This talk was presented at the 7th WCSQ World Congress for Software Quality in Lima, Perú on Wednesday, 22nd March 2017.
Writing secure code certainly is not an easy endeavor. In the book titled “Writing Secure Code: Practical Strategies and Proven Techniques for Building Secure Applications in a Networked World (Developer Best Practices)” authors Howard and LeBlanc talk about the so called attacker’s advantage and the defenders dilemma and they put into perspective the fact that developers (identified as defenders) must build better quality software because attackers have the advantage.
In this dilemma, software applications must be on a state of defense because attackers are out there taking advantage of any minor mistake, whereas the defender must be always vigilant, adding new features to the code, fixing issues, adding new engineers to the team. All this conditions are important when it comes to software security.
Sadly, strong understanding of software security principles is not always a characteristic of most software engineers but we can’t blame them. Writing code is a complex task per se, the abstraction level required, along with choosing and/or writing the accurate algorithm and dealing with tight schedules seems to be always a common denominator and the outcome when talking to developers.
This talk also includes techniques, tools and guidance that software engineers can use to perform Application Security testing during the development stage, enabling them to catch vulnerabilities at the time they are created.
Regular Expression Denial of Service RegexDoSMichael Hidalgo
This talk was presented on the OWASP AppSec 2016 Rio de la Plata in Montevideo, Uruguay on 2nd December 2016.
Regular expressions are commonly used in each computational environment: from Web clients to IDS/IPS to Web applications to databases.
Software engineers use regular expressions to perform input data validation and a wide range of other functions related to string manipulations and parsing. With code examples, We'll discuss the so-called RegEx DoS vulnerability and why this security problem has become more and more recurrent in this repository-driven and open source software development model.
This is a presentation about the so-called Regular Expression Denial of Service vulnerability, also known as RegexDoS.
This research gives an explanation on what is a Regex DoS and how it happens on different programming languages.
Several books and online articles were visited in order to create the presentation. Special thanks to Juliette Reinders Folmer from Pluralsight for creating great course https://www.pluralsight.com/courses/regular-expressions-fundamentals.
Mobile application security and threat modelingShantanu Mitra
From Telegraph to 5G, there is huge evolution and transformation in the network accessibility, application design, security threats and risk assessment - the change is getting reflected everywhere. The presentation describes here how good we can follow the best practices in our developments, how best we can we gain the trust of our clients.
DevSecCon Talk: An experiment in agile Threat ModellingzeroXten
ThreatSpec aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write threat specifications alongside code, then dynamically generating reports and data-flow diagrams from the code.
Learn about threat modeling from our CTO and co-creator of the DREAD threat modeling classification, Jason Taylor. Understand more about what threat modeling is, dive into real life examples, and use techniques you can leverage at every phase of the SDLC.
What Every Developer And Tester Should Know About Software SecurityAnne Oikarinen
Software security is best built in. This presentation introduces three essential things to help you design more secure software. In order to have a secure foundation, you can create and select security requirements for your applications using evil user stories and utilizing existing material for example from OWASP.
Another useful skill is threat modeling which helps you to assess security already in the design phase. Threat modeling helps you deliver better software, prioritize your preventive security measures, and focus penetration testing to the most risky parts of the system. The presentation covers various methods, such as the STRIDE model, for finding security and privacy threats.
You will also learn what kind of security related testing you can do without having any infosec background.
Link to Youtube video: https://youtu.be/OJMqMWnxlT8
You can contact me at abhimanyu.bhogwan@gmail.com
My linkdin id : https://www.linkedin.com/in/abhimanyu-bhogwan-cissp-ctprp-98978437/
Threat Modeling(system+ enterprise)
What is Threat Modeling?
Why do we need Threat Modeling?
6 Most Common Threat Modeling Misconceptions
Threat Modelling Overview
6 important components of a DevSecOps approach
DevSecOps Security Best Practices
Threat Modeling Approaches
Threat Modeling Methodologies for IT Purposes
STRIDE
Threat Modelling Detailed Flow
System Characterization
Create an Architecture Overview
Decomposing your Application
Decomposing DFD’s and Threat-Element Relationship
Identify possible attack scenarios mapped to S.T.R.I.D.E. model
Identifying Security Controls
Identify possible threats
Report to Developers and Security team
DREAD Scoring
My Opinion on implementing Threat Modeling at enterprise level
Regular Expression Denial of Service RegexDoSMichael Hidalgo
This talk was presented on the OWASP AppSec 2016 Rio de la Plata in Montevideo, Uruguay on 2nd December 2016.
Regular expressions are commonly used in each computational environment: from Web clients to IDS/IPS to Web applications to databases.
Software engineers use regular expressions to perform input data validation and a wide range of other functions related to string manipulations and parsing. With code examples, We'll discuss the so-called RegEx DoS vulnerability and why this security problem has become more and more recurrent in this repository-driven and open source software development model.
