markdown:
# AppSecEU2011
[Fabio.e.cerullo](/index.php/User:Fabio.e.cerullo)( [Talk](/index.php?title=User_talk:Fabio.e.cerullo&action=edit&redlink=1)| [contribs](/index.php/Special:Contributions/Fabio.e.cerullo))
|
|![]()
#### Welcome
|
|
|
|
#### Registration
**Registration is now open!** **Registration is now open!**
### Registration Fees
|Ticket Type||Before 6th April||After 6th April||After 6th May|
|Non-Member||€250||€300||€350|
|Active OWASP Member||€200||€250||€300|
|Student||€150||€200||€250|
|Course||Fee|
|1 Day Training||€495|
|2 Day Training||€990|
Note: To save on processing expenses, all fees paid for the OWASP conference are non-refundable. OWASP can accommodate transfers of registrations from one person to another, if such an adjustment becomes necessary.
* We need some kind of proof of your full-time student status. Either ask your local OWASP chapter leader to vouch for you by email to Kate.Hartmann@owasp.org, or email Kate a scanned image of your student ID (please compress the file size :).
#### June 7th-8th (Training)
## Schedule
|T1. Threat Modeling and Architecture Review - 2-Days (June 7-8) - 990 Euro|
|Threat Modeling and Architecture Review are the cornerstones of a preventative approach to Application Security. By combining these topics into single comprehensive course attendees can get a complete understanding of how to understand the threat an application faces and how the application will handle those potential threats. This enables the risk to be accurately assessed and appropriate changes or mitigating controls recommended.|
|Instructor: Pravir Chandra, Fortify|
| |[Click here to register](http://www.regonline.com/owasp_appsec_eu_2011)
|T2. Assessing and Exploiting Web Applications with Samurai - WTF - 2-Days (June 7-8) - 990 Euros|
|
|
Come take the official Samurai-WTF training course given by one of the founders and lead developers of the project! You will learn how to use the latest Samurai-WTF open source tools and the be shown the latest techniques to perform web application assessments. After a quick overview of pen testing methodology, the instructor will lead you through the penetration and exploitation of three different web applications, and the browsers connecting to them. Different sets of open source tools will be used on each web application, allow you to learn first hand the pros and cons of each tool. After you have gained experience with the Samurai-WTF tools, you will be challenged with a fourth web application that contains keys you must find and collect. This final challenge will give you time to practice your new skills at your own pace and experiment with your favorite new tools. This experience will help you gain the confidence necessary to perform web application assessments and expose you to the wealth of freely available open source tools.
| |[Click here to register](http://www.regonline.com/owasp_appsec_eu_2011)
This two-day boot-camp training is designed for people who want to quickly learn how to configure and deploy ModSecurity in the most effective manner possible. The course will cover topics such as the powerful ModSecurity rules language, extending functionality via the embedded Lua engine and managing suspicious events via AuditConsole. Documented hands-on labs help students understand the inner workings of ModSecurity and how to deploy ModSecurity securely. By leveraging the flexibility within ModSecurity, attendees will be able to write effective rules to mitigate complex web vulnerabilities
[Learn More about the Tactical Defense With Mod Security Class](/index.php/Learn_More_about_the_Tactical_Defense_With_Mod_Security_Class) [Click here to register](http://www.regonline.com/owasp_appsec_eu_2011)
Application security is not commonly a part of many computer science curricula today and most organizations have not focused on instituting a culture that includes application security as a core part of their software development training efforts. This intensive one-day course focuses on the most common web application security problems, including aspects of both the OWASP Top Ten (2010) and the MITRE Top 25. The course will introduce and demonstrate application assessment techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code
Instructor: Eoin Keary, OWASP
[Learn More About the Secure Application Development Class](/index.php/Learn_More_About_the_Secure_Application_Development_Class) [Click here to register](http://www.regonline.com/owasp_appsec_eu_2011)
|T5. Designing, Building and Testing Secure Application on Mobile Devices 1-Day - June 8th- 495 Euros|
