RfP for Owasp SAMM assessment (£10k budget)

Here is a project brief I have been asked to share by a company that operates across Europe, USA and Australia.

Seems to me like a great opportunity for an active member of the OWASP/SAMM community :)

Ping me if your company (or you) want to respond, and I'll put you in touch with them.

--------

Project brief:

Our e-commerce security maturity is of critical importance to us and our valued customers.

Through this RfP process, we are approaching the App/InfoSec community to invite responses from Europe-based AppSec consultants and businesses who are interested in engaging with our Group Security team to delivery an acute assessment of our individual team's security maturity.

We welcome responses from those well versed in the OWASP SAMM methodology, and have full-stack technical experience of auditing complex e-commerce environments and practices. Experience in producing board-level written reports and visualisations of data collected is highly desired. The data is to be collected using the Owasp Maturity Model tool.

Can you deliver this 3 day C++/Java course in the UK?

I was asked to deliver the course below in the UK but it is too structured for my style of training and I don't have the time to delivered it.

So if you have the skills and can do it, ping me and I'll put you in touch with the company organising it

First batch of questions for .NET Developer contracting work

Regarding the Two 6-months contract to work on TeamMentor (QA and Dev) here is my first batch of questions to the candidates:

Write technical content for SI's SME course development and TeamMentor

Just got this request from SI's Chris Williams (cwilliams@securityinnovation.com) which some of you might be interested in:

--------------------

As the SI course catalog  and Team Mentor continue to grow, so does our need for SMEs to write outlines, create PowerPoint decks, review draft content, and write TM articles.

Two 6-months contract to work on TeamMentor (QA and Dev)

Here is a heads up for an official 'SI job hiring' post that should be published asap (i.e. when we get it done).

NetSec jobs at Reddit and work for SI

If you looking for a new job or contract work, checkout this theead at Reddit's /r/netsec community: Q4 2012 Information Security Hiring Thread

There are some great opportunities in there including one from SI who I would  recommend you take a look at.

Here is how Joe (who leads the Services team) describes SI's work environment (which I have to say it is not an exaggeration) and the current openings.

(pasted from this reddit comment)

Security Innovation (SI) is hiring Security Engineers and Security Trainers for our Seattle and Boston offices.

SI is an awesome place where you get to work with like-minded, passionate, dedicated friends daily. We encourage our engineers to build their skills through research time and being part of a tightly knit team.

We are the kind of team that gets really, really excited about finding vulnerabilities and helping our customers understand their risk. Yesterday one of the guys on my team came in my office grinning from ear to ear giggling and saying "I figured out their auth system... Or Lack Thereof!!"

We work with a huge number of varying customers, from large tech companies to small startups. We find vulns in everything from embedded, mobile, web, native, and more. We expect you to have the skills for all of these and a specialty in one or two areas.

If you've found yourself giggling after finding a vulnerability, if you enjoy participating in CTFs and solving problems, if you like the idea of focusing on honing your skills in security with an awesome team please apply.

• We pay well and have tons of awesome perks like:
• 10% of your time can be dedicated to personal research (with a generous research and education budget), present at conferences, get published, etc.
• We will buy you a kickass machine when you come aboard of your choosing
• Unlimited (yes, really) vacation and awesome bonuses
• Work with an awesome team (for the last three years straight we've brewed beer together for our holiday party)
• Actually Fun Morale events (yes, beyond the beer brewing :) )

Check out our blog and some of our posts (especially the engineering ones like these):

• What LinkedIn Should Have Done with Your Passwords
• Making Responsible Disclosure Easy
• Online privacy is dead... if you let it die.

Check out some of our tools, github, blog, whitepapers and other contributions to the security world on our website.

Thanks for reading down to the end of this post, if you'd like to apply we'd love to have you. For more information see theofficial job postings.

When you're ready we've set up a challenge for you to test your skills! Get as far as you can and email your resume along with your progress to jobs -at- securityinnovation -.- com. If you get stuck don't hesitate to e-mail for a hint. Note: this challenge is supposed to be fun, so don't beat yourself up over it.

WebAppSec 4 day contract in Dublin, and Security Teams for Hire

Just got contacted by {somebody} who needs a resource asap for a 4 day project (WebAppSec assessment) in Dublin next week (starting on the 8th of May)

If this is something you can do (and have the skills + availability), please ping me and I'll put you in touch.

