My comments on the "Open Letter to the OWASP Board from the OWASP Chapters"

Thanks Josh (and others who put this Open Letter together) for the effort and passion on Owasp and in continuing to try to find solutions to improve the current situation

Although I don't agree 100% with the solutions presented in this document (see some of my ideas below), I'm happy to sign it since this is the kind of fact based discussions and conversations that we must have as a community (one request, can we put this letter in a GitHub repo so that we can send comments using git and sign it using Pull Requests)

Note that I have not been that involved lately in Owasp foundation threads (including reading all my @owasp.org email), but the key themes of decentralisation and openness are key for Owasp future and require creative solutions

My view on situations like this Open Letter, is that this is a great example of the passion that our community has for Owasp (which is a very positive thing). It is not good that they needed to resort to an Open Letter to raise the issue, but what is important is how we all react to the challenge and help to improve Owasp's future and organisation

Presentation - "Surrogate dependencies (poc in node js) v1.0"

Here is the second part of the presentation I delivered at the OWASP London Chapter event (29 Sep 2016)

Presentation "NodeJS security - still unsafe at most speeds - v1.0"

Here is the first part of the presentation I delivered at the OWASP London Chapter event (29 Sep 2016)

Using JIRA to manage RISKS - v1.0 - OWASP AppSec EU - June 2016

Here is the presentation I just delivered at OWASP's AppSec EU in Rome

Using jira to manage risks v1.0 - owasp app sec eu - june 2016 from Dinis Cruz

OWASP Mobile Top 10 2016 (Release candidate)

When looking a mobile applications security a great place to start is the OWASP Mobile Top 10 2016 which is currently in its release candidate state (previous version can be found here)

When doing a Threat Model of an mobile application, in addition to the STRIDE questions, go through these 10 items and ask the questions:

Link to join OWASP Slack

If you want to participate in one of the multiple great AppSec channels at https://owasp.slack.com and don't have an account, please use this link:

http://owasp.herokuapp.com

(posting this a blog so that it is easy to find on Google)

"New Era of Software with modern Application Security" presentation (v1.0)

This is the final slide deck of the "New Era of Software with modern Application Security" presentation I delivered at Codemotion Rome, which was a developer-focused conference (with 2000 tickets sold).

Description: "This presentation will start with an overview of the current state of Application Insecurity (with practical examples). This will make the attendees think twice about what is about to happen to their applications. The solution is to leverage a new generation of application security thinking such as: TDD, Docker, Test Automation, Static Analysis, cleaver Fuzzing, JIRA Risk workflows, Kanban, micro web services visualization, and ELK. These practices will not only make applications/software more secure/resilient, but it allow them to be developed in a much more efficient, cheaper and productive"

Presenting at OWASP AppSecEU on "Using JIRA to manage Risks and Security Champions activities"

I just received this nice invitation from the OWASP AppSec EU today:

My plan is to use this opportunity to document the JIRA workflows that I have been creating and implementing (when acting as Head of Application Security)

Here are a couple related posts:

• JIRA Workflows for handing AppSec RISKS 
• What are Security Champions and what do they do? 
• Does your team has a Security Champion? If not, get this Mug and Library 
• "New Era of Software with modern Application Security" updated presentation (v.0.6) 

"New Era of Software with modern Application Security" updated presentation (v.0.6)

Here is the updated version of the talk I delivered last week at the LSCC (this time around delivered at the OWASP London Chapter)

There are a number of new slides, but it is still far from complete :)

Please take a look at the slides and let me know what you think of them? (and what can be improved for the next version)

Paying OWASP Leaders and some ideas on how OWASP should be supporting its projects

(based on an email to the owasp-leaders list)

The reasons why I believe OWASP  should not be allowed to pay owasp leaders are listed here http://blog.diniscruz.com/2012/04/why-owasp-cant-pay-owasp-leaders.html

And since I have not been on the OWASP board for about 5 years, I think we need to realise that IF it was possible to pay owasp leaders to work on OWASP projects, THAT (paying owasp leaders) would have happened by now (after all, there has been enough budget to make that happen)

The problem is that there is still this 'idea' that "IF ONLY we could do that (pay owasp leaders) amazing stuff would happen". 

Request for OWASP board to approve 100K for a project Summit in 2016

(sent to the OWASP leaders list in early Dec 2015, following the original request made in June 2015)

Bumping this thread, since I believe not much has happened since.

I would like to request again for "OWASP board to approve 100K for a project Summit in 2016. And then ask for a team or OWASP leaders to lead that effort"

Proposed new strategy for OWASP projects - They are Research Projects

(variation of an email send to the owasp leaders list)

I think a key problem is the expectation that OWASP should ever be able to develop professional, best in class and 'secure' apps.

These conversations always tend to have a base on the idea that OWASP 'should not have a lot of projects' and 'only focus on a couple high-value/high-quality ones'. This never gains traction because that goes completely the model and culture of OWASP projects.

The reality is that really good a solid projects at OWASP are the exception and the outliers.

500 USD budget available for Google Cloud use by OWASP Projects

(below is an email I just sent to the owasp-leaders list about the 500 USD budget I requested from the 'OWASP budget available for OWASP projects')

---

OWASP leaders, FYI we now have a 500 USD budget approved to spend on Google Cloud (some more details on the thread below).

