AppSec USA 2013

AppSec USA 2013 took place Nov. 18, 2013 through Nov. 21, 2013 (11 years ago) at New York Marriott Marquis in New York City, New York, USA.

Presentations

Monday, Nov. 18, 2013

09:00 - OWASP Media Project Introduction
09:00 - Project Summit: OWASP Projects Review Session
13:00 - Project Summit: AppSensor 2.0 Hackathon
13:00 - OWASP PHP Security and RBAC Projects: An introduction

Tuesday, Nov. 19, 2013

09:00 - 2 Day Pre-Conference Training: Running A Software Security Program On Open Source Tools Training
09:00 - 2 Day Pre-Conference Training: Web Application Defender's Cookbook: LIVE Training
09:00 - 2 Day Pre-Conference Training: Securing Mobile Devices & Applications Training
09:00 - Project Summit: Mobile Security Session
09:00 - 2 Day Pre-Conference Training: The Art of Exploiting Injection Flaws Training
09:00 - 2 Day Pre-Conference Training: Application Cryptanalysis with Bletchley Training
09:00 - Project Summit: Training Development Session
13:00 - Project Summit: Academies Development Session
15:00 - OWASP O2 Documentation Session
19:00 - Hands-on Ethical Hacking: Preventing and Writing Exploits for Buffer Overflows Training

Wednesday, Nov. 20, 2013

08:30 - Welcome to OWASP AppSecUSA - Updates
09:00 - Computer and Network Security: I Think We Can Win!
09:00 - Project Summit: Writing and Documentation Review Session
10:00 - PANEL: Aim-Ready-Fire
10:00 - How To Stand Up an AppSec Program - Lessons from the Trenches
10:00 - Project Talk: Project Leader Workshop
10:00 - The Perilous Future of Browser Security
10:00 - Hardening Windows 8 apps for the Windows Store
10:00 - Automation Domination
11:00 - Securing Cyber-Physical Application Software
11:00 - From the Trenches: Real-World Agile SDLC
11:00 - Computer Crime Laws - Tor Ekeland, Attorney
11:00 - Why is SCADA Security an Uphill Battle?
11:00 - Project Talk: OWASP Enterprise Security API Project
11:00 - OWASP PCI toolkit Session
11:00 - Can AppSec Training Really Make a Smarter Developer?
12:00 - Build but don't break: Lessons in Implementing HTTP Security Headers
12:00 - The Cavalry Is Us: Protecting the public good
12:00 - BASHing iOS Applications: dirty, s*xy, cmdline tools for mobile auditors
12:00 - All the network is a stage, and the APKs merely players: Scripting Android Applications
12:00 - Case Study: 10 Steps to Agile Development without Compromising Enterprise Security
12:00 - OWASP NIST NSTIC IDecosystem Initiative: Initial Discussion Meeting
13:00 - A Framework for Android Security through Automation in Virtual Environments
13:00 - PANEL: Privacy or Security: Can We Have Both?
13:00 - Mantra OS: Because The World is Cruel
13:00 - 2013 AppSec Guide and CISO Survey: Making OWASP Visible to CISOs
13:00 - Project Talk: OWASP OpenSAMM Project
13:00 - HTML5: Risky Business or Hidden Security Tool Chest?
14:00 - PANEL: Cybersecurity and Media: All the News That's Fit to Protect?
14:00 - "What Could Possibly Go Wrong?" - Thinking Differently About Security
14:00 - Revenge of the Geeks: Hacking Fantasy Sports Sites
14:00 - Project Talk: The OWASP Education Projects
14:00 - Javascript libraries (in)security: A showcase of reckless uses and unwitting misuses.
14:00 - What You Didn't Know About XML External Entities Attacks
15:00 - Advanced Mobile Application Code Review Techniques
15:00 - Project Talk: OWASP AppSensor Project
15:00 - Making the Future Secure with Java
15:00 - Pushing CSP to PROD: Case Study of a Real-World Content-Security Policy Implementation
15:00 - OWASP Zed Attack Proxy
15:00 - PANEL: Mobile Security 2.0: Beyond BYOD
16:00 - OWASP Top Ten Proactive Controls
16:00 - Healthcare Security Forum
16:00 - Tagging Your Code with a Useful Assurance Label
16:00 - Sandboxing JavaScript via Libraries and Wrappers
16:00 - Forensic Investigations of Web Explotations
16:00 - Big Data Intelligence (Harnessing Petabytes of WAF statistics to Analyze & Improve Web Protection in the Cloud)
17:30 - OWASP Jeopardy

Thursday, Nov. 21, 2013

09:00 - Contain Yourself: Building Secure Containers for Mobile Devices
09:00 - Defeating XSS and XSRF using JSF Based Frameworks
09:00 - AppSec at DevOps Speed and Portfolio Scale
09:00 - Mobile app analysis with Santoku Linux
09:00 - ') UNION SELECT `This_Talk` AS ('New Exploitation and Obfuscation Techniques’)%00
09:00 - Project Summit: ZAP Hackathon Session
10:00 - Leveraging OWASP in Open Source Projects - CAS AppSec Working Group
10:00 - iOS Application Defense - iMAS
10:00 - Accidental Abyss: Data Leakage on The Internet
10:00 - PiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong
10:30 - Project Summit: ESAPI Hackathon Session
11:00 - Project Talk and Training: OWASP O2 Platform
11:00 - Verify your software for security bugs
11:00 - OWASP Hackademic: a practical environment for teaching application security
11:00 - The State Of Website Security And The Truth About Accountability and “Best-Practices”
11:00 - An Introduction to the Newest Addition to the OWASP Top 10. Experts Break-Down the New Guideline and Offer Provide Guidance on Good Component Practice
12:00 - PANEL: Women in Information Security: Who Are We? Where Are We Going? (Salon 1 & 2)
12:00 - Application Security: Everything we know is wrong
12:00 - Project Talk: OWASP Testing Guide
12:00 - Insecure Expectations
12:00 - OWASP Periodic Table of Elements
13:00 - NIST - Missions and impacts to US industry, economy and citizens
13:00 - Project Talk: OWASP Development Guide
13:00 - Project Summit: Open SAMM Session
13:00 - PANEL: Wait Wait... Don't Pwn Me!
13:00 - Hacking Web Server Apps for iOS
13:00 - Hack.me: a new way to learn web application security
14:00 - OWASP Broken Web Applications (OWASP BWA): Beyond 1.0
14:00 - Buried by time, dust and BeEF
14:00 - Modern Attacks on SSL/TLS: Let the BEAST of CRIME and TIME be not so LUCKY
14:00 - Go Fast AND Be Secure: Eliminating Application Risk in the Era of Modern, Component-Based Development
14:00 - Project Talk: OWASP Security Principles Project
15:00 - Wassup MOM? Owning the Message Oriented Middleware
15:00 - HTTP Time Bandit
15:00 - Project Talk: OWASP Code Review Guide
15:00 - CSRF: not all defenses are created equal
15:00 - The 2013 OWASP Top 10
16:00 - Award Ceremony (Salon 1, 2, 3 & 4)

Presenters