Security

OWASP

wild wild west

devsecops

As the Projects Manager for all projects at OWASP (the Open Web Application Security Project), Samantha Groves has deep visibility into the 140 or so projects currently on the boards at OWASP. We start our discussion with what her typical day looks like and then move into how OWASP is changing and the different models for project frameworks.

About Samantha Groves
Samantha Groves is the Project Manager at OWASP. Samantha has led many projects in her career, some of which include website development, brand development, sustainability and socio-behavioural research projects, competitor analysis, event organisation and management, volunteer engagement projects, staff recruitment and training, and marketing department organisation and strategy implementation projects for a variety of commercial and not-for-profit organisations. She is eager to begin her work at OWASP and help the organisation reach its project completion goals.

Samantha earned her MBA in International Management with a concentration in sustainability from Royal Holloway, University of London. She earned her Bachelor's degree majoring in Multimedia from The University of Advancing Technology in Mesa, Arizona, and she earned her Associate's degree from Scottsdale Community College in Scottsdale, Arizona. Additionally, Samantha recently attained her Prince2 (Foundation) project management certification.

Samantha Groves - Getting the Most from OWASP Projects

Run Along Little One

The OWASP Top Ten Proactive Controls Project is spearheaded by Jim Bird and Jim Manico. According to Jim Bird, it is a list of security techniques that should be included in every software development project. I spoke with him about the evolution of the project and how he envisions it being used by the OWASP community, and specifically by developers. 

Resources for this Broadcast
<a href="https://www.owasp.org/index.php/OWASP_Proactive_Controls">OWASP Top Ten Proactive Controls Project </a>
<a href="ca.linkedin.com/pub/jim-bird/3/4b2/646">Jim Bird on LinkedIn</a>

About Jim Bird
Jim Bird is a software development manager and CTO with more than 25 years of experience in software engineering, with a special focus on high-integrity and high-reliability systems. Jim is currently the co-founder and CTO of a major US-based institutional trading service, where he is responsible for managing the company’s technology group and IT security programs. Jim has worked as a consultant to IBM and to major stock exchanges and banks globally. He was also the CTO of a technology firm (now part of NASDAQ OMX) that built custom IT solutions for stock exchanges and central banks in more than 30 countries. Jim is an active contributor to OWASP, helps out as a member of the SANS Analysts program on application security, and rants about Agile software development, project management and application security topics on his blog “Building Real Software.

The OWASP Top Ten Proactive Controls Project  with Jim Bird

Earthgazing is a sound that we've been working on for the past year. It talks about how humans tend to forget how much the Earth provides us, and that we need to take a moment to look at it's beauty. When you look at the Earth from space, you realize that we're all one. Earthgazing is Until We Last's first official release.

Until We Last is a Bangalore based post-rock band that formed in 2011. Originally a one-man bedroom project started by Ketan Bahirat, it evolved into a fully fledged band in December 2012, when Bahirat was joined by Ralston D’souza on drums, Chaithanya Jade on guitars and Paul Dharamraj on bass.

Recording Engineered by Rahul Ranganath
Mixed by Keshav Dhar at Illusion Audio
Mastered by John Webber at AIR Studios, London
Art by Angiras Krishna

Bookings/Contact: Vital Agency | Munbir Chawla +91 99719-43113; munbir@thewildcity.com | Other contact: untilwelast@gmail.com

Earthgazing

Sails to the Breeze

In this segment, we talk with the co-coordinators of the OWASP OWTF Project. The aim of the project is to make security assessments as efficient as possible by automating the manual, uncreative part of pen testing.

OWASP Offensive Web Testing Framework with Bharadwaj Machiraju and Abraham Aranguren

John Patrick Lita has been working on the OWASP Online Academy since February. He plans to release it to the community within the next month. In this conversation, we talk with John about his plans for the project. Joining us is Jerry Hoff, one of the first content contributors to the Online Academy. 

https://www.owasp.org/index.php/OWASP_Online_Academy


The OWASP Online Academy with John Patrick Lita and Jerry Hoff

With over 20,000 downloads within it's first two months of release, the Security Knowledge Framework Projects seems to have hit a resonant chord with the OWASP community. Glenn Ten Cate and his brother Riccardo created the project as  a tool that is used as a guide for building and verifying secure software. It can also be used to train developers about application security.

