Intro to O2 Plartform

(here is an intro to the O2 Platform email that I wrote, which was bouncing of the recipient email's server due to '554 rejected due to spam URL in content')

The O2 Platform is all about automating and scripting. It's a platform/framework which means that it helps to have a 'hard question' to start with.

Here are a good place to start with the O2 Platform:

• Best version to download blog.diniscruz.com/2014/08/o2-platform-55-rc1-please-give-it-test.html (see links for documentation)
• Presentation www.slideshare.net/DinisCruz/owasp-o2-platform-november-2010
• Tons of videos: blog.diniscruz.com/2012/04/39-o2-platform-videos-with-12k-youtube.html

Threat Modeling Template and Concepts v0.6

Here is an updated version of Threat Model Template v0.5  and a new Threat Model Concepts page.

You can download the pdfs and draw.io files from this GitHub repo

The BBC should open source most (if not all) of its developed technology

Following on the Recipe for disaster post on the topic of BBC to close recipes website as part of £15m savings, I wanted to put down this idea, which in my view, goes to the heart of the value that public entities (like the BBC, but also the NHS, public services, Non-profit orgs, charities, etc... ) should provide to society:

The BBC should open source most (if not all) of its developed technology 

The BBC hires a large number of software/application teams (from Devs, to QA, to Designers, to Architects), which create a large body of code, that is in most cases behind closed doors and not available to the general public (namely other public or private organisations that would benefit from that code)

Looking for AppSec jobs? Here are some opportunities for you

The AppSec market is definitely getting hotter, and I'm getting more and more calls from recruiters.

The problem is that I'm too senior or expensive for most of them, so there is not much I can do to help. I also do a lot of AppSec training where I get asked a lot the question 'How do I get into AppSec?'

I've decided to try to connect these two worlds and see if we can get more AppSec roles filled up (specially by devs who want to move into AppSec).

I'm starting with job opportunities, but it would be interesting to also list professionals looking for a job.

You can find the page at http://blog.diniscruz.com/p/appsec-jobs.html (starting with two roles from The Hut Group)

Threat Model Template v0.5

Here is a an improved simple Threat Model template which contains info about STRIDE and DFD Elements (which is based on the diagram shown at Threat Model WebServices v0.2)

You can download both PDFs from here

Threat Model WebServices v0.2

Here is an experiment in trying to create an Threat Model (A3 size) that can be easily consumed during the Threat Model session(s).

This diagram was created using https://www.draw.io/ which is pretty amazing (and allows team collaboration):

AppSec and Software Quality - Presentation v0.5

Here is a slimmed down version of the presentation I delivered in Italy last March.

This version does not contain the part that talks about the problem (i.e. the attacks and why you need to do Application Security)

The key idea that I defend is that we can use Application Security to define and measure Software Quality

Let me know what you think