with a list of open source tools the security team and/or developers will use to ensure that they are ready, for the worst.

• Re-imagining Security Tools with OWASP ZAP - Simon Bennetts

ZAP is a flagship OWASP project and the most popular free, open source web security tool in the world. It is used by everybody from newcomers to security to experienced security professionals.

The ZAP desktop is extremely powerful, but it is very complicated and can be confusing, particularly for newcomers regardless of their security experience.

In this talk Simon, the ZAP project lead, will demonstrate a completely new and innovative interface for ZAP that the team has been working on.

Meeting time: 4:00 PM to 8:00 PM ET

Address: Valencia College -West Campus 1800 South Kirkman Road Orlando, FL 32811 How to find us: Building 11 Room 106 - park in Lot G or F

Presentation Decks

Patching Android Binaries

• Adrian Pastor Q4 2018

OpenSAMM & Maturity Programs

• Adrian Pastor Q2 2017

Do AppSec Shortcuts Exist? - Greg Wolford Q2 2016

XXE: The Anatomy of an XML Attack

• Mike Felch Q2 2016

iOS Automation Primitives

• Mikhail “Mike” Sosonkin Q2 2016

OWASP Top 10 with Code Examples

• Slides by Bill Riggins, Co-Presented with Tony Turner Orlando Q1 2013

Web Application Firewalls and Identity and Access Management Integration

• Jan Poscobutt Orlando Q3 2012

Don’t Drop the Soap: Real World Web Service Testing for Web Hackers

• Kevin Johnson Orlando Q3 2012

Application Firewalling in the Age of Mobile: New Considerations

• Stephen Mak Orlando Q2 2012

[https://www.owasp.org/images/6/60/2012Whereweare..Wherearewegoing.pptx OWASP Where are we… Where are we going in 2012] - Tom Brennan Orlando Q1 2012

Access Control Pitfalls

• Jim Manico Orlando Q1 2012 (Optional 2nd talk not delivered at chapter meeting)

XSS Past Present and Future v2

• Jim Manico Orlando Q1 2012

Meeting History

Tuesday 11/13/2018 Presentation Meeting

Topic:

• Third Party Software Vulnerability Assessments - David Dillard
• Lightning Intro to ASVS - Adrian Pastor and Tony Turner

Meeting time: 6:00 PM to 8:30 PM ET

Address: Valencia College -West Campus 1800 South Kirkman Road Orlando, FL 32811 How to find us: Building 11 Room 106 - park in Lot G or F

Thursday 10/25/2018 Presentation Meeting

Topics:

• OWASP Risk Rating Methodology - Tony Turner
• Patching Android Binaries - Adrian Pastor

Meeting time: 6:00 PM to 8:00 PM ET

Address: Valencia College -West Campus 1800 South Kirkman Road Orlando, FL 32811 How to find us: Building 11 Room 106 - park in Lot G or F

Thursday 03/23/2017 Presentation & Workshop Meeting

OpenSAMM & Maturity Programs – What’s It All About?

During this OWASP Orlando chapter meeting, we’ll get started with a turbo talk by Adrian Pastor on OpenSAMM and maturity programs. We’ll then follow up with a workshop to further explore some of the topics covered by Adrian.

Parking is free in the dirt lot on the North side of Pine St.

Thursday 09/29/2016 Social Meeting

On 09/29, we’re having a social meeting to network, meet fellow OWASPers, and reach out to the central Florida developer community. In addition to free food and beverages, we’ll give away some OWASP swag.

The location for our social meeting will be Downtown PourHouse, at 20 S Orange Ave, Orlando. We’ll meet from 5:30 PM to 8 PM approximately, or as late as people want to stay.

We look forward to seeing you.

Thursday 08/25/2016 Presentation Meeting

The meeting is free to attend and will take place from 5 to 7 PM. Free food and drinks will be provided! Meeting facilities will be kindly provided by HD Supply. Parking is free in the dirt lot on the North side of Pine St.

