OWASP Tampa

Next Meeting

Date:

• Wednesday, March 2, 2022

Time:

• 11:45am - 1:15pm “Why Automated DAST Scanners Suck Today.” by Ray Kelly

Description: Automated DAST scanners have been around for 20 years now, so why is it that we have so much trouble using them? From numerous false positives, complicated configurations to scans that take days raging through single website, why is this still happening? Many factors have changed in the past several years for businesses when it comes to the complexity of and number of assets that need to be scanned for security vulnerabilities. How can these businesses meet compliance and regulation requirements when AppSec tools can’t do the job? In this talk you will see the challenges of automated DAST scanners and why businesses are struggling to keep up with the ever expanding threat landscape when it comes to AppSec.

Biography

Ray Kelly is an internet security professional with over twenty five years of development experience, eighteen of which has focused on the internet security space. Ray has been a key player in multiple successfully acquired cyber security start-ups. He was the lead developer and business unit director for WebInspect with SPI Dynamics which is an industry leading application security scanner (later HP and Micro Focus). Ray holds three web application scanning patents and speaks regularly at security conferences. Today Ray is a Fellow at NTT AppSec where (formally WhiteHat) where he contributes to research, sales and vision of the security product line..

Registration Page: https://www.meetup.com/owasp-tampa/events/283218238/

Location:

• Virtual link via Zoom; When you register for the event, you will receive Zoom link.

AGENDA:

• Announcements
• Guest Speaker
• Ajourn

Presentation Archives

2019-Q1 - Application Security in an Ever Changing Digital Landscape - Trace Hollifield - Presentation Slides here

2016-Q4 - Mark Villinski, Kaspersky - Unlock the Key to Repel Ransomware, Major General Oleg D. Kalugin, Formerly with KGB and author of “Spymaster”, John Ford- Defend Trade Secrets Act of 2016, Steve Obeck, Tanium- Security Hygiene, Jeremy Rasmussen, Cybersecurity Director of Abacode - “Incident Response and Investigations: Tales from the Trenches”

2016-Q3 - Red Team Operating in a modern environment - Jonathan Echavarria - Presentation Slides here

2016-Q2 - OpenSAMM Software Assurance Maturity Model - Eoin Fitzpatrick

• Presentation Slides here

2016-Q1 - AppSec Pipeline: Application Security in a world of Agile Development, Continuous Change and DevOps - Doug Morato - Presentation Slides here

2015-Q4 - Care & Feeding of Programmers-Addressing App Sec Gaps with Headers - Sunny Wear - Presentation Slides here

2015-Q4 - Secure Session Management - Brian Beaudry - Presentation Slides here

OWASP Tampa Day 2014 - Shadow IT Does Not Have To Be Shady - Scott VanWart - Presentation Slides here

OWASP Tampa Day 2014 - Offensive Mobile Forensics - Joey Peloquin - Presentation Slides here

OWASP Tampa Day 2014 - OWASP Top 10 for MVC 4 and Greater - James Davis

• Presentation Slides here

OWASP Tampa Day 2014 - Application Centric Mobile Application Security Model - Daniel Bender - Presentation Slides here

OWASP Tampa Day 2014 - Intern down for what? - Tony Turner - Presentation Slides here

2014-Q3 - Do we really know the OWASP Top 10? - Jon Singer - Presentation Slides here

2014-Q1 - Herding Cats - Carl Brothers - Presentation Slides here

2014-Q1 - The Enemy Within - Ramece Cave - Presentation Slides here

OWASP Tampa Day 2013 - Securing Your Applications’ Data With Web Application Firewalls - Dennis K. Usle - Presentation Slides here

OWASP Tampa Day 2013 - Bring Your Own Service - Doug Maul - Presentation Slides here

OWASP Tampa Day 2013 - Design Consideration & Guiding Principles for Implementing Cloud Security - Bill Sterns - Presentation Slides here

OWASP Tampa Day 2013 - Let’s Get Right To The Endpoint - Mel Pless - Presentation Slides here

OWASP Tampa Day 2013 - Vulnerability Management That Works - Tony Turner

• Presentation Slides here

2012-Q3 - Taming the B.E.A.S.T. - Richard Newman - Presentation Slides [https://www.owasp.org/images/1/10/Taming_the_B.E.A.S.T..pdf here]

OWASP Tampa Day 2012 - Changing the Game - Jason Kent - Presentation Slides here

OWASP Tampa Day 2012 - MDM Technical Presentation - Keith Katz - Presentation Slides here

OWASP Tampa Day 2012 - Federated Identities in the Real World - Nathan Sargent - Presentation Slides here

OWASP Tampa Day 2012 - Define and Optimize Your Approach to Application Security - Bruce Jenkins - Presentation Slides here

OWASP Tampa Day 2012 - Anonymous: Lessons Learned - Bill Church - Presentation Slides here

2012-Q1 - Protecting Against SQLi in Real-Time - Stuart Hancock - Presentation Slides here

2011-Q4 - How Not to Build Android Apps - Jack Mannino - Presentation Slides here

2011-Q4 - Behind Enemy Lines: Practical & Triage Approaches to Mobile Security Abroad - Justin Morehouse - Presentation Slides here

2011-Q3 - Hiding in Plain Sight - Ramece Cave - Presentation Slides here

2011-Q3 - PCI Compliance 2.0 - Kate Mullin - Presentation Slides here

OWASP Tampa Day 2011 - PCI for Developers: Lessons from the Real World - Trevor Hawthorn - Presentation Slides here

OWASP Tampa Day 2011 - Top Website Vulnerabilities: Trends, Business Effects and How to Fight Them - Rinaldi Rampen - Presentation Slides here

OWASP Tampa Day 2011 - How to Defend the Universe from Evil-doers: A Guide for Software Developers and Security Teams - Bruce Jenkins - Presentation Slides here

OWASP Tampa Day 2011 - Analysis of Deadly Combination of XSS and CSRF - Sherif Koussa - Presentation Slides here

2011-Q1 - Real Lessons of Deploying Static Analysis in Development Groups - Jeff LoSapio - Presentation Slides here

2011-Q1 - Intelligence Gathering for Penetration Testers: Opening Doors with Metadata - Chris Patten - Presentation Slides here

2011-Q1 - Vulnerability Management in an IPv6 World - Richard Newman & Brett McKinney - Presentation Slides here

2010-Q4 - Nessus Bridge for Metasploit - Zate Berg - Presentation Slides here

2010-Q2 - Stealing Guests…The VMware Way - Justin Morehouse & Tony Flick - Presentation slides here

2010-Q1 - The New World of Smartphone Security - Trevor Hawthorn - Presentation slides here

2009-Q3 - Hacking the Smart Grid - Tony Flick - Presentation slides here

2009-Q2 - Open SAMM - Zate Berg - Presentation slides here

2009-Q1 - XSS Anonymous Browser - Matt Flick - Presentation slides here

2008-Q4 - Google Code Search : The pitfalls of Copy/Paste - Tony Flick - Presentation slides here