This is a presentation about the so-called Regular Expression Denial of Service vulnerability, also known as RegexDoS.
This research gives an explanation on what is a Regex DoS and how it happens on different programming languages.
Several books and online articles were visited in order to create the presentation. Special thanks to Juliette Reinders Folmer from Pluralsight for creating great course https://www.pluralsight.com/courses/regular-expressions-fundamentals.
Mobile application security and threat modelingShantanu Mitra
From Telegraph to 5G, there is huge evolution and transformation in the network accessibility, application design, security threats and risk assessment - the change is getting reflected everywhere. The presentation describes here how good we can follow the best practices in our developments, how best we can we gain the trust of our clients.
DevSecCon Talk: An experiment in agile Threat ModellingzeroXten
ThreatSpec aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write threat specifications alongside code, then dynamically generating reports and data-flow diagrams from the code.
Learn about threat modeling from our CTO and co-creator of the DREAD threat modeling classification, Jason Taylor. Understand more about what threat modeling is, dive into real life examples, and use techniques you can leverage at every phase of the SDLC.
What Every Developer And Tester Should Know About Software SecurityAnne Oikarinen
Software security is best built in. This presentation introduces three essential things to help you design more secure software. In order to have a secure foundation, you can create and select security requirements for your applications using evil user stories and utilizing existing material for example from OWASP.
Another useful skill is threat modeling which helps you to assess security already in the design phase. Threat modeling helps you deliver better software, prioritize your preventive security measures, and focus penetration testing to the most risky parts of the system. The presentation covers various methods, such as the STRIDE model, for finding security and privacy threats.
You will also learn what kind of security related testing you can do without having any infosec background.
Link to Youtube video: https://youtu.be/OJMqMWnxlT8
You can contact me at abhimanyu.bhogwan@gmail.com
My linkdin id : https://www.linkedin.com/in/abhimanyu-bhogwan-cissp-ctprp-98978437/
Threat Modeling(system+ enterprise)
What is Threat Modeling?
Why do we need Threat Modeling?
6 Most Common Threat Modeling Misconceptions
Threat Modelling Overview
6 important components of a DevSecOps approach
DevSecOps Security Best Practices
Threat Modeling Approaches
Threat Modeling Methodologies for IT Purposes
STRIDE
Threat Modelling Detailed Flow
System Characterization
Create an Architecture Overview
Decomposing your Application
Decomposing DFD’s and Threat-Element Relationship
Identify possible attack scenarios mapped to S.T.R.I.D.E. model
Identifying Security Controls
Identify possible threats
Report to Developers and Security team
DREAD Scoring
My Opinion on implementing Threat Modeling at enterprise level
Penetration testing reporting and methodologyRashad Aliyev
This paper covering information about Penetration testing methodology, standards reporting formats and comparing reports. Explained problem of Cyber Security experts when they making penetration tests. How they doing current presentations.
We will focus our work in penetration testing methodology reporting form and detailed information how to compare result and related work information.
"CERT Secure Coding Standards" by Dr. Mark ShermanRinaldi Rampen
OWASP DC - November 2015 Talk
Abstract:
This presentation will start with an overview of CERT’s view of the tools, technologies and processes for building secure software from requirements to operational deployment, including architecture, design, coding and testing. After providing the context for building secure software, the discussion will focus on the current state of the CERT Coding Standards: what is available, how the rules evolve and how the rules are put into practice.
Bio:
Dr. Mark Sherman is the Technical Director of the Cyber Security Foundations group at CERT within CMU’s Software Engineering Institute. His team focuses on foundational research on the life cycle for building secure software and on data-driven analysis of cyber security. Before coming to CERT, Dr. Sherman was at IBM and various startups, working on a mobile systems, integrated hardware-software appliances, transaction processing, languages and compilers, virtualization, network protocols and databases. He has published over 50 papers on various topics in computer science.
5 things i wish i knew about sast (DSO-LG July 2021)Michael Man
In this talk Florin Coada, who's been dealing with SAST over the last 7 years, will share some of his top tips to achieve more SASTisfaction from your tooling. Each tip will come with a little story that shows why this tip made it to the top 5 list.
The presentation will give you an idea the secure coding practices. The points mentioned here, I would say is the minimum you should consider while developing an application
An Example of use the Threat Modeling Tool (FFRI Monthly Research Nov 2016)FFRI, Inc.
• About threat analysis support tool
• Examples of tools
• Analysis target system
• Analysis result
– How to read result
– Overview of threats
• Effective usage
– About template
– Additional definition of threat information
• Conclusions
• References
I'm Ian. I do that geek thing.
This is an introductory deck on why an SDL or quality/secure software program is a good idea.
I can be found here:
http://gorrie.org
@gorrie
What's in your personal threat model? What assets are you trying to protect? Learn how to improve your personal security and privacy online through best practices and security tips. This talk is for everyone, whether your a seasoned security professional or complete novice hopefully you will take away a few areas where you can better protect your personal information.