| This course provides an introduction to security for mobile and smartphone applications. It walks through a basic threat model for a smartphone application. This threat model is then used as a framework for making good decisions about designing and building applications as well as for testing the security of existing applications. Examples are provided for both iOS (iPhone and iPad) and Android platforms and sample code is provided to demonstrate mobile security assessment techniques. Particular emphasis will be on the unique security challenges that developing software for mobile devices represent, comparing mobile software security concepts to those in the web application world
|
| |[Click here to register](http://www.regonline.com/owasp_appsec_eu_2011)
#### June 9th
## Schedule
| |Conference Day 1 - June 9, 2011
|
||Track 1 - Defend||Track 2 - Prevent||Track 3 - Attack|
|0800-08:50||Registration and Breakfast + Coffee|
|08:50-09:00||Welcome by AppSec EU Board|
|09:00-10:00|| Keynote: Brad Arkin, Adobe Corp | |[OWASP Global Board Update](https://www.owasp.org/images/8/8e/OWASP_Global_Board_Update_AppSecEU11_consolidated_-v3.pptx)- Tom Brennan, Eoin Keary, Seba Deleersnyder *Tom Keetch, Verizon Business*- [SLIDES](http://www.appseceu.org/wp-content/presentations/Tom%20Keetch%20-%20Practical%20Sandboxing%20with%20Chromium.pdf) *Narainder Chandwani, Foundstone*- [SLIDES](http://www.appseceu.org/wp-content/presentations/Narainder%20Chandwani%20-%20Building%20a%20Robust%20Application%20Security%20Plan.pdf) *Andreas Falkenberg, RUB*
*Charles Schmidt, MITRE Corp.*- [SLIDES](http://www.appseceu.org/wp-content/presentations/Charles%20Schmidt%20-%20The%20Missing%20Link.pdf)
*Joe Basirico, Security Innovation*- [SLIDES](http://www.appseceu.org/wp-content/presentations/Joe%20Basirico%20-%20Whats%20the%20Buzz%20About%20Fuzz.pdf) *Keith Turpin, The Boeing Company*- [SLIDES](http://www.appseceu.org/wp-content/presentations/Keith%20Turpin%20-%20Secure%20Coding%20Practices%20Quick%20Ref%20Guide.pdf) *Mark Crosbie, IBM*- [SLIDES](http://www.appseceu.org/wp-content/presentations/Mark%20Crosbie%20-%20Integrating%20Security%20Testing%20into%20a%20SDLC.pdf) *Javier Marcos de Prado & Juan Galiana Lara, IBM*- [SLIDES](http://www.appseceu.org/wp-content/presentations/JM%20del%20Prado%20%26%20JG%20Lara%20-%20Intranet%20Footprinting.pdf) *Marco Balduzzi & Davide Canali, EURECOM* *Chris Eng, Veracode* *Justin Searle, InGuardians Inc* *Colin Watson, Watson Hall Ltd* *Douglas Held, Fortify (HP)* *Mark Hillick, KTF*
#### June 10th
## Schedule
| |Conference Day 2 - June 10, 2011
|
||Track 1 - Defend||Track 2 - Prevent||Track 3 - Attack|
|08:00-08:50||Registration|
|08:50-09:00||Day 2 Opening Remarks|
|09:00-10:00||Keynote: Janne Uusilehto, Nokia.|
|10:00-10:10||Break|
|10:10-10:55|| Software Security: Is OK Good Enough?,
|John Dickson, Denim Group Ltd. | An Overview of Threat Modeling,
|Paco Hope, Cigital Inc. | An Introduction to the OWASP Zed Attack Proxy, "Simon Bennetts, OWASP" |
|10:55-11:10||Coffee Break|
|11:10-11:55|| New standards and upcoming technologies in browser security,
|Tobias Gondrom, IETF WG | Simple Approach to Sepcifying Security Requirements for Online Developments,
|Alexis Fitzgerald, RITS | A Case Study on Enterprise E-mail (in) Security Solutions, |Marian Ventuneac, Genworth Financial
|11:55-12:05||Break|
|12:05-12:50|| Six Key Application Security Program Metrics,
|Arian Evans, Whitehat Security | A Critical Look at the Classification Schemes for Privacy Risks,
|Elke Roth-Mandutz and Georg Simon, Ohm University | Testing Security Testing: Evaluating Quality of Security Testing, |Ofer Maor, Seeker Security
|12:50-13:50||Lunch|
|13:50-14:50||Keynote: Alex Lucas, Microsoft|
|14:50-15:00||Break|
|15:00-15:45|| Putting the Smart into Smartphones: Security Testing Mobile Applications,
|Dan Cornell, Denim Group | Wordpress Security,
|Steve Lord, Mandalorian Security Ltd. | The Dark Side: Measuring and Analyzing Malicious Activity On Twitter, |Daniel Peck, Barracuda Networks
|15:45-16:00||Coffee Break|
|16:00-16:45|| Threat modeling of banking malware-based attacks using the P.A.S.T.A. framework,
|Marco Morana, Cincinnati Chapter Lead & Tony UcedaVelez, VerSprite | PCI DSS v2.0: a new challenge for web application security testing?,
|Laurent Benameur Sauvaire, Espion, Ltd. | Practical Crypto Attacks Against Web Applications, |Justin Clarke, Gotham Digital Science
|16:45-16:55||Break|
|16:55-17:40||Keynote: Ivan Ristic, Qualys|
|17:40-18:00||Conference Closure and Raffle|
#### Accommodation
**The Morgan Hotel:**
Stay in one of the best luxury hotels in Dublin, The Morgan, Design hotel is located in Temple Bar. This 4 star Hotel Dublin offers an oasis of calm in a central location. The hotel’s cool modern interiors, chic design and boutique luxury hotel rooms are all part of an experience designed to pamper guests and breathe new life and style into hotel living.