Advanced IDS Evasions Using Scapy - Sanders Diaz

IDS Evasion has been a problem for Intrusion Detection since the technology’s infancy. Even though new technologies like such as Intrusion Prevention Systems, Unified Threat management, and Next Generation firewalls have replaced the traditional IDS, while doing so they inherited its weaknesses to evasion. In 2010, StoneSoft conducted a BlackHat talk on the restated the relevance of Evasion techniques by introducing the Stacked IDS Evasion Technique. This technique combines prior known IDS evasion techniques and combines them simultaneously to successfully evade many class leading products like the Palo Alto, Fortigate, Cisco ASA, and others. Since then, the leading vendors have implemented fixes to stacked evasions in later generations of their platforms, but academic studies have proven stacked evasions still work, even if they are less effective. Furthermore, it is still possible to find outmoded devices both outside and inside the perimeter of organizations large and small. This talk aims to demonstrate the relevance of these techniques, offer instruction for the application of these techniques via scapy, and provide recommendations for how to cope with the problem.

Location Details HD Supply1 501 W Church St Orlando, FL

Thursday 07/28/2016 Social Meeting

Note: this meeting was originally planned to be a presentation meeting but the speaker couldn’t attend for personal reasons.

The meeting is free to attend and will take place from 5 to 7 PM. Free food and drinks will be provided! Meeting facilities will be kindly provided by HD Supply. Parking is free in the dirt lot on the North side of Pine St.

Location Details HD Supply2 501 W Church St Orlando, FL

Thursday 06/23/2016 Presentation Meeting

The meeting is free to attend and will take place from 5 to 7 PM. Free food and drinks will be provided! Meeting facilities will be kindly provided by Darden Restaurants.

Do AppSec Shortcuts Exist? - Greg Wolford

As enterprises shift to continuous delivery and other DevOps innovations, the pressure is mounting to produce more secure software faster. Yet, according to SANS, less than 26% of organizations have mandated, ongoing secure coding education programs. Do shortcuts exist for improving the state of your application security program? Are some programing languages inherently more secure than others? What should design teams look for before starting their projects?

This session will provide tangible steps addressing these issues based on benchmark data from actual code-level analysis of trillions of lines of code from applications submitted to Veracode’s cloud-based platform. Attendees will hear tips organized by programing language that will aid in planning for new application development as well as prioritize assessment and remediation activities.

Location Details Darden Restaurants 1000 Darden Center Drive Orlando, FL 32837

Friday 05/13/2016 Presentation Meeting

The meeting is free to attend and will take place from 5 to 7 PM. Free food and drinks will be provided! Meeting facilities will be kindly provided by HD Supply. Parking is free in the dirt lot on the North side of Pine St.

XXE: The Anatomy of an XML Attack, by Mike Felch.

With XML being such a popular yet misunderstood file format, it’s gained a lot of momentum as an exciting target for attackers. By default, XML’s rich design creates a unique attack surface in applications which can pose problems when trying to mitigate. This talk will focus on one attack using external entities (XXE), which is plaguing mature applications from corporations like SAP, IBM, and Cisco to web applications within Yahoo, Google, and Facebook.

While XXE attacks are not extremely new, it seems to have gone unnoticed by most of the developers. Depending on the programming language and version, XML may enable the ability to use external entities by default which can create application specific attack primitives such as local file reads, denial of service, or unauthenticated remote code execution.

This presentation will briefly look at XML and how XXE is implemented, examine some real world attack payloads which leverage XXE to compromise web environments, and what developers can do to secure their applications. After the presentation, a vulnerable XXE application will be provided for attendees to exploit.

By the end of the meeting, attendees will have a much deeper appreciation for XML and the security risks that come with not understanding how programming languages implement the underlying technology.

Bio: Mike Felch is a senior pentester and security researcher with 18 years experience in offensive security strategies. He holds no degree and no certifications, just raw experience.

Location Details HD Supply3 501 W Church St Orlando, FL

Wednesday 04/13/2016 Presentation Meeting

The meeting is free to attend and will take place from 5 to 7 PM. Free food and drinks will be provided! Meeting facilities will be kindly provided by HD Supply. Parking is free in the dirt lot on the North side of Pine St.

iOS Automation Primitives by Mikhail “Mike” Sosonkin, SYNACK

From the user’s perspective Android and iOS are not too dissimilar. One is cheaper than the other and pretty much everyone makes their apps for both types of phones. However, from the security testing perspective things are very different. Android is open and has lots of standard mechanisms to assist with testing. On the other hand, iOS is closed and requires lots of non standard methods for black box testing. The caveat is, of course, unless you own and control the build of the application but, that is not completely black box. If you do then you can use any number of tools: Appium, Apple UI Automation, etc.