Video Link: https://www.youtube.com/watch?v=PIwvxSZj5e8
Finacle paper on secure coding practices gives an insight into application coding security and highlights how comprehensive approach in security is need to not only secure code but also web servers and databases.
As delusions of effective risk management for application environments continue to spread, companies continue to bleed large amounts of security spending without truly knowing if the amount is warranted, effective, or even elevating security at all. In parallel, hybrid, thought-provoking security strategies are moving beyond conceptual ideas to practical applications within ripe environments. Application Threat Modeling is one of those areas that, beyond the hype, provides practical and sensible security strategy that leverages already existing security efforts for an improved threat model of what is lurking in the shadows.
Tony UcedaVelez, Managing Director
An experienced security management professional, Tony has more than 10 years of hands-on security and technology experience and is a vocal advocate of security process engineering – a term that describes the design and development of secure processes and controls working symbiotically to create a unique business workflow. Tony currently serves as Managing Director for an Atlanta based risk advisory firm that focuses on security strategy and delivering effective means for risk mitigation and security process engineering. He has worked and consulted for the Fortune 500, as well as federal agencies in the U.S. on the topic of application security and security process engineering.
How to develop an AppSec culture in your project 99X Technology
Cyber attack is the greatest threat to every profession, every industry and every company in the world. Here are slides which will help you learn the challenges, prevent, detect and respond to Cyber threats and help safeguard the organization from every increasing security breaches.
This slide set describes developing an AppSec culture in your projects. This includes how to implement security risk assessment program, threat modeling and security designs and tools for security Automation.
Penetration testing reporting and methodologyRashad Aliyev
This paper covering information about Penetration testing methodology, standards reporting formats and comparing reports. Explained problem of Cyber Security experts when they making penetration tests. How they doing current presentations.
We will focus our work in penetration testing methodology reporting form and detailed information how to compare result and related work information.
"CERT Secure Coding Standards" by Dr. Mark ShermanRinaldi Rampen
OWASP DC - November 2015 Talk
Abstract:
This presentation will start with an overview of CERT’s view of the tools, technologies and processes for building secure software from requirements to operational deployment, including architecture, design, coding and testing. After providing the context for building secure software, the discussion will focus on the current state of the CERT Coding Standards: what is available, how the rules evolve and how the rules are put into practice.
Bio:
Dr. Mark Sherman is the Technical Director of the Cyber Security Foundations group at CERT within CMU’s Software Engineering Institute. His team focuses on foundational research on the life cycle for building secure software and on data-driven analysis of cyber security. Before coming to CERT, Dr. Sherman was at IBM and various startups, working on a mobile systems, integrated hardware-software appliances, transaction processing, languages and compilers, virtualization, network protocols and databases. He has published over 50 papers on various topics in computer science.
5 things i wish i knew about sast (DSO-LG July 2021)Michael Man
In this talk Florin Coada, who's been dealing with SAST over the last 7 years, will share some of his top tips to achieve more SASTisfaction from your tooling. Each tip will come with a little story that shows why this tip made it to the top 5 list.
The presentation will give you an idea the secure coding practices. The points mentioned here, I would say is the minimum you should consider while developing an application
An Example of use the Threat Modeling Tool (FFRI Monthly Research Nov 2016)FFRI, Inc.
• About threat analysis support tool
• Examples of tools
• Analysis target system
• Analysis result
– How to read result
– Overview of threats
• Effective usage
– About template
– Additional definition of threat information
• Conclusions
• References
I'm Ian. I do that geek thing.
This is an introductory deck on why an SDL or quality/secure software program is a good idea.
I can be found here:
http://gorrie.org
@gorrie
What's in your personal threat model? What assets are you trying to protect? Learn how to improve your personal security and privacy online through best practices and security tips. This talk is for everyone, whether your a seasoned security professional or complete novice hopefully you will take away a few areas where you can better protect your personal information.
Video Link: https://www.youtube.com/watch?v=PIwvxSZj5e8
Finacle paper on secure coding practices gives an insight into application coding security and highlights how comprehensive approach in security is need to not only secure code but also web servers and databases.
As delusions of effective risk management for application environments continue to spread, companies continue to bleed large amounts of security spending without truly knowing if the amount is warranted, effective, or even elevating security at all. In parallel, hybrid, thought-provoking security strategies are moving beyond conceptual ideas to practical applications within ripe environments. Application Threat Modeling is one of those areas that, beyond the hype, provides practical and sensible security strategy that leverages already existing security efforts for an improved threat model of what is lurking in the shadows.
Tony UcedaVelez, Managing Director
An experienced security management professional, Tony has more than 10 years of hands-on security and technology experience and is a vocal advocate of security process engineering – a term that describes the design and development of secure processes and controls working symbiotically to create a unique business workflow. Tony currently serves as Managing Director for an Atlanta based risk advisory firm that focuses on security strategy and delivering effective means for risk mitigation and security process engineering. He has worked and consulted for the Fortune 500, as well as federal agencies in the U.S. on the topic of application security and security process engineering.