This city centre Dublin hotel is just a few blocks away from Trinity College, Grafton Street, the main shopping thoroughfare, theatres, shopping, music and nightlife along with proximity to the IFSC, Dublin’s main business district. There is no other 4 star hotel Dublin quite like it!
Stay in the heart of the conference action at a hotel specially discounted for its attendees.
Rooms can be booked by emailing reservations@themorgan.com and quoting OWASP.
The contact in reservations is Bernadette Doyle and you could contact her for special requests at the following number: +353 1 643 7000
Special Rates: €130 Bed & Full Irish Breakfast – Single Occupancy €140 Bed & Full Irish Breakfast – Double Occupancy
Special rate deadline: 6 May 2011
The Morgan Hotel
10 Fleet st, Temple Bar, Dublin 2
Phone: +353 1 6437000 Fax: +353 1 6437060
[http://www.themorgan.ie](http://www.themorgan.ie)
**Trinity College:**
Accommodation is also available on the historic campus at Trinity College Dublin, located right in the centre of the city. The bedrooms, many of which have been recently renovated, are excellent value with prices ranging from Euro 55.00 to Euro 100.00 per night. Rooms are serviced daily and continental breakfast is included in room rates.
For more information visite:
[https://accommodation.tcd.ie/kxHotel/](https://accommodation.tcd.ie/kxHotel/)
#### KartCon EU
It was about time for Europe to host this adrenaline fueled event!
Kylemore Karting, Ireland’s largest indoor Karting arena, has a choice of three 360 mtr tracks with flyovers, underpasses, hills and banked corners waiting for you.
**Race for best time – Race for best crash – Race for fun**
This is your chance to sit down, strap in and race for the finish line to “Rev Up” for APPSEC EU 2011.
The doors open Wednesday 8th June at 7:30pm and there will be transportation available from Dublin city centre.
More info could be found here:
Kylemore Karting
Unit 1A,
Kylemore Industrial Estate,
Killeen Road,
Kylemore, Dublin 10
[http://www.kylemore-karting.com](http://www.kylemore-karting.com)
REGISTRATION IS OPEN. Please visit URL below to register:
[http://www.regonline.com/owasp_appsec_eu_2011](http://www.regonline.com/owasp_appsec_eu_2011)
#### Challenges
### Countdown Challenges -- Free Tickets to Win!
You could check all challenges here:
[http://www.appseceu.org/?page_id=197](http://www.appseceu.org/?page_id=197)
#### Team
**AppSec EU Conference Team**
**Chairs**
Eoin Keary
Fabio Cerullo
Fiona Walsh
**Operations**
Kate Hartmann
Lorna Alamri
Sarah Baso
Ana Loza
Ralph Durkee
**Volunteers**
Owen Pendlebury
Niall Jordan
Ronan O'Mullane
Federico Feraboli
#### Chapters Workshop
On June 9, 14h30-18h in Trinity College - Arts Building room 3126, we organize a chapter leader workshop for all the chapter leaders that attend the conference.
Items that will be discussed are:
- How to improve the current Chapter Leader Handbook?
- How to start and support new chapters within Europe?
- How to support inactive chapters within Europe?
- What Governance model is required for OWASP chapters?
- How can the global chapters committee facilitate the European chapters?
- ...
Agenda and room details are online at
[AppSecEU 2011 chapters workshop agenda](/index.php/AppSecEU_2011_chapters_workshop_agenda).
Contact
[Seba](mailto:seba@owasp.org) for more details.
#### Industry Outreach Sessions
**For more information about any of the sessions or to R.S.V.P. contact Sarah Baso**
**Security for Managers and Executives** **10:15-11:00 AM, Conference Day 2, 10 June 2011**
**Location: Arts Building room 3106**
The purpose for this session is to help organizations understand why application security is important and how OWASP can help in making their applications more secure. It will give them an opportunity to learn what documentation, training, architecture, tools and infrastructure is available. The best part is all these materials are free. OWSAP provides the solution for their application security needs. We are also looking to improve collaboration by helping get more organization participating in OWASP projects. This will help us ensure that we account for the various needs of industry and develop well vetted best practices.