This talk will cover reasons for why we constrain ourselves to this type of testing as well as various tools and techniques for instrumenting iOS apps to do UI automation. Specifically, we are constrained to no source code and no way to make a special build. The jailbreak community has developed many of these building blocks that if used in concert can provide for a powerful testing automation framework. This talk will also demonstrate a reference implementation of an extensible tool that brings all the primitives together to automate the testing of iOS applications.

Location Details HD Supply4 501 W Church St Orlando, FL

Thursday 02/18/2016 Social Meeting

On 02/18, we’re having a social meeting to network, meet fellow OWASPers, and reach out to the central Florida developer community. In addition to free food and beverages, we’ll give away OWASP swag and books as trivia prizes.

The location for our social meeting will be Downtown PourHouse, at 20 S Orange Ave, Orlando. We’ll meet from 5:30 PM to 8 PM approximately.

For more details or to join our Meetup community, check out http://www.meetup.com/OWASP-Orlando/events/228782867/

Monday 01/18/2016 Training Meeting

The meeting on 01/18 will consist of a secure programming workshop which will be kindly delivered by Jim Manico. The workshop will start at noon, and end at 5 PM approximately.

The location for our Jan 18 training meeting will be the following:

HD Supply5 501 W Church St Orlando, FL

Thursday 01/07/2016 Social Meeting

On 01/07, we’re having a social meeting to network, meet fellow OWASPers, and reach out to the central Florida developer community. In addition to free food and beverages, we’ll give away OWASP swag and books as trivia prizes.

The location for our social meeting will be Downtown PourHouse, at 20 S Orange Ave, Orlando. We’ll meet from 5:30 PM to 8 PM approximately.

2015 Meeting November 19

If you are in Orlando on Thursday November 19th, please join us at the next OWASP Orlando chapter meeting. Free food and drinks will be provided! We’ll be conducting a roundtable style discussion of topics of interest such as:

• Static vs Dynamic Testing (perhaps IAST too)
• Web App Firewalls vs Runtime Application Security Protection vs fixing vulnerable code
• Other topics - if you have one you’d like to see covered email the leaders

The meeting is free to attend and will take place from 5 PM to 7.30 PM. The location will be kindly provided by HD Supply. Parking is free in the dirt lot on the north side of Pine St.

Location Details HD Supply6 501 W Church St Orlando, FL

2015 Meeting October 29

If you are in Orlando on Thursday October 29th, please join us at the next OWASP Orlando chapter meeting. Free food and drinks will be provided! We’ll have two amazing presentations on reverse-engineering Android applications and attacking cryptographic libraries.

The meeting is free to attend and will take place from 5 PM to 7.30 PM. The location will be kindly provided by HD Supply. Parking is free in the dirt lot on the north side of Pine St.

Location Details HD Supply7 501 W Church St Orlando, FL Guest Speakers

Reverse Engineering Android Applications for Pride and Glory - Ben Watson

This presentation will serve as an introduction for those who want to dive into the art of reverse engineering Android applications and firmware. We will explore the inner workings of the Android architecture, traverse the landscape of reverse engineering tools and techniques, and propose some practical methodologies and workflows for all your bug hunting needs.

Ben Watson has over 7 dedicated years in application and mobile security. Prior to joining GuidePoint Security, Ben has been solving mobile & application security problems for cutting edge companies in the financial services, eCommerce, and medical industries. Often Ben has been sought after for building application security programs from the ground up. This is due to his experience in not only developing testing methodologies, tools, and techniques, but his understanding and perspective around what it requires to build secure products. Ben has managed and lead efforts in large mobile application security service initiatives, and is also an experienced mobile security researcher. He currently focuses his efforts around discovering new exploitable vulnerability patterns in Android and iOS. He also has multiple published zero day vulnerabilities effecting various Android web browsers, and is the creator and curator of the Android assessment toolkit called Lobotomy.