How to develop an AppSec culture in your project 99X Technology
Cyber attack is the greatest threat to every profession, every industry and every company in the world. Here are slides which will help you learn the challenges, prevent, detect and respond to Cyber threats and help safeguard the organization from every increasing security breaches.
This slide set describes developing an AppSec culture in your projects. This includes how to implement security risk assessment program, threat modeling and security designs and tools for security Automation.
Mike Spaulding - Building an Application Security Programcentralohioissa
Application Security in many organizations is a simply a 'wish list' item, but with some staff and some training, AppSec can be a reality, even for a small organization. This talk will discuss the best practices, strategies and tactics, and resource planning to build an internal AppSec function - enterprise to 'mom & pop' operations will all benefit from this talk.
Penetration Testing is interesting and difficult work.
The main result of this work is Report. It can be used for Customer Presentation, Vulnerabilities Mitigation and Audit Compliance. Report is final proof of completed work and good overall score of Security Status.
Project Quality-SIPOCSelect a process of your choice and creat.docxwkyra78
Project Quality-SIPOC
Select a process of your choice and create a SIPOC for this process. Explain the utility of a SIPOC in the context of project management.
(
Application security in large enterprises (part 2)
Student Name:
) (
Instructor Name
)
Detailed Description:
Large enterprises of a thousand persons or more often have distinctly distinct data security architectures than lesser businesses. Typically they treat their data security as if they were still little companies.
This paper endeavors to demonstrate that not only do large businesses have an entire ecology of focused programs, specific to large businesses and their needs, but that this software has distinct security implications than buyer or small enterprise software. identifying these dissimilarities, and analyzing the way this can be taken advantage of by an attacker, is the key to both striking and keeping safe a large enterprise.
The Web applications are the important part of your business every day, they help you handle your intellectual property, increase your sales, and keep the trust of your customers. But there's the problem that applications re fast becoming the preferred attack vector of hackers. For this you really need something that makes your application secure.
And, with the persistent condition of today's attacks, applications can easily be get infected when security is not considered and scoped into each phase of the software development life cycle, from design to development to testing and ongoing maintenance of the application. When you take a holistic approach to your application security, you actually enhance your ability to produce and manage stable, secure applications. Applications need training and testing from the leading team of ethical hackers, for this there should be an authentic plan to recover these issues that can help an organization to plan, test, build and run applications smartly and safely.
Large enterprises of a thousand people or even more have distinctly different information security architectures than many other smaller companies. Actually, they treat their information security as if they were still small companies.
We are going to discuss some attempts to demonstrate that not only do large companies have an entire ecology of specialized software, specific to large companies and their needs, but that this software has different security implications than consumer or small business software for the applications. Recognizing these differences, and examining the way this can be taken advantage of by an attacker, is the key to both attacking and defending a large enterprise. It’s really important to cover up the security procedures in the large enterprise.
Key Features:
· Web application security checking from development through output
· Security check web APIs and world wide web services that support your enterprise
· Effortlessly organize, view and share security-test outcomes and histories
· Endow broader lifecycle adoption th ...
For Business's Sake, Let's focus on AppSecLalit Kale
Slide-Deck for session on Application Security at Limerick DotNet-Azure User Group on 15th Feb, 2018
Event URL: https://www.meetup.com/Limerick-DotNet/events/hzctdpyxdbtb/
chap-1 : Vulnerabilities in Information SystemsKashfUlHuda1
Introduction to Cyber Security. Chapter #1. Vulnerabilities in Information Systems. What is a vulnerability?
Cyberspace: From terra incognita to terra nullius.
Cyberspace performance expectations. Measuring vulnerabilities. CVSS XCCDF OVAL
Avoiding vulnerabilities through secure coding
This webinar series is designed to help internal auditors looking to equip themselves with competencies and confidence to handle audit of IT controls and information security, and learn about the emerging technologies and their underlying risks
The series focuses on contemporary IT audit approaches relevant to Internal Auditors and the processes underlying risk based IT audits.
Session 6 of 10
This Webinar focuses on Application Security
• Application security logging and monitoring
• Issues in current logging practices
• Resources required by developers for security logging
• Correlating and alerting from log sources
• Logging in multi-tiered architectures and disparate systems
• Application security logging requirements
Security Testing Approach for Web Application Testing.pdfAmeliaJonas2
There are numerous web security testing tools available to aid in the process. One such tool is Astra's Pentest Solution. Astra offers a comprehensive suite of Security Testing Services, including vulnerability scanning, penetration testing, and code reviews. It provides automated scanning and analysis of web applications to identify vulnerabilities and suggest remediation measures.
Because many organizations don't perform security unless they have to, more than 80% of all web applications are being exposed to vulnerabilities. In comes regulation. There are a number of different industries other than financial and healthcare that deal with PII and PHI but are either not regulated at all or are regulated very loosely. This presentation will discuss the various regulations (PCI, SOX, HIPAA, etc.) and what each does to address web application security, if any, as well as the shortcomings of each. Finally, it will further address industries that need to be more strictly regulated in order to better protect personal information.
