Owasp Netherlands Chapter Meeting, 22 September 2016

OWASP Foundation is a professional association of global members and is open to anyone interested in learning more about application security. Local chapters are run independently and governed by the Chapter Leader Handbook. As a 501(c)(3) non-profit professional association.

OWASP Netherlands Chapter

<P>OWASP Netherlands Chapter Meeting September 22nd, 2016</P>
<H2><SPAN CLASS="mw-headline">Programme</SPAN></H2>
<DL><DT>18:30 - 19:00 Registration &amp; Pizzas</DT><DT>19:00 - 19:15 OWASP Netherland and Foundation Updates</DT><DT>19:15 - 20:00 Handling of Security Requirements in Software Development Lifecycle</DT><DD>Daniel Kefer, René Reuter</DD><DT>20:00 - 20:15 break</DT><DT>20-15 - 21:00 Hacking the OWASP Juice Shop</DT><DD>Björn Kimminich</DD><DT>21:00 - 21:30 Networking</DT></DL>
<H2><SPAN CLASS="mw-headline">Presentations</SPAN></H2>
<H3><SPAN CLASS="mw-headline">Handling of Security Requirements in Software Development Lifecycle</SPAN></H3>
<P>The bigger the company you're working in, the more technologies and methodologies used by development teams you are going to face. At the same time, you want to address security risks in an appropriate, reliable and measurable way for all of them.</P>
<P>After a short introduction of a unified process for handling security requirements in a large company, the main part of the talk is going to focus on a tool called SecurityRAT (Requirement Automation Tool) which has been developed in order to support and accelerate this process. The goal of the tool is first to provide a list of relevant security requirements according to properties of the developed software, and afterwards to handle these in a mostly automated way - integration with an issue tracker being used as a core feature.</P>
<P>The tool was open sourced in May 2016 (available at <A CLASS="external free" HREF="https://github.com/SecurityRAT" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer">https://github.com/SecurityRAT</A>) and is continuously being further developed since then. The newest implemented features, work in progress and future plans will form the last part of the talk.</P>
<H3><SPAN CLASS="mw-headline">Hacking the OWASP Juice Shop</SPAN></H3>
<P>OWASP Juice Shop* is an intentionally insecure web app suitable for pentesting and security awareness trainings written in Node.js, Express and AngularJS. It is the first application written entirely in JavaScript listed in the OWASP VWA Directory. It also seems to be the first broken web app that uses the currently popular architecture of an SPA/RIA frontend with a RESTful backend.</P>
<P>In this talk I will show why and how the app was created followed by a demo how to hack it. Prepare for some nasty XSS, SQLI and CSRF flaws bundled with some seriously broken access control and business logic - all in one single application!</P>
<P>(*Translating "dump" or "useless outfit" into German yields "Saftladen" which can be reverse-translated word by word into "juice shop". Hence the project name. That the initials "JS" match with those of "JavaScript" was purely coincidental!)</P>
<H2><SPAN CLASS="mw-headline">Speakers</SPAN></H2>
<H3><SPAN CLASS="mw-headline">Daniel Kefer</SPAN></H3>
<P>1&amp;1 Mail &amp; Media Development &amp; Techhnology GmbH, Head of Application Security</P>
<P>Daniel Kefer has been working in the application security field since 2007. Having started as a penetration tester, he soon became passionate about proactive security efforts and working closely with developers. Since 2011 he has been working for 1&amp;1 where he focuses on design and continuous improvement of the internal secure SDLC process and its implementation in different development departments. Apart from 1&amp;1, he also works as a volunteer for the OWASP OpenSAMM project.</P>
<H3><SPAN CLASS="mw-headline">René Reuter</SPAN></H3>
<P>Robert Bosch GmbH, IT Security Consultant</P>
<P>René Reuter is a security engineer with over 4 years of experience in the application security field. At Robert Bosch GmbH, he works as an IT Security Consultant responsible for identifying vulnerabilities and design flaws that may impact Robert Boschs' applications and infrastructure. René holds a Master's Degree in Computer Science from the University of Applied Sciences Karlsruhe.</P>
<H3><SPAN CLASS="mw-headline">Björn Kimminich</SPAN></H3>
<P>Björn Kimminich is working in the area of software development for Kuehne + Nagel for over 8 years where he is now responsible for Global IT Architecture. His most sophisticated Open Source work is the intentionally insecure web application Juice Shop, which just recently was accepted as an OWASP Tool Project. As a side job he lectures software development at the UAS Nordakademie where he teaches Java to engineering students as their first programming language.</P>
<H2>Location</H2>
<P>Beta-faculty Huygensgebouw<BR> Heyendaalseweg 135, 6525 AJ Nijmegen<BR> Parkeergarage P11</P>
<H2>Sponsors</H2>
<P>The OWASP Netherlands Chapter is sponsored by:</P>
<P><A CLASS="external text" HREF="https://informatiebeveiliging.nl/" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer"><IMG ALT="Logo_Informatiebeveiliging-200.png" SRC="https://www.owasp.org/images/9/9a/Logo_Informatiebeveiliging-200.png"></IMG></A> <A CLASS="external text" HREF="http://www.securify.nl" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer"><IMG ALT="Ecurify-2016.png" SRC="https://www.owasp.org/images/9/92/Ecurify-2016.png"></IMG></A> <A CLASS="external text" HREF="https://www.nixu.com/en/nixubenelux" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer"><IMG ALT="Nixu-logo.png" SRC="https://www.owasp.org/images/5/50/Nixu-logo.png"></IMG></A> <A CLASS="external text" HREF="https://xebia.com/agile-security-risk-management" TARGET="_blank" DATA-MSYS-CLICKTRACK="0" REL="nofollow noopener noreferrer"><IMG ALT="Logo_xebia.jpg" SRC="https://www.owasp.org/images/f/f9/Logo_xebia.jpg"></IMG></A></P>

Radboud Universiteit Nijmegen

Onze {communityGuidelinesLink} beschrijven wat voor content verboden is op Eventbrite. Als je denkt dat een evenement deze schendt, meld dit dan aan ons, zodat wij het kunnen onderzoeken.

Om andere categorieën van verboden of illegale content te rapporteren, verzend je {link}

Owasp Netherlands Chapter Meeting, 22 September 2016

Meer evenementen van OWASP Netherlands Chapter

Ontdek meer evenementen van OWASP Netherlands Chapter, van Wetenschap en tech tot andere ervaringen die je misschien leuk vindt.

Nog op zoek naar het juiste evenement?

Ontdek alle evenementen in Nijmegen en filter op datum, categorie en meer om de perfecte match te vinden.

Owasp Netherlands Chapter Meeting, 22 September 2016

Meer evenementen van OWASP Netherlands Chapter

Ontdek meer evenementen van OWASP Netherlands Chapter, van Wetenschap en tech tot andere ervaringen die je misschien leuk vindt.

Meer Wetenschap en tech evenementen

Blader door meer Wetenschap en tech-evenementen met verschillende datums, prijzen en formats om je volgende geweldige ervaring te vinden.

Nog op zoek naar het juiste evenement?

Ontdek alle evenementen in Nijmegen en filter op datum, categorie en meer om de perfecte match te vinden.