The OWASP Security Knowledge Framework is an expert system web-application that uses the OWASP Application Security Verification Standard and other resources. I spoke with Glenn about the project and it's future growth.

You can learn more about the project on the OWASP project site: https://www.owasp.org/index.php/OWASP_Security_Knowledge_Framework

OWASP Security Knowledge Framework Project w/ Glenn Ten Cate

The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls. The primary aim of the OWASP ASVS Project is to normalize the range in the coverage and level of rigor available in the market when it comes to performing Web application security verification using a commercially-workable open standard.

Project on OWASP
https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project


OWASP Application Security Verification Standard Project w/ Andrew van der Stock

The WebGoat Project started 10 years ago and has had over 1,000,000 downloads. Version 7.0 is being released this week. I caught with Bruce Mayhew, project lead, to talk about the history of the project, what has been updated in version 7, and what he foresees as the future of this project.

https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project

The OWASP WebGoat Project, version 7.0, with Bruce Mayhew

The OWASP Top 10 Proactive Controls Project uses the OWASP Top 10 model as a way to encourage the community to participate in the building and maintenance of a Top 10 project aimed at developers. In this interview, I talk with Jim Manico and Katy Anton on the history of the project, how they anticipate it being utilized, and how they have worked with the community do decide the criteria for building the list of controls.

OWASP Top 10 Proactive Controls Project with Jim Manico and Katy Anton

Author Podcast | Nine Steps To Success: An ISO 27001 Implementation Overview with Alan Calder

Jason Schmitt's passion is to assure security is built into the development process, not just as a bolt-on add-on.  His experience in various aspects of software security has led him on a path through mobile, application and cloud security. In our conversation, Jason talks about the value OWASP provides to the community as well as what he perceives as a critical time for the integration between DevOps and security. 

About Jason Schmitt

Jason Schmitt is vice president and general manager of HPE Security  Products, Fortify for Hewlett Packard Enterprise. He is responsible for driving the growth of Fortify’s  software security business and managing all operational functions  within the group.  Schmitt has extensive experience in product management,  development and marketing for all types of web and security  technologies. His expertise ranges from cloud-based secure web  gateways, to application security and mobile security consulting  services, to network-based video surveillance.

Security as Part of DevOps and Development with Jason Schmitt

What can software learn from industries like aerospace, transportation, or even retail during national disasters? This week’s podcast is with Emil Stolarsky and was recorded live after his talk on the subject at Strangeloop 2017. Interesting points from the podcast include several stories from Emil’s research, including the origin of the checklist, how Walmart pushed decision making down to the store level in a national disaster, and where the formalized conversation structure onboard aircraft originated. The podcast mentions several resources you can turn to if you want to learn more and wraps with some of the ways this research is affecting incident response at Shopify.

Why listen to this podcast:

* Existing industries like aerospace have built a working history of how to resolve issues; it can be applicable to software issues as well.
* Crew Resource Management helps teams work together and take ownership of problems that they can solve, instead of a command-and-control mandated structure.
* Checklists are automation for the brain.
* Delegating authority to resolve system outages removes bottlenecks in processes that would otherwise need managerial sign off.
* When designing an alerting system, make sure it doesn’t flood with irrelevant alerts and that there’s clear observability to what is going wrong.

More on this: Quick scan our curated show notes on InfoQ http://bit.ly/2zmCsfR

You can also subscribe to the InfoQ newsletter to receive weekly updates on the hottest topics from professional software development. bit.ly/24x3IVq

Subscribe: www.youtube.com/infoq
Like InfoQ on Facebook: bit.ly/2jmlyG8
Follow on Twitter: twitter.com/InfoQ
Follow on LinkedIn: www.linkedin.com/company/infoq
Want to see extented shownotes? Check the landing page on InfoQ: http://bit.ly/2zmCsfR

InfoQ Podcast

Show Notes

Incident Response Across Non-Software Industries with Emil Stolarsky

The inclusion of security as an integral piece of the DevOps puzzle continues to gain traction. In this episode of the DevSecOps Days Podcast Series, I speak with Curtis Yanko and Scott McCarty about their new book, "A Concise Introduction to DevSecOps". We discuss why they wrote the book, who the audience is that will benefit from it and why enterprises should be considering security as part of the software development environment.

with Curtis Yanko and Scott McCarty

A Concise Introduction to DevSecOps

Electric Universe

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.