Andrew Weidenhamer, Senior Security Consultant, SecureState
Andrew Weidenhamer, Senior Security Consultant, joined SecureState in January 2008. As a former member of the Profiling Team, Andrew performed technical security assessments on a weekly basis. These assessments included Internal and External Attack and Penetration Assessments, Wireless Penetration Assessments, Web Application Security Reviews, Physical Penetration Tests, and Social Engineering Assessments.
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Denim Group
HP Protect 2015 Presentation with Denim Group's John Dickson and HP's Bruce Jenkins - Software security historically has been a bolt-on afterthought, frequently a "nice to do" and not a "must do" activity in many organizations. Despite the obvious need to build security in from the outset, organizations continue to struggle to gain momentum and focus resources in support of a structured and measurable software security assurance program. How can organizations determine the best-fit activities and appropriate resource allocation levels to adequately address software risk? How can security leaders know what other organizations are doing to produce more secure software? This session provides an overview of the Open Software Assurance Maturity Model (OpenSAMM) framework and illustrates how organizations can use it to give their security program the edge necessary to stay competitive in today's DevOps world and need-for-speed go-to-market strategies. The session includes case studies on how organizations are using comparative data and OpenSAMM benchmarking to realize measurable software security improvement.
Originally shared here - https://sessioncatalog.hpglobalevents.com/go/agendabuilder.sessions/?l=19&sid=4026_2744&locale=en_US
CompTIA exam study guide presentations by instructor Brian Ferrill, PACE-IT (Progressive, Accelerated Certifications for Employment in Information Technology)
"Funded by the Department of Labor, Employment and Training Administration, Grant #TC-23745-12-60-A-53"
Learn more about the PACE-IT Online program: www.edcc.edu/pace-it
Similar to Application Security Testing for Software Engineers: An approach to build software resilient to attacks (20)
Listen to the keynote address and hear about the latest developments from Rachana Ananthakrishnan and Ian Foster who review the updates to the Globus Platform and Service, and the relevance of Globus to the scientific community as an automation platform to accelerate scientific discovery.
Prosigns: Transforming Business with Tailored Technology SolutionsProsigns
Unlocking Business Potential: Tailored Technology Solutions by Prosigns
Discover how Prosigns, a leading technology solutions provider, partners with businesses to drive innovation and success. Our presentation showcases our comprehensive range of services, including custom software development, web and mobile app development, AI & ML solutions, blockchain integration, DevOps services, and Microsoft Dynamics 365 support.
Custom Software Development: Prosigns specializes in creating bespoke software solutions that cater to your unique business needs. Our team of experts works closely with you to understand your requirements and deliver tailor-made software that enhances efficiency and drives growth.
Web and Mobile App Development: From responsive websites to intuitive mobile applications, Prosigns develops cutting-edge solutions that engage users and deliver seamless experiences across devices.
AI & ML Solutions: Harnessing the power of Artificial Intelligence and Machine Learning, Prosigns provides smart solutions that automate processes, provide valuable insights, and drive informed decision-making.
Blockchain Integration: Prosigns offers comprehensive blockchain solutions, including development, integration, and consulting services, enabling businesses to leverage blockchain technology for enhanced security, transparency, and efficiency.
DevOps Services: Prosigns' DevOps services streamline development and operations processes, ensuring faster and more reliable software delivery through automation and continuous integration.
Microsoft Dynamics 365 Support: Prosigns provides comprehensive support and maintenance services for Microsoft Dynamics 365, ensuring your system is always up-to-date, secure, and running smoothly.
Learn how our collaborative approach and dedication to excellence help businesses achieve their goals and stay ahead in today's digital landscape. From concept to deployment, Prosigns is your trusted partner for transforming ideas into reality and unlocking the full potential of your business.
Join us on a journey of innovation and growth. Let's partner for success with Prosigns.
Modern design is crucial in today's digital environment, and this is especially true for SharePoint intranets. The design of these digital hubs is critical to user engagement and productivity enhancement. They are the cornerstone of internal collaboration and interaction within enterprises.
Large Language Models and the End of ProgrammingMatt Welsh
Talk by Matt Welsh at Craft Conference 2024 on the impact that Large Language Models will have on the future of software development. In this talk, I discuss the ways in which LLMs will impact the software industry, from replacing human software developers with AI, to replacing conventional software with models that perform reasoning, computation, and problem-solving.
Unleash Unlimited Potential with One-Time Purchase
BoxLang is more than just a language; it's a community. By choosing a Visionary License, you're not just investing in your success, you're actively contributing to the ongoing development and support of BoxLang.
