1. HACTIVITY CONFERENCE 2015
The air force one has departured are you on board?
SURVIVAL IS NOT MANDATORY

2. Glenn ten Cate
Security dude @ Schuberg Philis
Author of OWASP-SKF
Coordinates
Twitter: @FooBar_testing_
E-mail: glenn.ten.cate@owasp.org
Website: secureby.design
WHO AM I?

3. Fast mean of traveling
Safest transportation method
Autopilots
Monitoring and communication
Airplanes are very reliable
AIRPLANES

4. HACTIVITY CONFERENCE 2015
TRAINING

5. HACTIVITY CONFERENCE 2015
CHECKLISTS

6. HACTIVITY CONFERENCE 2015
MANUALS

7. All the parts of the airplane are tested
Critical individual components
Simulate certain conditions
Manual testing
Automatic testing
TESTING

8. HACTIVITY CONFERENCE 2015
The airliner companies share information
This information is key to prevent x
Learn from mistakes…
All for the good of protecting
SHARING INFORMATION

9. Last year around 45 Million web-
applications got hacked
Sensitive information is leaked
Lives of people are at risk
Criminals get better IT is not…
THOSE WHO FAIL TO LEARN FROM
HISTORY…

10. ARE FORCED TO REPEAT THE PAST
THOSE WHO FAIL TO LEARN FROM
HISTORY…

11. HACTIVITY CONFERENCE 2015
The Open Web Application Security
Project
Worldwide not-for-profit charitable
organization focused on improving the
security of software.
Knowledge sharing platform / network
Visit www.owasp.org for more
information
OWASP

12. HACTIVITY CONFERENCE 2015
OWASP Application Security Verification
Standard
Worldwide used checklist
Securing web-applications in depth
Visit www.owasp.org for more
information
OWASP CHECKLISTS

13. HACTIVITY CONFERENCE 2015
OWASP Application Security Verification
Standard
Use level 1 – 3 depending on the type of
application and data it holds.
Use it as a security requirement
OWASP ASVS

14. Can only lead to one thing
Only question is when?
NO SECURITY REQUIREMENTS

15. HACTIVITY CONFERENCE 2015
OWASP Security Knowledge Framework
Tool for training developers
Creating secure web-applications by
design
Implementation of OWASP ASVS
Visit www.secureby.design for more
information
OWASP TRAINING

16. HACTIVITY CONFERENCE 2015
OWASP Security Knowledge Framework
Pre-development phase
Post-development phase
Security Knowledge reference place
Security code examples
OWASP SKF

17. HACTIVITY CONFERENCE 2015
OWASP Security Knowledge Framework
Demo
https://securityknowledgeframework.org/
demo.php
OWASP SKF

18. HACTIVITY CONFERENCE 2015
OWASP-SKF
Code review
SAST
DAST
Manual pentest by expert
SDLC MANUAL

19. HACTIVITY CONFERENCE 2015
Software Development Life Cycle
Travis CI
Coveralls CI
Scrutinizer CI
SDLC CI

20. HACTIVITY CONFERENCE 2015
Travis CI
SDLC CI

21. HACTIVITY CONFERENCE 2015
Coveralls CI
SDLC CI

22. HACTIVITY CONFERENCE 2015
Scrutinizer CI
SDLC CI

23. HACTIVITY CONFERENCE 2015
DEMO SDLC
OWASP-SKF

24. HACTIVITY CONFERENCE 2015
CONCLUSION SO FAR…

25. HACTIVITY CONFERENCE 2015
QUESTIONS
Questions?