Do Your Own Highly Successful Five-minute Cryptography Evaluations - Scott Arciszewski

From web frameworks to encrypted chat applications to contactless smartcards, our industry is filled with people who deploy home-grown cryptography. The result of this choice is usually catastrophic. Even if you’re using good primitives from well-studied libraries, how you utilize them can completely defeat the security they provide. Clearly, rolling your own cryptography is a bad idea; but how do you assess the libraries that others have written? The following implementations will be scrutinized:

• OpenCart’s Encryption library (ECB mode, no MAC)
• Tutanota’s messaging app (CBC mode without a MAC)
• Mifare Classic’s Proprietary Stream Cipher (aside from the 48-bit key, this cipher is incredibly unsound)
• Defuse Security’s PHP Encryption Library (safe, for reasons I will explain)
• Libsodium - crypto_box() (safe, for reasons I will explain)

Before winning the password hashing category of the Underhanded Crypto Contest at the Crypto & Privacy Village at DEFCON this year, Scott has spent years studying how to make real-world cryptosystems fail in useful ways for attackers, from timing side-channels to padding oracles and random number generator failures. Scott leads the software development efforts for, and audits client’s cryptography products on behalf of, the Orlando-based technology consulting firm, Paragon Initiative Enterprises.

Q4 2014 Meeting November 12

We will be holding our Q4 meeting on Wednesday, November 12th at The University of Central Florida, main campus. There is NO cost to attend. Refreshments and snacks are provided by HeroiSec. Location Provided by University of Central Florida.

Guest Speakers

Blog like a hacker - Vikram Dhillon People just entering information security have a tough path ahead to become established and well-known. One major tool that almost all well known security analysts have is a blog where they all reach out to their audience. Getting a blog on a popular CMS platform is easy and of course great and all but you can’t show your own skills off. Enter Jekyll. A blog written from scratch up where you can show off your own development skills. Most developers are using their own styling along with various plugins combined in this Ruby-based tool to show off how they can blog like a hacker. This session will be a walkthrough of how to blog using jekyll. I will showcase what the finished project looks like, how to get started with one, the structure of the app and finally how to extend the blog you’ve created with your own imagination.

Technological Telekinesis: Become One with the Force (aka Art, Gadgets and Tech) - Nathan Selikoff Witness how objects and digital worlds can be manipulated without any direct contact. You never see a Jedi with a keyboard or a touchscreen, do you? Why be tethered when you can freely express yourself? With a low-cost input device, a laptop, and a bit of programming know-how, you can capture a flick of the wrist or an all out dance routine. What you do from there is only limited by your imagination. Kinect yourself and Leap into the future! Nathan Selikoff is an artist and programmer who plays with interactivity and motion in time and space. Inspired by the behavior of systems, science, nature, and music, he combines computer code, traditional materials, and future technology to bring new ideas to life.

Schedule

6:00PM - 6:15 Arrive at UCF

6:15 - 7:00 Blog like a hacker - Vikram Dhillon

7:00 - 7:10 Short break for refreshments and questions

7:10 - 7:55 Technological Telekinesis - Nathan Selikoff

7:55 - 8:00 Questions and closing remarks

8:00 - ? World of Beer social gathering (21+)

Location Details UCF Teaching Academy8 Room 117 4221 Andromeda Loop N Orlando, FL 32816

Parking Details Garage A University Blvd.


Q2 2014 May 12 Secure Coding Training

We will be holding a midday 4 hour training on secure application development led by Jim Manico. This workshop is an abridged version of the following course:

The class is a combination of lecture, security testing demonstration and code review. Students will learn the most common threats against applications. More importantly, students will learn how to code secure web solutions via defense-based code samples.

As part of this course, we will explore the use of third-party security libraries and frameworks to speed and standardize secure development. We will highlight production quality API’s from various languages and frameworks that provide production quality and scalable security controls.

This course will include secure coding information for Java, PHP and .NET programmers, but any software developer building web applications, webservices or mobile applications will benefit.

Jim Manico is a member of the OWASP Board and currently manages many OWASP projects including the cheatsheet series. He also runs Manicode Security where he specializes in application security training

Training location IST Partnership 2 2nd Floor Room 208 3100 Technology Parkway Orlando, FL 32826

The parking lot will (most likely) be full

You can also park across the street at: College of Nursing Address: 12201 Research Parkway, Orlando, FL 32826

Q4 2013 October 30 Meeting

OWASP Orlando is holding a social event for Q3/4 with complimentary wings and beer at Buffalo Wild Wings. We’d like to welcome you out to talk about web app security, upcoming events, Central FL infosec and other topics of note. There is no formal agenda, just show up, eat food, drink beer and hang out! We do have a limited budget for this event and expect we should have enough for the first couple hours, but if turn out is much greater than anticipated, or folks want to stay later we may have to switch to a non-free model at some point in the evening. Please register for this event so we can get an accurate account for who will be coming and an idea of cost.