Developing Distributed High-performance Computing Capabilities of an Open Sci...Globus
COVID-19 had an unprecedented impact on scientific collaboration. The pandemic and its broad response from the scientific community has forged new relationships among public health practitioners, mathematical modelers, and scientific computing specialists, while revealing critical gaps in exploiting advanced computing systems to support urgent decision making. Informed by our team’s work in applying high-performance computing in support of public health decision makers during the COVID-19 pandemic, we present how Globus technologies are enabling the development of an open science platform for robust epidemic analysis, with the goal of collaborative, secure, distributed, on-demand, and fast time-to-solution analyses to support public health.
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoamtakuyayamamoto1800
In this slide, we show the simulation example and the way to compile this solver.
In this solver, the Helmholtz equation can be solved by helmholtzFoam. Also, the Helmholtz equation with uniformly dispersed bubbles can be simulated by helmholtzBubbleFoam.
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...Globus
The U.S. Geological Survey (USGS) has made substantial investments in meeting evolving scientific, technical, and policy driven demands on storing, managing, and delivering data. As these demands continue to grow in complexity and scale, the USGS must continue to explore innovative solutions to improve its management, curation, sharing, delivering, and preservation approaches for large-scale research data. Supporting these needs, the USGS has partnered with the University of Chicago-Globus to research and develop advanced repository components and workflows leveraging its current investment in Globus. The primary outcome of this partnership includes the development of a prototype enterprise repository, driven by USGS Data Release requirements, through exploration and implementation of the entire suite of the Globus platform offerings, including Globus Flow, Globus Auth, Globus Transfer, and Globus Search. This presentation will provide insights into this research partnership, introduce the unique requirements and challenges being addressed and provide relevant project progress.
Code reviews are vital for ensuring good code quality. They serve as one of our last lines of defense against bugs and subpar code reaching production.
Yet, they often turn into annoying tasks riddled with frustration, hostility, unclear feedback and lack of standards. How can we improve this crucial process?
In this session we will cover:
- The Art of Effective Code Reviews
- Streamlining the Review Process
- Elevating Reviews with Automated Tools
By the end of this presentation, you'll have the knowledge on how to organize and improve your code review proces
Understanding Globus Data Transfers with NetSageGlobus
NetSage is an open privacy-aware network measurement, analysis, and visualization service designed to help end-users visualize and reason about large data transfers. NetSage traditionally has used a combination of passive measurements, including SNMP and flow data, as well as active measurements, mainly perfSONAR, to provide longitudinal network performance data visualization. It has been deployed by dozens of networks world wide, and is supported domestically by the Engagement and Performance Operations Center (EPOC), NSF #2328479. We have recently expanded the NetSage data sources to include logs for Globus data transfers, following the same privacy-preserving approach as for Flow data. Using the logs for the Texas Advanced Computing Center (TACC) as an example, this talk will walk through several different example use cases that NetSage can answer, including: Who is using Globus to share data with my institution, and what kind of performance are they able to achieve? How many transfers has Globus supported for us? Which sites are we sharing the most data with, and how is that changing over time? How is my site using Globus to move data internally, and what kind of performance do we see for those transfers? What percentage of data transfers at my institution used Globus, and how did the overall data transfer performance compare to the Globus users?
Quarkus Hidden and Forbidden ExtensionsMax Andersen
Quarkus has a vast extension ecosystem and is known for its subsonic and subatomic feature set. Some of these features are not as well known, and some extensions are less talked about, but that does not make them less interesting - quite the opposite.
Come join this talk to see some tips and tricks for using Quarkus and some of the lesser known features, extensions and development techniques.
A Comprehensive Look at Generative AI in Retail App Testing.pdfkalichargn70th171
Traditional software testing methods are being challenged in retail, where customer expectations and technological advancements continually shape the landscape. Enter generative AI—a transformative subset of artificial intelligence technologies poised to revolutionize software testing.
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...Anthony Dahanne
Les Buildpacks existent depuis plus de 10 ans ! D’abord, ils étaient utilisés pour détecter et construire une application avant de la déployer sur certains PaaS. Ensuite, nous avons pu créer des images Docker (OCI) avec leur dernière génération, les Cloud Native Buildpacks (CNCF en incubation). Sont-ils une bonne alternative au Dockerfile ? Que sont les buildpacks Paketo ? Quelles communautés les soutiennent et comment ?
Venez le découvrir lors de cette session ignite
Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...Globus
The Earth System Grid Federation (ESGF) is a global network of data servers that archives and distributes the planet’s largest collection of Earth system model output for thousands of climate and environmental scientists worldwide. Many of these petabyte-scale data archives are located in proximity to large high-performance computing (HPC) or cloud computing resources, but the primary workflow for data users consists of transferring data, and applying computations on a different system. As a part of the ESGF 2.0 US project (funded by the United States Department of Energy Office of Science), we developed pre-defined data workflows, which can be run on-demand, capable of applying many data reduction and data analysis to the large ESGF data archives, transferring only the resultant analysis (ex. visualizations, smaller data files). In this talk, we will showcase a few of these workflows, highlighting how Globus Flows can be used for petabyte-scale climate analysis.