This is basically open to any OWASP leader to use on OWASP projects. 

Part of the idea is to figure out good use cases of using cloud resources (like the ones provided by Google Cloud) on OWASP projects

I've setup an Slack channel to talk about this and to manage its use: https://owasp.slack.com/archives/projects-in-cloud

If you want access to the admin console (for example to setup your linux/docker/windows VM) drop me, Fabio or Matt (ideally via Slack) a simple email and we'll add you to the cloud users ground.

This is early days of this experiment and we still need to create a couple Rules of Engagement and scripts to manage the environment, so if you want to be involved in that part of the action it would help to make this resource available to a wider community.

As a example of the kind of usage that OWASP projects can have of these Google Cloud resources, based on a recent thread on the O2 Platform mailing list (How-To Request: Running Real Time feedback inside Visual Studio with C# REPL) we are setting up a Windows VM with VisualStudio 2010

OWASP and O2 Platform on Slack

There is a new Slack for OWASP https://owasp.slack.com which you can join using the invite at http://owasp.herokuapp.com

In there you will find the https://owasp.slack.com/messages/project-o2 which can be used for all sort of O2 questions and scripts developments :)

See you there

On the current OWASP Project Summit efforts (in Feb 2015)

It's really hard to create an OWASP Project Summit with the current model (with little funding, with no dedicated team, attached to a conference, etc..)

The formula that worked in the past was to start with a set budget (lets say 50k to 100k) and :

• use those funds to make sure the key players (in this case project leaders and 'new players') are going to attend (by offering to cover all travel and accommodation expenses (while asking them if they can get their employee to pay instead))
• hire a dedicated summit team (for that period)
• secure dedicated venue and summit resources
• generate a huge amount of energy about the summit sessions (starting by inventing all sorts of sessions, until the real sessions become solid) 
• cast a very wide net of 'invitations to attend the summit' (with the vision that 'the summit is THE place to be, where all the key players will be in the same location, and  where REAL work can be done')

Question about ESAPI for .NET

I was asked recently about 'ESAPI for .NET?' (by XXX, who is an SI customer) and here was my reply

---------

Hi, unfortunately there isn't a simple answer/solution for your question

I would definitely not recommend of using any of the ESAPI libraries, specially the .NET since that is not even in a workable state.

The best security controls out there are actually the Microsoft ones, which when used in secure ways, do provide a lot of security (for example Razor now encodes by default which does a lot to prevent XSS). On the topic of XSS, the Microsoft AntiXSS library is really good, and is now part of .NET 4.5.

Please come and play with the OWASP Band AppSec EU at the CB2 (Tuesday 24th,7pm)

Next week the OWASP Band is getting back together and as always we need players. 

So, If you are coming to the conference (or are in the area), please let me know (ASAP) what instrument you can play, and I'm sure we can find a way to make it work.

Due to Adrian relentless efforts there is a full PA + Amps + Guitar + Bass + Keyboard + Drums available, what we now need is players :)

The show starts at at 7pm and we will do the soundcheck (i.e. the rehearsal) from 5pm.

The venue is the CB2 (http://www.cb2bistro.com/contact.html) which is just walking distance from the main conference location:

Some hacking for the weekend (with an AppSensor and O2 Platform flavour)

(originally posted to the OWASP leaders list)

---------- ---------- ---------- ---------- ---------- ---------- ---------- 

As you can see on Please hack TeamMentor 3.4.1 (learn, maybe be paid or even get a job) I'm inviting the world to hack the app I'm been working for the past years.

You can either do a pure black-box (on https://tm-appsensor.azurewebsites.net ) or look at the source code (clone from https://github.com/TeamMentor/Dev and run locally or in Azure (only needs .NET 4.0, no DB install required) 

There is quite a lot of OWASP influence in this release of TeamMentor, from the O2 Platform FluentSharp libraries (which make me a lot more productive as a developer), to the AppSensor-like features (see below) and the multiple OWASP-inspired coding strategies used to keep the app secure (look for example at the ASMX and WCF security tests or the .NET Security Demands).

What is really cool and I'm very excited about, is the first pass at adding AppSensor capabilities to this app. 

On the unrealistic expectations on OWASP board members, and the 'myth of the OWASP Board member'

Following Michael's original OWASP.next post to the leaders list (regarding his OWASP.next post on the OWASP blog), Dennis replied with a number of examples of rotten leadership  which I don't really agree with and posted the text bellow as my reply

For a while I have been saying that putting such 'expectations and requirements' on board members was going to cause a lot of friction and this is just another example of it

I don't actually agree with Dennis analysis. But the reason I don't agree is not due to the fact that he is correct (or not) in his analysis. My view is that it is completely unrealistic to put  such a high level of expectation on OWASP board members, specially in terms of their: behaviour, morals, actions and words. My biggest problem with current/past board members is on lack of action, decisions and delegation of duties :)

Published Beta version of "Thoughts on OWASP" eBook

After releasing the "Practical AngularJS",  Practical Git and GitHub,  Practical Jni4Net and Practical Eclipse books, here is an equivalent book containing my OWASP related blog posts.

This new eBook has 165 pages and is made of 67 blog posts published in the last couple years.

The posts are grouped by topic and represent a lot of my thinking about OWASP, the current AppSec industry and other philosophical ideas.

This eBook is available at https://leanpub.com/Thoughts_OWASP