The Atlanta OWASP chapter will meet this Thursday night, June 21st at 6:00pm.
We are excited to announce that this meeting will occur at the Dell SecureWorks headquarters at One Concourse Pkwy, Suite 500, Atlanta, GA 30328.
Please use the following link to RSVP.
This month we will welcome Rohit Sethi as our guest speaker. Rohit is a specialist in building security controls into the software development life cycle (SDLC). Rohit is a SANS course developer and instructor on Secure J2EE development. He has spoken and taught at FS-ISAC, RSA, OWASP, Shmoocon, CSI National, Sec Tor, Infosecurity New York and Toronto, TASK, the ISC2’s Secure Leadership series conferences, and many others. Mr. Sethi has written articles for Dr. Dobb’s Journal, TechTarget, Security Focus and the Web Application Security Consortium (WASC), and he has been quoted as an expert in application security for ITWorldCanada and Computer World. He also leads the OWASP Design Patterns Security Analysis project.
ABSTRACT::
Despite years of research on best practices to integrate security into the early phases of the SDLC, most organizations rely on static analysis, dynamic analysis, and penetration testing as their primary means of eliminating vulnerabilities. This approach leads to discovering vulnerabilities late in the development process, thereby either causing project delays or risk acceptance. Neither option is particularly appealing.
ABSTRACT::
Despite years of research on best practices to integrate security into the early phases of the SDLC, most organizations rely on static analysis, dynamic analysis, and penetration testing as their primary means of eliminating vulnerabilities. This approach leads to discovering vulnerabilities late in the development process, thereby either causing project delays or risk acceptance. Neither option is particularly appealing.
This talk is an open discussion about the presence, if any, of scalable, measurable, approaches working to address security into the SDLC. Consideration for how Agile development impacts effectiveness will be explored.
Points of discussion will include:
– Is static analysis sufficient?
– Developer awareness training
– Threat modeling / architecture analysis
– Secure requirements
– Considerations for procured applications