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...Juraj Vysvader
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I didn't get rich from it but it did have 63K downloads (powered possible tens of thousands of websites).
Innovating Inference - Remote Triggering of Large Language Models on HPC Clus...Globus
Large Language Models (LLMs) are currently the center of attention in the tech world, particularly for their potential to advance research. In this presentation, we'll explore a straightforward and effective method for quickly initiating inference runs on supercomputers using the vLLM tool with Globus Compute, specifically on the Polaris system at ALCF. We'll begin by briefly discussing the popularity and applications of LLMs in various fields. Following this, we will introduce the vLLM tool, and explain how it integrates with Globus Compute to efficiently manage LLM operations on Polaris. Attendees will learn the practical aspects of setting up and remotely triggering LLMs from local machines, focusing on ease of use and efficiency. This talk is ideal for researchers and practitioners looking to leverage the power of LLMs in their work, offering a clear guide to harnessing supercomputing resources for quick and effective LLM inference.
Experience our free, in-depth three-part Tendenci Platform Corporate Membership Management workshop series! In Session 1 on May 14th, 2024, we began with an Introduction and Setup, mastering the configuration of your Corporate Membership Module settings to establish membership types, applications, and more. Then, on May 16th, 2024, in Session 2, we focused on binding individual members to a Corporate Membership and Corporate Reps, teaching you how to add individual members and assign Corporate Representatives to manage dues, renewals, and associated members. Finally, on May 28th, 2024, in Session 3, we covered questions and concerns, addressing any queries or issues you may have.
For more Tendenci AMS events, check out www.tendenci.com/events
2. Who Am I?
• Software Engineer based in Costa Rica
• OWASP Costa Rica Chapter Leader
• Recurrent Speaker on Application Security
conferences
• Head of Software Development Engineering
at DeepRecce, a Cybersecurity company
with offices in Costa Rica.
• Hacker looking for challenging the Status
Quo
3. Disclaimer
The opinions expressed in this presentation and on the following
slides are solely my own and not necessarily those of my
employee.
The techniques presented on this talk have the unique purpose
of teaching and creating awareness about Application Security.
4. –Michael Howard, Microsoft Senior Security Program Manager
“If your engineers know nothing about the basic security tenets,
common security defect types, basic secure design, or security
testing, there really is no reasonable chance they could produce
secure software.”
5. Why this presentation?
• According to Verizon DBIR 2016: Web
Application Attacks are the #1 Source of
Data Breaches.
Source: Verizon 2016 Data Breach Investigation Report:
https://www.verizondigitalmedia.com/blog/2016/06/verizon-dbir-2016-web-application-attacks-are-the-1-source-of-data-breaches
6. Why this presentation?
• Looking to the future : Cisco IBSG predicts
there will be 50 billion devices connected to
the Internet by 2020
Source: Cisco Internet Business Solutions Group The Internet of Things How the Next Evolution of the Internet Is Changing Everything
http://www.cisco.com/c/dam/en_us/about/ac79/docs/innov/IoT_IBSG_0411FINAL.pdf
12. 1. Confidentiality
• Security concept that has to do with
protection against unauthorized information
disclosure.
• It also helps to maintain data privacy.
• It is the concept of preventing the
disclosure of information to unauthorized
parties.
• Core function is keeping secrets secret.
13. 2. Integrity
• Refers to protecting data from unauthorized
alteration.
• Is the measure of software resiliency.
• Integrity software ensure that the data that
are transmitted, processed and stored are
as accurate as the originator intended.
• It must ensure that software performs
reliably.
14. 3. Availability
• Access to the system by authorized
personnel.
• Criticality of data and it uses in the system
are essential factors to determine system’s
availability.
• Service Level Agreement (SLA) is an
instrument that can be used to explicitly
state and govern availability requirements
for business partners and clients.
15. 4. Authentication
• Process of determining the identity of a user.
• Foundational element of security.
• It ensures that only valid users are admitted.
• It is the process used to verify into a
computer system that the individual is who it
claims to be.
• Three methods are used:
• Something you know.
• Something you have.
• Something you are.
16. 5. Authorization
• Process of applying access control rules to
a user process.
• Determines whether or not a user has
access to a given object.
• Access to objects is controlled based on
the rights and privileges that are granted to
a requestor by the owner of the data or
system.
• Once we know who you are, authorization
responds to the question, What do you
have access to?
17. 6. Auditing/Logging
• Passive detective control mechanism.
• Nonrepudiation addresses the deniability of
actions taken either by a user or software
on behalf o a user.
• Auditing can be seen as a form of recording
historical events on a system.
19. The Core Of Application Security : User can submit arbitrary input
• The end user is outside of the application’s control, and they could send
arbitrary input to the server-side application.
• The application must always treat all input as if it was damaging.
• It is important to ensure that the input data cannot be manipulated to interfere
with the application business logic.