Topics of interest:

• AppSecUSA conference in NYC (Nov 17-21)

• B-Sides Orlando conference (April 5-6)

• Chapter Outreach Opportunities (We recently presented for ISACA)

• Other CFL Inosec groups (Some new groups, some old. We want to work with you!)

• Cool projects you are working on

• Beer

There is NO cost to attend, but if you are interested in donating or joining the chapter please contact me at [email protected]

We do not currently have sponsorship for this event, if you are interested please do not hesitate to contact us.

http://goo.gl/N5TRrw

Q2 2013 Meeting June 26

Our Q2 meeting for 2013 will be a bit of a change in pace. Due to chapter demand for more hands on content, we are holding a Web App Hacking Workshop. You will need to bring a laptop with VMware Workstation or Player (free) installed. We will provide the VM. As always we will have our AppSec Trivia Contest and we have some OWASP hardcopy books for Testing Guide, Code Review Guide and Top 10 to give away as prizes.

6:15 - 6:30 Arrive at Cloudspace (see below)

6:30 - 6:45 Welcome and Opening Remarks

6:45 - 8:00 “Web App Hacking Workshop with Mutillidae” Facilitated by Tony Turner

8:00 - ? After event social gathering - Location TBD

We do not currently have a sponsor for this event but refreshments will be provided. If you are interested in sponsoring please contact [email protected]

Cloudspace (near UCF Main campus) 11551 University Blvd Suite 2 Orlando, FL 32817

http://goo.gl/45l1b

Q1 2013 Meeting February 13

We are kicking off Q1 of 2013 by going back to the basics. Chapter leadership will be delivering coverage of the OWASP Top 10, with examples and ways you can help reduce your exposure. As always we will have our AppSec Trivia Contest and we have some OWASP hardcopy books for Testing Guide, Code Review Guide and Top 10 to give away as prizes.

We have also changed our venue to Cloudspace who have graciously allowed us to use their space. UCF Medical College, while a great facility was a bit far for some folks to drive so we hope this will work out better for everyone.

6:15 - 6:30 Arrive at Cloudspace (see below)

6:30 - 6:45 Welcome and Opening Remarks

6:45 - 8:00 “OWASP Top 10” - Tony Turner and William Riggins

8:00 - ? After event social gathering - Location TBD

We do not currently have a sponsor for this event but refreshments will be provided. If you are interested in sponsoring please contact [email protected]

Cloudspace (near UCF Main campus) 11551 University Blvd Suite 2 Orlando, FL 32817 http://goo.gl/45l1b

Q3 2012 Meeting September 12

5:45 - 6:00 Arrive

6:00 - 6:15 Welcome and Opening Remarks / Appsec Trivia

6:15 - 7:00 “An Insider’s Look: WAF and Identity and Access Management Integration” - Jan Poczobutt, Director of Enterprise ADC & WAF Sales at Barracuda Networks, will provide an inside look at some of the problems with traditional access management implementations and how enterprises can sucessfully overcome these challenges by integrating web application firewall technologies with Identity and Access Management. Learn about best practices, specific use cases and how this new integration translates into operational simplicity for the enterprise.

7:00 - 7:15 Break

7:15 - 8:00 “Don’t Drop the SOAP: Real World Web Service Testing for Web Hackers” - Over the years web services have become an integral part of web and mobile applications. From critical business applications like SAP to mobile applications used by millions, web services are becoming more of an attack vector than ever before. Unfortunately, penetration testers haven’t kept up with the popularity of web services, recent advancements in web service technology, testing methodologies and tools. In fact, most of the methodologies and tools currently available either don’t work properly, are poorly designed or don’t fully test for real world web service vulnerabilities. In addition, environments for testing web service tools and attack techniques have been limited to home grown solutions or worse yet, production environments.

In this presentation Kevin Johnson will discuss the new security issues with web services and discuss an updated web service testing methodology released at defcon 19 last year that will be integrated into the OWASP testing guide, new Metasploit modules and exploits for attacking web services and an open source vulnerable web service for the Samurai-WTF (Web Testing Framework) that can be used by penetration testers to test web service attack tools and techniques.

