AppSec USA 2013

AppSec USA 2013 took place Nov. 18, 2013 through Nov. 21, 2013 (10 years, 5 months ago) at New York Marriott Marquis in New York, New York, USA.

Presentations

Monday, Nov. 18, 2013

09:00 - Project Summit: OWASP Projects Review Session
09:00 - OWASP Media Project Introduction
13:00 - OWASP PHP Security and RBAC Projects: An introduction
13:00 - Project Summit: AppSensor 2.0 Hackathon

Tuesday, Nov. 19, 2013

09:00 - 2 Day Pre-Conference Training: Securing Mobile Devices & Applications Training
09:00 - 2 Day Pre-Conference Training: Web Application Defender's Cookbook: LIVE Training
09:00 - Project Summit: Training Development Session
09:00 - Project Summit: Mobile Security Session
09:00 - 2 Day Pre-Conference Training: Running A Software Security Program On Open Source Tools Training
09:00 - 2 Day Pre-Conference Training: The Art of Exploiting Injection Flaws Training
09:00 - 2 Day Pre-Conference Training: Application Cryptanalysis with Bletchley Training
13:00 - Project Summit: Academies Development Session
15:00 - OWASP O2 Documentation Session
19:00 - Hands-on Ethical Hacking: Preventing and Writing Exploits for Buffer Overflows Training

Wednesday, Nov. 20, 2013

08:30 - Welcome to OWASP AppSecUSA - Updates
09:00 - Computer and Network Security: I Think We Can Win!
09:00 - Project Summit: Writing and Documentation Review Session
10:00 - How To Stand Up an AppSec Program - Lessons from the Trenches
10:00 - Project Talk: Project Leader Workshop
10:00 - Hardening Windows 8 apps for the Windows Store
10:00 - The Perilous Future of Browser Security
10:00 - Automation Domination
10:00 - PANEL: Aim-Ready-Fire
11:00 - From the Trenches: Real-World Agile SDLC
11:00 - Project Talk: OWASP Enterprise Security API Project
11:00 - OWASP PCI toolkit Session
11:00 - Can AppSec Training Really Make a Smarter Developer?
11:00 - Securing Cyber-Physical Application Software
11:00 - Computer Crime Laws - Tor Ekeland, Attorney
11:00 - Why is SCADA Security an Uphill Battle?
12:00 - BASHing iOS Applications: dirty, s*xy, cmdline tools for mobile auditors
12:00 - OWASP NIST NSTIC IDecosystem Initiative: Initial Discussion Meeting
12:00 - Case Study: 10 Steps to Agile Development without Compromising Enterprise Security
12:00 - Build but don't break: Lessons in Implementing HTTP Security Headers
12:00 - The Cavalry Is Us: Protecting the public good
12:00 - All the network is a stage, and the APKs merely players: Scripting Android Applications
13:00 - A Framework for Android Security through Automation in Virtual Environments
13:00 - 2013 AppSec Guide and CISO Survey: Making OWASP Visible to CISOs
13:00 - Project Talk: OWASP OpenSAMM Project
13:00 - Mantra OS: Because The World is Cruel
13:00 - HTML5: Risky Business or Hidden Security Tool Chest?
13:00 - PANEL: Privacy or Security: Can We Have Both?
14:00 - Project Talk: The OWASP Education Projects
14:00 - Javascript libraries (in)security: A showcase of reckless uses and unwitting misuses.
14:00 - Revenge of the Geeks: Hacking Fantasy Sports Sites
14:00 - "What Could Possibly Go Wrong?" - Thinking Differently About Security
14:00 - PANEL: Cybersecurity and Media: All the News That's Fit to Protect?
14:00 - What You Didn't Know About XML External Entities Attacks
15:00 - Project Talk: OWASP AppSensor Project
15:00 - Pushing CSP to PROD: Case Study of a Real-World Content-Security Policy Implementation
15:00 - Advanced Mobile Application Code Review Techniques
15:00 - PANEL: Mobile Security 2.0: Beyond BYOD
15:00 - OWASP Zed Attack Proxy
15:00 - Making the Future Secure with Java
16:00 - Big Data Intelligence (Harnessing Petabytes of WAF statistics to Analyze & Improve Web Protection in the Cloud)
16:00 - Healthcare Security Forum
16:00 - Forensic Investigations of Web Explotations
16:00 - Sandboxing JavaScript via Libraries and Wrappers
16:00 - OWASP Top Ten Proactive Controls
16:00 - Tagging Your Code with a Useful Assurance Label
17:30 - OWASP Jeopardy

Thursday, Nov. 21, 2013

09:00 - Defeating XSS and XSRF using JSF Based Frameworks
09:00 - Mobile app analysis with Santoku Linux
09:00 - Contain Yourself: Building Secure Containers for Mobile Devices
09:00 - AppSec at DevOps Speed and Portfolio Scale
09:00 - ') UNION SELECT `This_Talk` AS ('New Exploitation and Obfuscation Techniques’)%00
09:00 - Project Summit: ZAP Hackathon Session
10:00 - Accidental Abyss: Data Leakage on The Internet
10:00 - PiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong
10:00 - iOS Application Defense - iMAS
10:00 - Leveraging OWASP in Open Source Projects - CAS AppSec Working Group
10:30 - Project Summit: ESAPI Hackathon Session
11:00 - OWASP Hackademic: a practical environment for teaching application security
11:00 - An Introduction to the Newest Addition to the OWASP Top 10. Experts Break-Down the New Guideline and Offer Provide Guidance on Good Component Practice
11:00 - The State Of Website Security And The Truth About Accountability and “Best-Practices”
11:00 - Verify your software for security bugs
11:00 - Project Talk and Training: OWASP O2 Platform
12:00 - Insecure Expectations
12:00 - Project Talk: OWASP Testing Guide
12:00 - OWASP Periodic Table of Elements
12:00 - PANEL: Women in Information Security: Who Are We? Where Are We Going? (Salon 1 & 2)
12:00 - Application Security: Everything we know is wrong
13:00 - Project Talk: OWASP Development Guide
13:00 - Project Summit: Open SAMM Session
13:00 - NIST - Missions and impacts to US industry, economy and citizens
13:00 - PANEL: Wait Wait... Don't Pwn Me!
13:00 - Hacking Web Server Apps for iOS
13:00 - Hack.me: a new way to learn web application security
14:00 - Modern Attacks on SSL/TLS: Let the BEAST of CRIME and TIME be not so LUCKY
14:00 - Project Talk: OWASP Security Principles Project
14:00 - Go Fast AND Be Secure: Eliminating Application Risk in the Era of Modern, Component-Based Development
14:00 - OWASP Broken Web Applications (OWASP BWA): Beyond 1.0
14:00 - Buried by time, dust and BeEF
15:00 - The 2013 OWASP Top 10
15:00 - CSRF: not all defenses are created equal
15:00 - Wassup MOM? Owning the Message Oriented Middleware
15:00 - Project Talk: OWASP Code Review Guide
15:00 - HTTP Time Bandit
16:00 - Award Ceremony (Salon 1, 2, 3 & 4)

Presenters