• Most of the attacks targeting Web applications, contains crafted payloads to
trigger an event that was not considered by the application or by it’s design.
Source: The Web Application Hacker Handbook 2nd Edition, page 9
20. All Input is Evil!
URL
Form fields
GET
Parameters
POST
Payloads
HTTP
Headers
Web
Services
Cookies
External
Services
Database
22. Image taken from : http://blog.prestonbailey.com/files/2010/11/Overcoming-Challenging-Obstacles.jpg
Application Security Implementation Challenges
23. Iron Triangle Constraints
• A software development project, from design to implementation, there is a
need for Schedule (time), Scope (resources) and Budget (cost).
• Resources with technical skills and knowledge are not always readily available.
• Having the need to incorpore security into the software is seen as an extra and
costly activity.
• Constraints in terms of Schedule, Scope and Budget are sometimes the
reasons why security is left behind.
24. Security as an Afterthought
• Sometimes security is being considered as an afterthought and a process that
is hard to justify as a part of the security investment.
• The value added of security into an application is not easy to show.
• End users don’t perceive security as an asset in their day to day activities.
• Addressing security vulnerabilities before a product is released is very
expensive.
25. Security versus Usability
• Traditionally, security has had a negative impact in the usability of the software.
That is, the software is seen more complex, more restrictive and less usable.
• As an example, a secure password policy might force the users to follow a
pattern including a minimum and maximum of characters, upper and lower
case and numbers.
• Sometimes when detective controls (e.g logs) are included into the system, it
leads to slowdown the process and you can find users complaining about the
security measure slowed down the operation because of the amount of time it
takes to execute a process.
29. Writing Insecure Code is relatively easy.
What if there is an error
inside this function?
This code will be
executed.
Source: Writing Secure Code 2nd Edition. Michael Howard and David LeBlanc page 65
30. Overwhelming number of Javascript frameworks.
Image source: https://hackernoon.com/how-it-feels-to-learn-javascript-in-2016-d3a717dd577f#.2mwrox3hf
32. Why Good engineers write
bad code?
• Technical Factors: Intrinsic complexity in
underlaying technologies.
• Physiological Factors: Programmers are
humans and security errors are easy to
overlook.
• Risk Assessment Problems: It’s hard to find
a security issue in a code review if we don’t
understand what security means.
35. Security is everyone’s job
• Security is Holistic: Software is only as secure as the weakest link.
• Application, Host and Network needs to be secured adequately and
appropriately.
• Builders must practice Secure Engineering.
• Operations must continue architecting reasonable networks.
• Executives must understand how early investment on security design and
analysis affects their products.
36. Security must be a priority on every Software Development Team
Source: Introduction to the Microsoft Secure Development Lifecycle (SDL)
https://download.microsoft.com/download/9/3/5/935520EC-D9E2-413E-BEA7-0B865A79B18C/Introduction%20to%20the%20Microsoft%20Security%20Development%20Lifecycle%20(SDL).ppsx
Education Accountability
Administer and track security
training
Incident
Response
(MSRC)
Establish release criteria and
sign-off as part of FSR
Ongoing Process Improvements
Process
Guide product teams to meet
SDL requirements
38. What is Application Security Testing?
• Security Testing is different.
• It is about demonstrating that a tester can’t spoof a user’s identity.
• It is about verifying that a tester can’t tamper parameters.
• Security Testing is about proving that defensive mechanisms work correctly.
• Type of testing focused on checking that some features appear to fail.
• A security test is a method of evaluating the security of a computer system or
network by methodically validating and verifying the effectiveness of application
security controls.
52. OWASP Zed Attack Proxy Project
• It is one of the world’s most popular free security tools and is actively
maintained by hundreds of international volunteers.
• It can help you automatically find security vulnerabilities in your web
applications while you are developing and testing your applications.
• Its also a great tool for experienced pentesters to use for manual security
testing.
55. OWASP Code Review Guide
• Alpha Release OWASP Code Review 2.0
• It is a technical book written for those responsible for code reviews
(management, developers, security professionals).
• While security scanners are improving every day the need for manual security
code reviews still needs to have a prominent place in organizations SDLC
(Secure development life cycle) that desires good secure code in production.
Full access to the Code Review Guide here : https://www.owasp.org/index.php/Category:OWASP_Code_Review_Project
56. ISTQB: Advanced Security Tester
Full access to the Certification here : http://www.istqb.org/certification-path-root/advanced-security-tester/advanced-security-tester-contents.html
58. Other references
• The Open Web Application Security Project OWASP https://www.owasp.org/
index.php/Main_Page
• Microsoft Secure Development Lifecycle https://www.microsoft.com/en-us/
sdl/
• Infosec Institute Penetration Testing Methodology and Standards http://
resources.infosecinstitute.com/penetration-testing-methodologies-and-
standards/
• ISTQB Security Tester http://www.istqb.org/certification-path-root/advanced-
security-tester.html