[Security For Managers and Executives - Industry Outreach Presentation ](http://code.google.com/p/owasp-cbt-project/downloads/list)
**Presented by: Nishi Kumar, IT Architect Specialist, FIS**
[View Presenter's Bio](https://www.owasp.org/index.php/AppSecEU2011/Industry_Outreach#Security_for_Managers_and_Executives)
**CISO Survey** **12:05-12:50 PM, Conference Day 2, 10 June 2011**
**Location: Arts Building room 3106**
The objective of this session is to solicit feedback from industry leaders to help inform the content of the upcoming OWASP CISO survey. Specifically, we are interested in what they would like to see in a survey of their peers and leaders and how they think such a survey should be executed. The session will provide participants an opportunity to meet with peers in a vendor-free environment and discuss their problems with and solutions to information security. It will also allow them to shape the focus of the upcoming survey to maximize the return value to them.
**Presented by: Rex Booth, Senior Manager, Grant Thornton**
[View Presenter's Bio](https://www.owasp.org/index.php/AppSecEU2011/Industry_Outreach#CISO_Survey)
**Global Industry Roundtable** **15:00-15:45 PM, Conference Day 2, 10 June 2011**
**Location: Arts Building room 3106**
This roundtable session will involve a series of questions aimed at driving discussion to determine: How can the OWASP Global Industry Committee become more relevant and work to achieve a better working relationship with industry verticals? What would types of OWASP resources (if none are currently available) would your company find value in? If you are not currently an OWASP member or corporate supporter, why not?
The outcomes of this session, as well as similar sessions that we hope to host at the other OWASP global appsec conferences this year, will be used determine whether a new membership model (esp. for corporate supporters) is needed within OWASP as well as where committee resources should be focused in the upcoming year(s).
**Facilitated by: Sarah Baso, Operations Manager for the OWASP Global Industry Committee** **With remote participation from:** [Joe Bernik](mailto:joe.bernik@owasp.org), Chief Information Security Officer for Fifth Third Bank and OWASP GIC Committee Chair [View Presenters' Bios](https://www.owasp.org/index.php/AppSecEU2011/Industry_Outreach#Global_Industry_Roundtable)
#### Sponsorship Options
OWASP is providing sponsors exclusive access to its audience in Trinity College Dublin, Ireland through a limited number of Expo floor slots, providing a focused setting for potential customers.Attendees will be pushed through the Expo floor for breakfast, lunch and coffee breaks giving them direct access to sponsors’ booths and technology.
The conference is expected to draw over 400 international attendees; all with budgets dedicated to web application security initiatives. Financial Services, Media, Pharmaceuticals, Government, Healthcare, Technology, and many other verticals will be represented.
Sponsorship opportunities are filling up rapidly. All proceeds from sponsorship support the conference and the mission of the OWASP Foundation (501c3 Not-For-Profit), driving funding for research grants, tools and documents, local chapters, and more.
All sponsorship opportunities feature significant discounts to OWASP members, allowing you year-round access the web application security’s top thinkers as well as use of OWASP materials in product and service delivery.
To find out more about the different sponsorship opportunities please check the document below:
[http://www.appseceu.org/wp-content/uploads/2011/03/AppSecEU_Sponsorship_Packages.pdf](http://www.appseceu.org/wp-content/uploads/2011/03/AppSecEU_Sponsorship_Packages.pdf)
#### SoccerCon EU
We are organizing a Futbol (Soccer) friendly in Ireland for AppSec EU. For those that partook in the friendly in Portugal, the event was a big success despite the fact we played at 8am, inebriated, with a semi-deflated ball, on a slick concrete court - all of such conditions which allow me to continue my personal denial for the loss we experienced against the Portuguese/ Brazilian Chapter leads. All that aside, I would like to know if there are any members interest to relive this in much better fashion while in Dublin.
Date: 10th June at 7:00PM - Trinity College Sports Centre
Proud Soccer Field Sponsor:
Bring your shorts and show us your Messi skills. ;-)
If you plan to attend, please fill in your name below:
- Tony UcedaVelez
- Tom Brennan
- Fabio Cerullo
- Dan Cornell
- Frederick Donovan
- ...
Contact
[Tony](mailto:tonyuv@owasp.org) for more details.

X-Frame-Options: sameorigin

Content-language: en

Cache-Control: private, must-revalidate, max-age=0