And if you are looking to hire a team or want the services provided by a company (vs a contactor) I will recommend that you talk with these guys below (just a quick list from the top of my head of when I think of WebApp Security companies):

• Joe Basirico at SecurityInnovation - who leads a great team (note that I work at SI)
• Dan Cornell at Denim Group (Texas) - the man behind http://code.google.com/p/threadfix/
• Jeff Williams at Aspect Security (Washington DC) - the creator of  http://esapi.org/
• John Steven at Cigital (Washington DC) - who just god married and need a good excuse to go out and visit a 'customer' :)
• Justin Clarke at Gotham Digital Science (London) - who is a regular Chiswick Boot Camp sometimes wearing his Batsuit :)

Freelance Brief - Improve cross browser CSS of main TeamMentor GUI

This is a brief for a freelancer expert in Browser compatibility issues

Problem: Improve the cross browser CSS of the main TeamMentor GUI (as seen on https://owasp.teammentor.net/)
Deliverable: Patch for https://github.com/TeamMentor-OWASP/Master  repository
Budget: 100 USD
Apply at: https://www.elance.com/job/30027361/proposals


Technical details:


Currently there are subtle CSS differences between the multiple browsers and Operating System that need to be corrected.

The focus should be on the Font family and sizes.

Here is TeamMentor GUI showing https://owasp.teammentor.net/ on multiple Browsers and Operation Systems:

Chrome and Firefox on Windows:

IE on Windows:

Safari and Chrome on OSX:

The brief is to provide a number of CSS fixes as patches (first one to deliver gets the contract)

The source code is at https://github.com/TeamMentor-OWASP/Master  and the live server is at https://owasp.teammentor.net/)

Bonus Points: Figure out why the checkboxes of the Filters overflow in Chrome on OSx (see screenshot above) 

Freelance Brief - Fix IE layout issue in TeamMentor Eval Page

This is a brief for a freelancer expert in IE compatibility issues

Problem: Fix the IE 7,8,9 layout problem that happens in the http://docs.teammentor.net/xml/Eval and http://docs.teammentor.net/xml/Customer pages
Deliverable: Patch for https://github.com/TeamMentor/TeamMentor-Documentation repository
Budget: 100 USD
Apply at: https://www.elance.com/job/30027086/proposals


Technical details:


The 3.1 version of TeamMentor supports the creation and delivery of pure XML content. This technique is used to create an marketing page made of an xml file (http://docs.teammentor.net/xml/Eval) and an XSL file (http://docs.teammentor.net/xml/xslt_LandingPage_Variation_2). The http://docs.teammentor.net/xml/Customer xml page uses the same XSL.

The XML+XST transformation into HTML happens on the client (i.e. browser) and looks like this in Chrome/Firefox:

The problem is that it looks like this in IE (note how it is left justified)

The brief is to provide a IE specific patch for this problem (first one to deliver gets the contract)

The source code is at https://github.com/TeamMentor/TeamMentor-Documentation and the live server is at http://docs.teammentor.net/xml/Eval

Bonus Points: Figure out why the '& included inside the HTML Object tags' encoding is lost, when editing the XSL via thisTeamMentor Notepad Interface: http://docs.teammentor.net/notepad/xslt_LandingPage_Variation_2

Want to work? I need resources ASAP for TeamMentor 3.1 release

With TeamMentor 3.1 entering its last push before general release I have budget to add a couple temporary resources to the team in order to make sure this release absolutely rocks!

Here are the current tasks I can hire you (or somebody you know) ASAP as a short term contractor:

• QA and Testing -  test TM and provide feedback on any bugs (on previous and new features). Ability to write UnitTests is VERY important (on NUnit and/or QUnit)
• Security review, do a security review on the new 3.1 features (btw, I want any findings as Unit Tests). See ...O2 in Seattle..." and "...Please Hack TeamMentor (beta)... for more details
• Library Creation and Content Review - go though the exercise of creating a bunch of new libraries (from existing TM content and from other sources), both using the previous and new editing modes. The objective is to make sure the workflow(s) are working 100%
• TM Documentation - There is quite a lot to document, specially on the customization front (and I expect that who is involved in the tasks described above will also create TM Documentation articles)

In order to make this workable, I want to allocate these tasks in blocks of 500 USD a pop (i.e. brief).

So your brief is to write your brief based on the tasks you want to do :)

Then send it to me, and if it looks good, you can start strait away (note that we want to release 3.1 in the next week(s)).

One caveat, if you have problems working with Git and GitHub, you probably are not a good fit (sorry about that).

Tip: The best way for you to get this gig is for you to go to this GitHub repository or to this one , create a clone (or Fork) and send me a patch :)