OWASP AppSec DC 2009 - Part 1

Following an encouraging discussion of the Building Security In initiative of the US Department of Homeland Security by Joe Jarzombek, Director for Software Assurance in the National Cyber Security Division, and a short presentation from the Open Web Application Security Project (OWASP) board, OWASP AppSec DC 2009 got underway.

The conference had four streams on the first day:

• OWASP
• Tools
• Web 2.0
• SDLC

This made choosing which presentations to attend difficult, but I settled on:

• Understanding the Implications of Cloud Computing on Application Security, Dennis Hurst.
  Briefing on the upcoming second version of the guidance document from the Cloud Security Alliance.
• Transparent Proxy Abuse, Robert Auger
  The lifecycle, explanation and demonstration of an unexpected weakness in transparent proxies.
• OWASP ModSecurity Core Rule Set Project, Ryan Barnett
  Briefing on ModSecurity web application firewall (WAF) and the changes in the recently issued v2 rule set which is now an OWASP Project.
• Defend Yourself: Integrating Real Time Defenses into Online Applications, Michael Coates
  An update on the OWASP AppSensor Project and two example implementations demonstrating how the AppSensor responds to an automated scanner, and how it could suppress application worm propagation.
• The ESAPI Web Application Firewall, Arshan Dabirsiaghi
  Demonstration of code built upon the OWASP ESAPI Project to apply virtual patches to an application built in Java.
• Attacking WCF Web Services, Brian Holyfield
  Description of .NET core communications framework and how messages can be intercepted, decoded and modified.
• When Web 2.0 Attacks – Understanding Security Implications of Highly Interactive Technologies, Rafal Los
  Issues and examples of how Web 2.0 is reinventing old faults.

The presentations will be available on the conference web site.

The day ended with a generously sponsored reception for delegates to network further and practice penetration testing.

Update 14th November 2009: Part 2 added.