• Kevin Johnson is a security consultant and founder of Secure Ideas. Kevin came to security from a development and system administration background. He has many years of experience performing security services for fortune 100 companies, and in his spare time he contributes to a large number of open source security projects. Kevin’s involvement in open-source projects is spread across a number of projects and efforts. He is the founder of many different projects and has worked on others. He founded BASE, which is a Web front-end for Snort analysis. He also founded and continues to lead the SamuraiWTF live DVD. This is a live environment focused on Web penetration testing. He also founded Yokoso and Laudanum, which are focused on exploit delivery. Kevin is a certified instructor for SANS and the author of Security 542: Web Application Penetration Testing and Ethical Hacking. He also presents at industry events, including DEFCON and ShmooCon, and for various organizations, like Infragard, ISACA, ISSA, and the University of Florida.

Twitter: @secureideas

We do not currently have a sponsor for this event but refreshments will be provided. If you are interested in sponsoring please contact [email protected]

University of Central Florida has graciously agreed to provide meeting space at the Medical College campus.

Q2 2012 Meeting May 15

The theme for Q2 is Mobile Security

5:45 - 6:00 Arrive

6:00 - 6:15 Welcome and Opening Remarks / Appsec Trivia

6:15 - 7:00 “Practical Android Security” - Jack Mannino

- Building secure Android applications can be achieved with a mix of common sense, leveraging platform security features, and following secure development best practices. This presentation will focus on security “quick wins” during development and will cover techniques that can reduce the overall attack surface within Android applications.

7:00 - 7:15 Break

7:15 - 8:00 “Application Firewalling in the Age of Mobile: New Considerations” - Stephen Mak

- With mobile application development on a rapid rise, it is important to understand the security risks associated with externally published APIs. This talk will discuss the similarities and differences of risks posed by browser-based web applications and mobile applications.

• Jack Mannino is the CEO of nVisium Security, an application security firm located within the Washington DC area. At nVisium, he helps to ensure that large corporations, government agencies, and software startups have the tools they need to build and maintain successful application security initiatives. He is an active Android security researcher, and has a keen interest in identifying security issues and trends on a large scale. Jack is the leader and founder of the OWASP Mobile Security Project. He also serves as a board member on the OWASP Northern Virginia chapter. Jack is also the lead developer for the OWASP GoatDroid Project, which is a collection of vulnerable Android applications used for training and education.
• Stephen Mak is the Product Manager for the Layer 7 SecureSpan Gateway, and has over 10 years product management experience in the enterprise application software industry.

Refreshments will be provided at the event and have been donated by Fishnet Security.

University of Central Florida has graciously agreed to provide meeting space at the Medical College campus.

Q1 2012 Meeting February 22

5:45 - 6:00 Arrive

6:00 - 6:15 Welcome and Opening Remarks / Appsec Trivia

6:15 - 7:00 “OWASP Where are we… Where are we going in 2012” - Tom Brennan

7:00 - 7:15 Break

7:15 - 8:00 “XSS Defense” - Jim Manico

- This talk will discuss the past methods used for cross-site scripting (XSS) defense that were only partially effective. Learning from these lessons, we will also discuss present day defensive methodologies that are effective, but place an undue burden on the developer. We will then finish with a discussion of future XSS defense mythologies that shift the burden of XSS defense from the developer to various frameworks. These include auto-escaping template technologies, browser-based defenses such as Content Security Policy, and Javascript sandboxes such as the Google CAJA project and JSReg.

8:00 - ? After event social gathering - Cariera’s

• Tom Brennan is a Director at Spiderlabs/Trustwave, an OWASP Global Board Member and Chapter Leader for OWASP NY/NJ Metro.
• Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. Jim is a participant and project manager of the OWASP Developer Cheatsheet series. He is also the producer and host of the OWASP Podcast Series.

Refreshments donated by Security Innovation.

University of Central Florida provided meeting space at the Medical College campus.

Inaugural Meeting October 19, 2011 6:30 PM at Seasons 52

We will be holding our first meeting on October 19 for an informal gathering of those interested in the OWASP mission. This is a chance to get to know the other members of the chapter and engage in the initial dialogue that will drive the direction of the group. We want to know what kinds of technologies you use or are interested in learning about, the challenges you are facing in your daily work and get a sense for the types of content you want to see at future meetings. I will bring some copies of various OWASP guides and possibly some other OWASP shwag to this initial meeting. We will be covering the OWASP mission, culture, and a high level view of OWASP projects. The format for this meeting will largely be discussion oriented. This is not currently a sponsored event, but we do have interested parties asking about sponsorship opportunities so this may change.